Browser Hijack and probable trojan

grey hair · March 21, 2012

Hi guys,

I appear to have a nasty little problem. Have run malwayebytes quick scan plus AVG 2012. Nothing seems to remove it. AVG keeps going off like a frog in a sock every 10 minutes when it finds another threat. Then, everytime I go on internet with Firefox sometimes it will go to right page, most times it wont and random extra tag pages start to open up for shopping sites. Any help would be greatly appreciated. Thanks. Logs attached.

dds.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_31

Run by Owner at 10:26:22 on 2012-03-21

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.599 [GMT 10:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\CAP3RSK.EXE

C:\WINDOWS\system32\CNAB3RPK.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Greenshot\Greenshot.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com.au/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: CashKeywords Toolbar: {9eb64fa9-57c4-4a41-9940-e12e0418b693} - c:\program files\cashkeywords\prxtbCas1.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll

BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: CashKeywords Toolbar: {9eb64fa9-57c4-4a41-9940-e12e0418b693} - c:\program files\cashkeywords\prxtbCas1.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll

BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll

TB: CashKeywords Toolbar: {9eb64fa9-57c4-4a41-9940-e12e0418b693} - c:\program files\cashkeywords\prxtbCas1.dll

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [iSUSPM] "c:\documents and settings\all users\application data\flexnet\connect\11\ISUSPM.exe" -scheduler

uRun: [Greenshot] c:\program files\greenshot\Greenshot.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [CAP3ON] c:\windows\system32\spool\drivers\w32x86\3\CAP3ONN.EXE

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Nuance PDF Reader-reminder] "c:\program files\nuance\pdf reader\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\pdf reader\ereg\Ereg.ini"

mRun: [OPSE reminder] "c:\program files\scansoft\omnipagese2.0\eregeng\ereg.exe" -r "c:\program files\scansoft\omnipagese2.0\eregeng\ereg.ini"

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

mRun: [ASUS Update Checker] c:\program files\asus\asusupdate\updatechecker\UpdateChecker.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\canonl~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\CAP3LAK.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll

LSP: mswsock.dll

Trusted Zone: iinet.net.au\www

Trusted Zone: microsoft.com\*.update

Trusted Zone: windowsupdate.com\download

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://aussieshort.webex.com/client/T26L/webex/ieatgpc.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 10.1.1.1

TCP: Interfaces\{771ED046-B0D8-4D60-924C-023E337AB576} : DhcpNameServer = 10.1.1.1

TCP: Interfaces\{E1477D81-BC16-4761-A523-3A4FE3C6131C} : DhcpNameServer = 10.1.1.1

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\4a4uylfi.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\4a4uylfi.default\extensions\{9eb64fa9-57c4-4a41-9940-e12e0418b693}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\4a4uylfi.default\extensions\{9eb64fa9-57c4-4a41-9940-e12e0418b693}\components\RadioWMPCore.dll

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\4a4uylfi.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\winnt_x86-msvc\components\pagespeed.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll

FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll

FF - plugin: c:\program files\nuance\pdf reader\bin\nppdf.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 230608]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 40016]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 295248]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 16720]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-11-24 222976]

S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-20 135664]

S2 mferkdk;FlexBios;c:\windows\system32\svchost.exe -k netsvcs [2006-2-28 14336]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-12-20 135664]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-3-21 40776]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2012-03-20 22:25:06 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-03-20 21:54:41 0 --sha-w- c:\windows\system32\dds_trash_log.cmd

2012-03-20 14:25:16 -------- d-----w- c:\program files\Microsoft Research

2012-03-17 03:44:22 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll

2012-03-17 03:44:22 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll

2012-03-06 11:03:21 -------- d-----w- c:\documents and settings\owner\application data\YCanPDF

2012-03-06 11:03:16 -------- d-----w- C:\tmp

2012-03-06 11:03:16 -------- d-----w- C:\output

2012-03-06 03:02:39 -------- d-----w- c:\documents and settings\owner\application data\Iona Photo-Book Publisher

2012-03-04 05:42:22 -------- d-----w- c:\documents and settings\owner\application data\calibre

2012-03-04 05:41:12 -------- d-----w- c:\program files\Calibre2

2012-02-29 04:44:57 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll

2012-02-29 04:44:57 3072 ------w- c:\windows\system32\iacenc.dll

.

==================== Find3M ====================

.

2012-02-28 14:03:34 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-27 05:34:10 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-02-27 05:34:08 472808 ----a-w- c:\windows\system32\deployJava1.dll

2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys

2012-01-18 04:58:39 737280 ----a-w- c:\windows\iun6002.exe

2012-01-09 16:20:25 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

.

============= FINISH: 10:27:28.78 ===============

attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 5/09/2006 10:51:27 AM

System Uptime: 21/03/2012 10:09:26 AM (0 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5KPL-CM

Processor: Intel® Pentium® Dual CPU E2200 @ 2.20GHz | Socket 775 | 2218/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 233 GiB total, 47.65 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is FIXED (NTFS) - 932 GiB total, 714.774 GiB free.

G: is FIXED (NTFS) - 75 GiB total, 13.274 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}

Description: Microsoft PS/2 Mouse

Device ID: ACPI\PNP0F03\4&2C575ACB&0

Manufacturer: Microsoft

Name: Microsoft PS/2 Mouse

PNP Device ID: ACPI\PNP0F03\4&2C575ACB&0

Service: i8042prt

.

==== System Restore Points ===================

.

RP145: 22/12/2011 10:50:40 AM - System Checkpoint

RP146: 23/12/2011 11:39:35 AM - System Checkpoint

RP147: 24/12/2011 12:25:47 PM - System Checkpoint

RP148: 26/12/2011 1:22:48 PM - System Checkpoint

RP149: 27/12/2011 2:12:31 PM - System Checkpoint

RP150: 28/12/2011 3:26:20 PM - System Checkpoint

RP151: 29/12/2011 4:34:26 PM - System Checkpoint

RP152: 30/12/2011 4:50:52 PM - System Checkpoint

RP153: 31/12/2011 5:37:05 PM - System Checkpoint

RP154: 1/01/2012 6:19:20 PM - System Checkpoint

RP155: 2/01/2012 6:30:44 PM - System Checkpoint

RP156: 3/01/2012 6:31:12 PM - System Checkpoint

RP157: 3/01/2012 9:02:35 AM - System Checkpoint

RP158: 4/01/2012 10:00:09 AM - System Checkpoint

RP159: 4/01/2012 2:14:34 PM - Software Distribution Service 3.0

RP160: 5/01/2012 3:28:17 PM - System Checkpoint

RP161: 7/01/2012 9:57:18 AM - System Checkpoint

RP162: 8/01/2012 3:40:41 PM - System Checkpoint

RP163: 9/01/2012 9:08:55 PM - System Checkpoint

RP164: 10/01/2012 9:21:05 PM - System Checkpoint

RP165: 11/01/2012 3:45:50 PM - Software Distribution Service 3.0

RP166: 12/01/2012 4:43:26 PM - System Checkpoint

RP167: 13/01/2012 5:26:13 PM - System Checkpoint

RP168: 14/01/2012 6:17:28 PM - System Checkpoint

RP169: 15/01/2012 6:25:49 PM - System Checkpoint

RP170: 16/01/2012 6:33:22 PM - System Checkpoint

RP171: 17/01/2012 6:34:38 PM - System Checkpoint

RP172: 18/01/2012 6:58:07 PM - System Checkpoint

RP173: 19/01/2012 12:09:12 PM - Software Distribution Service 3.0

RP174: 19/01/2012 12:38:01 PM - Installed Windows Internet Explorer 8.

RP175: 20/01/2012 1:07:34 PM - System Checkpoint

RP176: 21/01/2012 2:03:58 PM - System Checkpoint

RP177: 22/01/2012 4:13:46 PM - System Checkpoint

RP178: 23/01/2012 5:57:30 PM - System Checkpoint

RP179: 24/01/2012 6:30:54 PM - System Checkpoint

RP180: 25/01/2012 4:42:59 PM - Software Distribution Service 3.0

RP181: 26/01/2012 9:26:37 PM - System Checkpoint

RP182: 27/01/2012 10:15:51 PM - System Checkpoint

RP183: 28/01/2012 10:49:48 PM - System Checkpoint

RP184: 30/01/2012 10:10:08 AM - System Checkpoint

RP185: 31/01/2012 10:49:33 AM - System Checkpoint

RP186: 1/02/2012 11:13:55 AM - System Checkpoint

RP187: 2/02/2012 7:15:30 PM - System Checkpoint

RP188: 3/02/2012 9:06:34 PM - System Checkpoint

RP189: 4/02/2012 9:26:49 PM - System Checkpoint

RP190: 5/02/2012 10:13:10 PM - System Checkpoint

RP191: 6/02/2012 10:34:46 PM - System Checkpoint

RP192: 8/02/2012 7:54:25 AM - System Checkpoint

RP193: 9/02/2012 9:15:39 AM - System Checkpoint

RP194: 27/02/2012 3:32:45 PM - Removed Java™ 6 Update 27

RP195: 27/02/2012 3:33:40 PM - Installed Java™ 6 Update 31

RP196: 28/02/2012 3:44:01 PM - System Checkpoint

RP197: 29/02/2012 2:47:54 PM - Software Distribution Service 3.0

RP198: 1/03/2012 3:15:20 PM - System Checkpoint

RP199: 2/03/2012 3:28:45 PM - System Checkpoint

RP200: 3/03/2012 4:15:15 PM - System Checkpoint

RP201: 4/03/2012 3:41:07 PM - Installed calibre

RP202: 5/03/2012 5:42:05 PM - System Checkpoint

RP203: 6/03/2012 6:03:50 PM - System Checkpoint

RP204: 7/03/2012 6:55:16 PM - System Checkpoint

RP205: 8/03/2012 7:04:46 PM - System Checkpoint

RP206: 9/03/2012 7:55:24 PM - System Checkpoint

RP207: 10/03/2012 8:08:55 PM - System Checkpoint

RP208: 11/03/2012 8:31:07 PM - System Checkpoint

RP209: 12/03/2012 9:14:46 PM - System Checkpoint

RP210: 13/03/2012 4:00:49 PM - Software Distribution Service 3.0

RP211: 14/03/2012 5:52:45 PM - System Checkpoint

RP212: 15/03/2012 8:35:30 AM - Software Distribution Service 3.0

RP213: 16/03/2012 9:39:11 AM - System Checkpoint

RP214: 17/03/2012 9:58:16 AM - System Checkpoint

RP215: 18/03/2012 10:27:43 AM - System Checkpoint

RP216: 19/03/2012 10:32:24 AM - System Checkpoint

RP217: 20/03/2012 11:27:54 AM - System Checkpoint

RP218: 20/03/2012 11:12:42 PM - Software Distribution Service 3.0

RP219: 21/03/2012 12:25:15 AM - Installed Microsoft Image Composite Editor

.

==== Installed Programs ======================

.

7-Zip 4.65

Adobe Acrobat 6.0.1 Professional

Adobe Acrobat and Reader 6.0.3 Update

Adobe Acrobat and Reader 6.0.4 Update

Adobe Acrobat and Reader 6.0.5 Update

Adobe Acrobat and Reader 6.0.6 Update

Adobe Atmosphere Player for Acrobat and Adobe Reader

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.3.4

Adobe Shockwave Player

Alvin Phang's Atomic Blogging Keyword Research Tool v2.0

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Article Assistant

Ashampoo Burning Studio Elements 10.0.9

ASUSUpdate

Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver

Athlon 64 Processor Driver

Audacity 1.2.6

Auto Click Profit

AVG 2012

BlueVoda Website Builder 12.2

Bonjour

BookSmart® 2.8.0 2.8.0

calibre

CamStudio Lossless Codec

CamStudioIM

Camtasia Studio 6

Canon CanoScan Toolbox 4.5

Canon LASER SHOT LBP-1120

Canon LBP3000

CashKeywords Toolbar

CCleaner

Compatibility Pack for the 2007 Office system

ConvertHelper 2.2

ConvertXtoDVD 4.0.10.324

Creative Specifix® Memory Publisher

Critical Update for Windows Media Player 11 (KB959772)

CutePDF Writer 2.7

Directory Submitter 1.0.29

DP Animation Maker

DupeFree Pro

DupeFree Pro v2(remove only)

DVD Shrink 3.2

e-Record 6

e-tax 2008

e-tax 2009

e-tax 2010

e-tax 2011

eBridge Trader

Fast Content Producer

FileNet Desktop eForms

FileZilla Client 3.5.3

Forex Strategy Builder v2.60.0.0 Beta

FormatFactory 2.60

Free Video Joiner 1.1

Free WMA to MP3 Converter 1.16

GnuWin32: Wget-1.11.4-1

Good Keywords v3 121708

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Google Updater

GoToMeeting 4.8.0.723

Greenshot

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Internet Explorer 7 (KB947864)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HTML Slideshow Powertoy for Windows XP

Hubb Investor

HyperVRE 1.9.1

Ideal DVD Copy V3.2.5

Image Optimizer 3.0

Image Resizer Powertoy for Windows XP

ImgBurn

InstantArticleWizard

Intel® Graphics Media Accelerator Driver

iPhone Configuration Utility

iResizer 1.1

iTunes

Jalbum

Jalbum 8.1

Japanese Fonts Support For Adobe Reader 9

Java Auto Updater

Java™ 6 Update 3

Java™ 6 Update 31

Java™ 6 Update 5

Java™ 6 Update 6

Java™ 6 Update 7

Jing

jv16 PowerTools

Karen's Directory Printer

Karen's Replicator

Keyword Pad v1.0.112706

KeywordCorral

Lame ACM MP3 Codec

LAME v3.98.3 for Audacity

Legacy 5.0

Legacy 6.0

Lizardtech DjVu Control

Malwarebytes Anti-Malware version 1.60.1.1000

MassArticleCreator

Memory Publisher

MetaTrader- AxisTrader 4.00

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Image Composite Editor

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office Excel Viewer 2003

Microsoft Office XP Professional with FrontPage

Microsoft Publisher 2002

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 11.0 (x86 en-US)

Mozilla Thunderbird 10.0.2 (x86 en-US)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

My Free Web Site Builder

Myson Century USB Driver for Windows 98&ME

Nero 7 Ultra Edition

neroxml

Nuance PDF Reader

NVIDIA Drivers

Nvu 1.0PR

OTrader Software Option Pricing

OutFront Web Template

Passenger Arrivals 1839 - 1890

Passenger Arrivals 1839 - 1890 (C:\Program Files\Passenger Arrivals 1839 - 1890\)

PDF Password Remover v2.5

PE Builder 3.1.10a

Photo Story 3 for Windows

Photoupz 1.6

PIXresizer 1.0.8

Platform

Power Article Rewriter

PowerDVD

QFHSdatasearch

QuickTime

RAR Repair Tool v.4.0.1

Retouch Pilot Free 3.4.1

S3 Ripper 1.3

SAG Rookwood Cemetery v1.10

SAG Waverley and South Head Cemeteries v1.14

Samsung Master

Samsung Media Studio

SAMSUNG Mobile Composite Device Software

SAMSUNG Mobile Modem Driver Set

Samsung Mobile phone USB driver Software

SAMSUNG Mobile USB Modem 1.0 Software

SAMSUNG Mobile USB Modem Software

Samsung PC Studio 1.0 PIM & File Manager

Samsung PC Studio 3

Samsung_MonSetup

ScanSoft OmniPage SE 4

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB2544521)

Security Update for Windows Internet Explorer 7 (KB2618444)

Security Update for Windows Internet Explorer 7 (KB2647516)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB939653)

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows Internet Explorer 7 (KB944533)

Security Update for Windows Internet Explorer 7 (KB950759)

Security Update for Windows Internet Explorer 7 (KB953838)

Security Update for Windows Internet Explorer 7 (KB956390)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Internet Explorer 7 (KB961260)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows Media Player 9 (KB936782)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Serif PhotoPlus 7.0

Skype™ 4.1

Spelling Dictionaries Support For Adobe Reader 8

Swiff Player 1.5

TeamViewer 7

Traffic Travis 3.3.19

Traffic Travis 4.0.0

Traffic Travis 4.1.0

TrafficSeeker 7.0 Lite

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VIA Platform Device Manager

Vidmex 1.39

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

VLC media player 2.0.0

vReveal

VSeven MP4 Converter 1.0

Watermark Image software version 1.6.8.1

WebEx

WebFldrs XP

Winamp

Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)

Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer Clean Up

Windows Internet Explorer 7

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

WinHTTrack Website Copier 3.43-2

Wondershare PDF Converter (Build 2.6.2)

Wondershare PDF Converter (Build 3.0.0)

Wondershare Video Converter Ultimate(Build 5.4.3.0)

Wondershare Vivideo(Build 2.0.0.10)

WordFlood 1.2 (remove only)

WYSIWYG Web Builder 5.0

XHeader

XHeader Bonus Download

XML Paper Specification Shared Components Pack 1.0

XSitePro2

XviD MPEG-4 Video Codec

.

==== Event Viewer Messages From Past Week ========

.

21/03/2012 9:55:35 AM, error: Service Control Manager [7023] - The Sandradatasrv service terminated with the following error: Access is denied.

21/03/2012 9:50:00 AM, error: Schedule [7901] - The At20.job command failed to start due to the following error: %%2147943555

21/03/2012 9:50:00 AM, error: Schedule [7901] - The At19.job command failed to start due to the following error: %%2147942402

21/03/2012 9:39:55 AM, error: Service Control Manager [7023] - The BsHelpCS service terminated with the following error: Access is denied.

21/03/2012 9:24:54 AM, error: Service Control Manager [7023] - The REVOSENS service terminated with the following error: Access is denied.

21/03/2012 9:23:54 AM, error: Service Control Manager [7023] - The Vcsw service terminated with the following error: Access is denied.

21/03/2012 9:15:42 AM, error: Service Control Manager [7023] - The MRENDIS5 service terminated with the following error: The specified module could not be found.

21/03/2012 9:15:42 AM, error: Service Control Manager [7023] - The FlexBios service terminated with the following error: The specified module could not be found.

21/03/2012 9:15:42 AM, error: Service Control Manager [7023] - The DVDVRRdr_xp service terminated with the following error: The specified module could not be found.

21/03/2012 9:15:42 AM, error: Service Control Manager [7023] - The Ctaud2k service terminated with the following error: The specified module could not be found.

21/03/2012 9:10:27 AM, error: Service Control Manager [7023] - The Ssmdrv service terminated with the following error: Access is denied.

21/03/2012 8:55:27 AM, error: Service Control Manager [7023] - The Ctaud2k service terminated with the following error: Access is denied.

21/03/2012 8:50:07 AM, error: Schedule [7901] - The At18.job command failed to start due to the following error: %%2147943555

21/03/2012 8:50:01 AM, error: Schedule [7901] - The At17.job command failed to start due to the following error: %%2147942402

21/03/2012 8:40:31 AM, error: Service Control Manager [7023] - The FlexBios service terminated with the following error: Access is denied.

21/03/2012 8:25:17 AM, error: Service Control Manager [7023] - The MRENDIS5 service terminated with the following error: Access is denied.

21/03/2012 8:10:16 AM, error: Service Control Manager [7023] - The DVDVRRdr_xp service terminated with the following error: Access is denied.

21/03/2012 8:09:17 AM, error: Service Control Manager [7023] - The Z800mdm service terminated with the following error: Access is denied.

21/03/2012 8:02:44 AM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found.

21/03/2012 8:02:44 AM, error: Service Control Manager [7023] - The Help and Support service terminated with the following error: The specified module could not be found.

21/03/2012 8:02:44 AM, error: Service Control Manager [7023] - The Hap17v2k service terminated with the following error: The specified module could not be found.

21/03/2012 7:54:43 AM, error: Service Control Manager [7023] - The Hap17v2k service terminated with the following error: Access is denied.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The Vcsw service terminated with the following error: The specified module could not be found.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The Ssmdrv service terminated with the following error: The specified module could not be found.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The Sandradatasrv service terminated with the following error: The specified module could not be found.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The REVOSENS service terminated with the following error: The specified module could not be found.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The Mmc_2K service terminated with the following error: Access is denied.

21/03/2012 10:13:40 AM, error: Service Control Manager [7023] - The BsHelpCS service terminated with the following error: The specified module could not be found.

20/03/2012 8:50:35 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd

20/03/2012 5:18:29 PM, error: Dhcp [1002] - The IP address lease 10.1.1.4 for the Network Card with network address 001FC6C77F99 has been denied by the DHCP server 10.1.1.1 (The DHCP Server sent a DHCPNACK message).

18/03/2012 10:11:20 AM, error: Dhcp [1002] - The IP address lease 10.1.1.2 for the Network Card with network address 001FC6C77F99 has been denied by the DHCP server 10.1.1.1 (The DHCP Server sent a DHCPNACK message).

.

==== End Of File ===========================

grey hair · March 23, 2012

Just an update. AVG Resident Shield Alert keeps going off every 10 minutes or so. The threat name is - Trojan Horse Crypt.AQLW. It appears to be creating random .dll files which try to open and get detected by AVG. This has been driving me nuts for 3 days now, any help would greatly appreciated.

LDTate · March 23, 2012

:welcome:

Whether you wish to continue with cleaning or not, you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps
Removing this infection can also disable the ability to connect to the internet.

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

Please post back to let me know how you wish to proceed.

grey hair · March 23, 2012

Thanks LTD, luckily I do not do internet banking. I do use ebay and paypal but I do not leave any passwords logged into any system, except for 1 sharemarket site. I keep all passwords in a book and use them as and when needed and always clean browser cache after using them. Have been operating from laptop for past 3 days as did not want to use infected desktop for anything. Will change the 1 password logged into desktop, after that should be good to go.

What do I need to do now?

Thanks.

LDTate · March 23, 2012

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Download TDSSKiller from here and save it to your Desktop.

Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

grey hair · March 23, 2012

Here is requested log file from TDSSKiller.

I am downloading these files on laptop and using usb key to swap between machines. Hopefully this will work ok. Touch wood.

00:01:24.0359 1404 TDSS rootkit removing tool 2.7.22.0 Mar 21 2012 17:40:00

00:01:25.0500 1404 ============================================================

00:01:25.0500 1404 Current date / time: 2012/03/24 00:01:25.0500

00:01:25.0500 1404 SystemInfo:

00:01:25.0500 1404

00:01:25.0500 1404 OS Version: 5.1.2600 ServicePack: 3.0

00:01:25.0500 1404 Product type: Workstation

00:01:25.0500 1404 ComputerName: USER

00:01:25.0500 1404 UserName: Owner

00:01:25.0500 1404 Windows directory: C:\WINDOWS

00:01:25.0500 1404 System windows directory: C:\WINDOWS

00:01:25.0500 1404 Processor architecture: Intel x86

00:01:25.0500 1404 Number of processors: 2

00:01:25.0500 1404 Page size: 0x1000

00:01:25.0500 1404 Boot type: Normal boot

00:01:25.0500 1404 ============================================================

00:01:27.0531 1404 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

00:01:27.0562 1404 Drive \Device\Harddisk1\DR1 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

00:01:27.0984 1404 Drive \Device\Harddisk2\DR4 - Size: 0x1DD400000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

00:01:27.0984 1404 \Device\Harddisk0\DR0:

00:01:27.0984 1404 MBR used

00:01:27.0984 1404 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C4542

00:01:27.0984 1404 \Device\Harddisk1\DR1:

00:01:27.0984 1404 MBR used

00:01:27.0984 1404 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1

00:01:27.0984 1404 \Device\Harddisk2\DR4:

00:01:27.0984 1404 MBR used

00:01:27.0984 1404 \Device\Harddisk2\DR4\Partition0: MBR, Type 0xC, StartLBA 0x1F80, BlocksNum 0xEE8080

00:01:28.0109 1404 Initialize success

00:01:28.0109 1404 ============================================================

00:01:43.0890 0372 ============================================================

00:01:43.0890 0372 Scan started

00:01:43.0890 0372 Mode: Manual; SigCheck; TDLFS;

00:01:43.0890 0372 ============================================================

00:01:44.0359 0372 Abiosdsk - ok

00:01:44.0546 0372 abp480n5 - ok

00:01:44.0921 0372 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

00:01:50.0031 0372 ACPI - ok

00:01:50.0343 0372 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

00:01:50.0484 0372 ACPIEC - ok

00:01:50.0765 0372 ADIHdAudAddService - ok

00:01:50.0937 0372 adpu160m - ok

00:01:51.0109 0372 aeaudio - ok

00:01:51.0296 0372 AEAudioService - ok

00:01:51.0546 0372 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

00:01:51.0812 0372 aec - ok

00:01:52.0062 0372 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

00:01:52.0218 0372 AFD - ok

00:01:52.0406 0372 Aha154x - ok

00:01:52.0687 0372 aic78u2 - ok

00:01:52.0859 0372 aic78xx - ok

00:01:53.0078 0372 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

00:01:53.0171 0372 Alerter - ok

00:01:53.0375 0372 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

00:01:53.0484 0372 ALG - ok

00:01:53.0765 0372 AliIde - ok

00:01:54.0000 0372 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

00:01:54.0078 0372 AmdK8 - ok

00:01:54.0250 0372 amsint - ok

00:01:54.0406 0372 Apple Mobile Device (018857ead9a077a56aedfc0e5ef7a24a) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

00:01:54.0421 0372 Apple Mobile Device - ok

00:01:54.0703 0372 AppMgmt - ok

00:01:54.0875 0372 AppnApi - ok

00:01:55.0109 0372 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

00:01:55.0218 0372 Arp1394 - ok

00:01:55.0406 0372 asc - ok

00:01:55.0687 0372 asc3350p - ok

00:01:55.0875 0372 asc3550 - ok

00:01:56.0093 0372 AsIO (2b4e66fac6503494a2c6f32bb6ab3826) C:\WINDOWS\system32\drivers\AsIO.sys

00:01:56.0703 0372 AsIO - ok

00:01:56.0921 0372 aslm75 - ok

00:01:57.0171 0372 Aspi32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\aspi32.sys

00:01:57.0234 0372 Aspi32 ( UnsignedFile.Multi.Generic ) - warning

00:01:57.0234 0372 Aspi32 - detected UnsignedFile.Multi.Generic (1)

00:01:57.0453 0372 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

00:01:57.0500 0372 aspnet_state - ok

00:01:57.0828 0372 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

00:01:57.0937 0372 AsyncMac - ok

00:01:58.0171 0372 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

00:01:58.0312 0372 atapi - ok

00:01:58.0484 0372 Atdisk - ok

00:01:58.0828 0372 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

00:01:58.0937 0372 Atmarpc - ok

00:01:59.0093 0372 ATNT40K - ok

00:01:59.0312 0372 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

00:01:59.0406 0372 AudioSrv - ok

00:01:59.0734 0372 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

00:01:59.0843 0372 audstub - ok

00:02:00.0000 0372 avgfwsrv - ok

00:02:01.0531 0372 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

00:02:04.0218 0372 AVGIDSAgent - ok

00:02:04.0687 0372 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys

00:02:04.0687 0372 AVGIDSDriver - ok

00:02:04.0921 0372 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys

00:02:04.0968 0372 AVGIDSEH - ok

00:02:05.0218 0372 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys

00:02:05.0218 0372 AVGIDSFilter - ok

00:02:05.0437 0372 AVGIDSShim (1e01c2166b5599802bcd61b9691f7476) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys

00:02:05.0453 0372 AVGIDSShim - ok

00:02:05.0812 0372 Avgldx86 (bf8118cd5e2255387b715b534d64acd1) C:\WINDOWS\system32\DRIVERS\avgldx86.sys

00:02:05.0906 0372 Avgldx86 - ok

00:02:06.0109 0372 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys

00:02:06.0140 0372 Avgmfx86 - ok

00:02:06.0375 0372 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys

00:02:06.0406 0372 Avgrkx86 - ok

00:02:06.0812 0372 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys

00:02:06.0921 0372 Avgtdix - ok

00:02:07.0156 0372 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files\AVG\AVG2012\avgwdsvc.exe

00:02:07.0187 0372 avgwd - ok

00:02:07.0406 0372 b57w2k - ok

00:02:07.0687 0372 backupexecjobengine - ok

00:02:07.0859 0372 backupexecnamingservice - ok

00:02:08.0015 0372 Bcim - ok

00:02:08.0187 0372 bdselfpr - ok

00:02:08.0406 0372 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

00:02:08.0531 0372 Beep - ok

00:02:08.0937 0372 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

00:02:09.0437 0372 BITS - ok

00:02:09.0765 0372 bocdrive - ok

00:02:09.0984 0372 Bonjour Service (673cf4f6bb1fbe09331b526802fbb892) C:\Program Files\Bonjour\mDNSResponder.exe

00:02:10.0140 0372 Bonjour Service - ok

00:02:10.0312 0372 bridge - ok

00:02:10.0531 0372 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

00:02:10.0765 0372 Browser - ok

00:02:10.0921 0372 BrSerIf - ok

00:02:11.0093 0372 bvrp_pci - ok

00:02:11.0234 0372 catchme - ok

00:02:11.0468 0372 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

00:02:11.0640 0372 cbidf2k - ok

00:02:11.0843 0372 cd20xrnt - ok

00:02:12.0046 0372 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

00:02:12.0156 0372 Cdaudio - ok

00:02:12.0421 0372 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

00:02:12.0531 0372 Cdfs - ok

00:02:12.0812 0372 cdfsvc - ok

00:02:13.0046 0372 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

00:02:13.0187 0372 Cdrom - ok

00:02:13.0359 0372 Changer - ok

00:02:13.0531 0372 cics.region1 - ok

00:02:13.0828 0372 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

00:02:13.0937 0372 CiSvc - ok

00:02:14.0156 0372 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

00:02:14.0265 0372 ClipSrv - ok

00:02:14.0453 0372 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

00:02:14.0484 0372 clr_optimization_v2.0.50727_32 - ok

00:02:14.0781 0372 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

00:02:14.0875 0372 clr_optimization_v4.0.30319_32 - ok

00:02:15.0078 0372 CmdIde - ok

00:02:15.0265 0372 COMSysApp - ok

00:02:15.0468 0372 Cpqarray - ok

00:02:15.0781 0372 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

00:02:15.0890 0372 CryptSvc - ok

00:02:16.0062 0372 CTEDSPFX.DLL - ok

00:02:16.0234 0372 ctxhttp - ok

00:02:16.0390 0372 cxpt_service - ok

00:02:16.0687 0372 dac2w2k - ok

00:02:16.0859 0372 dac960nt - ok

00:02:17.0187 0372 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

00:02:17.0343 0372 DcomLaunch - ok

00:02:17.0593 0372 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

00:02:17.0812 0372 Dhcp - ok

00:02:18.0046 0372 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

00:02:18.0140 0372 Disk - ok

00:02:18.0312 0372 dlbx_device - ok

00:02:18.0484 0372 DM9102 - ok

00:02:18.0750 0372 dmadmin - ok

00:02:19.0171 0372 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

00:02:19.0750 0372 dmboot - ok

00:02:19.0984 0372 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

00:02:20.0156 0372 dmio - ok

00:02:20.0359 0372 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

00:02:20.0468 0372 dmload - ok

00:02:20.0781 0372 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

00:02:20.0875 0372 dmserver - ok

00:02:21.0093 0372 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

00:02:21.0218 0372 DMusic - ok

00:02:21.0421 0372 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

00:02:21.0703 0372 Dnscache - ok

00:02:21.0921 0372 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

00:02:22.0062 0372 Dot3svc - ok

00:02:22.0234 0372 downloadmanagerlite - ok

00:02:22.0437 0372 dpti2o - ok

00:02:22.0765 0372 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

00:02:22.0859 0372 drmkaud - ok

00:02:23.0078 0372 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

00:02:23.0187 0372 EapHost - ok

00:02:23.0359 0372 emu10k - ok

00:02:23.0562 0372 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

00:02:23.0765 0372 ERSvc - ok

00:02:24.0000 0372 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

00:02:24.0062 0372 Eventlog - ok

00:02:24.0343 0372 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

00:02:24.0453 0372 EventSystem - ok

00:02:24.0859 0372 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

00:02:25.0000 0372 Fastfat - ok

00:02:25.0250 0372 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

00:02:25.0343 0372 FastUserSwitchingCompatibility - ok

00:02:25.0578 0372 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

00:02:25.0781 0372 Fdc - ok

00:02:25.0937 0372 filemon701 - ok

00:02:26.0187 0372 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

00:02:26.0281 0372 Fips - ok

00:02:26.0468 0372 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

00:02:26.0593 0372 Flpydisk - ok

00:02:26.0906 0372 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

00:02:27.0031 0372 FltMgr - ok

00:02:27.0250 0372 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

00:02:27.0265 0372 FontCache3.0.0.0 - ok

00:02:27.0453 0372 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

00:02:27.0578 0372 Fs_Rec - ok

00:02:27.0875 0372 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

00:02:28.0015 0372 Ftdisk - ok

00:02:28.0187 0372 GBFSHook - ok

00:02:28.0421 0372 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

00:02:28.0437 0372 GEARAspiWDM - ok

00:02:28.0703 0372 ggsemc - ok

00:02:28.0875 0372 gmer - ok

00:02:29.0078 0372 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

00:02:29.0203 0372 Gpc - ok

00:02:29.0437 0372 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe

00:02:29.0453 0372 gupdate - ok

00:02:29.0484 0372 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe

00:02:29.0531 0372 gupdatem - ok

00:02:29.0734 0372 gusvc (408ddd80eede47175f6844817b90213e) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

00:02:29.0781 0372 gusvc - ok

00:02:30.0031 0372 HdAudAddService (f58d2900c66a1e773e3375098e0e9337) C:\WINDOWS\system32\drivers\HdAudio.sys

00:02:30.0171 0372 HdAudAddService - ok

00:02:30.0437 0372 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

00:02:30.0609 0372 HDAudBus - ok

00:02:30.0734 0372 helpsvc - ok

00:02:30.0906 0372 HidBth - ok

00:02:31.0125 0372 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll

00:02:31.0296 0372 HidServ - ok

00:02:31.0500 0372 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

00:02:31.0671 0372 HidUsb - ok

00:02:31.0875 0372 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

00:02:31.0984 0372 hkmsvc - ok

00:02:32.0171 0372 hpn - ok

00:02:32.0484 0372 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

00:02:32.0734 0372 HTTP - ok

00:02:32.0953 0372 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

00:02:33.0078 0372 HTTPFilter - ok

00:02:33.0265 0372 i2omgmt - ok

00:02:33.0437 0372 i2omp - ok

00:02:33.0781 0372 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

00:02:33.0890 0372 i8042prt - ok

00:02:34.0046 0372 iAimTV5 - ok

00:02:36.0203 0372 ialm (9acb03875cfe068d5cc0e98fb2cf7017) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys

00:02:40.0093 0372 ialm - ok

00:02:40.0328 0372 ibmsmbus - ok

00:02:40.0578 0372 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

00:02:40.0718 0372 IDriverT ( UnsignedFile.Multi.Generic ) - warning

00:02:40.0718 0372 IDriverT - detected UnsignedFile.Multi.Generic (1)

00:02:41.0125 0372 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

00:02:41.0718 0372 idsvc - ok

00:02:42.0000 0372 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

00:02:42.0109 0372 Imapi - ok

00:02:42.0359 0372 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

00:02:42.0468 0372 ImapiService - ok

00:02:42.0781 0372 ini910u - ok

00:02:42.0968 0372 IntelIde - ok

00:02:43.0203 0372 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

00:02:43.0296 0372 intelppm - ok

00:02:43.0515 0372 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

00:02:43.0671 0372 Ip6Fw - ok

00:02:43.0890 0372 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

00:02:44.0000 0372 IpFilterDriver - ok

00:02:44.0218 0372 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

00:02:44.0296 0372 IpInIp - ok

00:02:44.0546 0372 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

00:02:44.0812 0372 IpNat - ok

00:02:45.0140 0372 iPod Service (0ca8c2e721617aa2f923a8151c96fb33) C:\Program Files\iPod\bin\iPodService.exe

00:02:45.0609 0372 iPod Service - ok

00:02:45.0890 0372 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

00:02:46.0015 0372 IPSec - ok

00:02:46.0203 0372 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

00:02:46.0312 0372 IRENUM - ok

00:02:46.0546 0372 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

00:02:46.0765 0372 isapnp - ok

00:02:46.0921 0372 isdrv122 - ok

00:02:47.0093 0372 iviVD - ok

00:02:47.0390 0372 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe

00:02:47.0437 0372 JavaQuickStarterService - ok

00:02:47.0781 0372 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

00:02:47.0921 0372 Kbdclass - ok

00:02:48.0125 0372 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

00:02:48.0234 0372 kbdhid - ok

00:02:48.0406 0372 klif - ok

00:02:48.0765 0372 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

00:02:48.0906 0372 kmixer - ok

00:02:49.0156 0372 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

00:02:49.0359 0372 KSecDD - ok

00:02:49.0703 0372 L1e (080cf8720a306a64f7a09d1226491791) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys

00:02:49.0812 0372 L1e - ok

00:02:50.0031 0372 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

00:02:50.0140 0372 lanmanserver - ok

00:02:50.0390 0372 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

00:02:50.0453 0372 lanmanworkstation - ok

00:02:50.0781 0372 Lbd - ok

00:02:50.0953 0372 lbrtfdc - ok

00:02:51.0140 0372 lexbces - ok

00:02:51.0328 0372 lirsgt - ok

00:02:51.0531 0372 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

00:02:51.0687 0372 LmHosts - ok

00:02:51.0859 0372 lvckap - ok

00:02:52.0015 0372 lyncusbserv - ok

00:02:52.0234 0372 mbamchameleon (7ffd29fafcde7aaf89b689b6e156d5b0) C:\WINDOWS\system32\drivers\mbamchameleon.sys

00:02:52.0265 0372 mbamchameleon ( UnsignedFile.Multi.Generic ) - warning

00:02:52.0265 0372 mbamchameleon - detected UnsignedFile.Multi.Generic (1)

00:02:52.0437 0372 mbr - ok

00:02:52.0703 0372 mcupdmgr.exe - ok

00:02:52.0921 0372 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

00:02:53.0000 0372 Messenger - ok

00:02:53.0171 0372 mfeavfk - ok

00:02:53.0343 0372 mferkdk - ok

00:02:53.0562 0372 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

00:02:53.0781 0372 mnmdd - ok

00:02:53.0968 0372 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

00:02:54.0078 0372 mnmsrvc - ok

00:02:54.0312 0372 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

00:02:54.0406 0372 Modem - ok

00:02:55.0093 0372 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys

00:02:56.0031 0372 monfilt - ok

00:02:56.0250 0372 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

00:02:56.0359 0372 Mouclass - ok

00:02:56.0578 0372 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

00:02:56.0796 0372 mouhid - ok

00:02:57.0015 0372 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

00:02:57.0125 0372 MountMgr - ok

00:02:57.0296 0372 mpservice - ok

00:02:57.0468 0372 mraid35x - ok

00:02:57.0750 0372 MREMP50a64 - ok

00:02:57.0968 0372 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

00:02:58.0140 0372 MRxDAV - ok

00:02:58.0484 0372 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

00:02:58.0859 0372 MRxSmb - ok

00:02:59.0093 0372 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

00:02:59.0171 0372 MSDTC - ok

00:02:59.0375 0372 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

00:02:59.0484 0372 Msfs - ok

00:02:59.0750 0372 MSIServer - ok

00:03:00.0000 0372 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

00:03:00.0078 0372 MSKSSRV - ok

00:03:00.0281 0372 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

00:03:00.0390 0372 MSPCLOCK - ok

00:03:00.0718 0372 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

00:03:00.0828 0372 MSPQM - ok

00:03:01.0031 0372 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

00:03:01.0140 0372 mssmbios - ok

00:03:01.0375 0372 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

00:03:01.0421 0372 MTsensor - ok

00:03:01.0781 0372 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

00:03:01.0859 0372 Mup - ok

00:03:02.0031 0372 mwstick - ok

00:03:02.0203 0372 NAL - ok

00:03:02.0468 0372 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

00:03:02.0750 0372 napagent - ok

00:03:02.0921 0372 navapel - ok

00:03:03.0343 0372 NBService (6d8fcdd5bb3b676ef58fa234073492c6) C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

00:03:03.0718 0372 NBService - ok

00:03:04.0031 0372 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

00:03:04.0218 0372 NDIS - ok

00:03:04.0437 0372 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

00:03:04.0546 0372 NdisTapi - ok

00:03:04.0812 0372 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

00:03:04.0906 0372 Ndisuio - ok

00:03:05.0125 0372 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

00:03:05.0250 0372 NdisWan - ok

00:03:05.0468 0372 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

00:03:05.0531 0372 NDProxy - ok

00:03:05.0765 0372 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

00:03:05.0859 0372 NetBIOS - ok

00:03:06.0140 0372 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

00:03:06.0281 0372 NetBT - ok

00:03:06.0515 0372 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

00:03:06.0640 0372 NetDDE - ok

00:03:06.0671 0372 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

00:03:06.0765 0372 NetDDEdsdm - ok

00:03:06.0968 0372 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

00:03:07.0062 0372 Netlogon - ok

00:03:07.0312 0372 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

00:03:07.0437 0372 Netman - ok

00:03:07.0671 0372 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

00:03:07.0750 0372 NetTcpPortSharing - ok

00:03:07.0906 0372 nfmservice - ok

00:03:08.0078 0372 ngdbserv - ok

00:03:08.0359 0372 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

00:03:08.0468 0372 NIC1394 - ok

00:03:08.0640 0372 NICSer_WPC300N - ok

00:03:08.0906 0372 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

00:03:08.0953 0372 Nla - ok

00:03:09.0203 0372 NMIndexingService (e32686b4e27d11f83e3f2844e104c66c) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

00:03:09.0296 0372 NMIndexingService - ok

00:03:09.0468 0372 nmwcdcm - ok

00:03:09.0734 0372 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

00:03:09.0875 0372 Npfs - ok

00:03:10.0046 0372 NTACCESS - ok

00:03:10.0437 0372 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

00:03:10.0781 0372 Ntfs - ok

00:03:10.0984 0372 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

00:03:11.0062 0372 NtLmSsp - ok

00:03:11.0421 0372 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

00:03:11.0718 0372 NtmsSvc - ok

00:03:11.0921 0372 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

00:03:12.0031 0372 Null - ok

00:03:13.0265 0372 nv (9e1f2f09e34c92a96b9900b6a45d5026) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

00:03:15.0187 0372 nv - ok

00:03:15.0515 0372 NVENETFD (2a7a2c6ab9631028b6e3a4159aa65705) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

00:03:15.0562 0372 NVENETFD - ok

00:03:15.0734 0372 NVNET - ok

00:03:15.0953 0372 nvnetbus (20526a8827dc0956b5526aebcb6751a0) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

00:03:16.0000 0372 nvnetbus - ok

00:03:16.0250 0372 NVSvc (0b24ab7cc5b7ed2aa7f438a4072459f4) C:\WINDOWS\system32\nvsvc32.exe

00:03:16.0343 0372 NVSvc - ok

00:03:16.0562 0372 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

00:03:16.0671 0372 NwlnkFlt - ok

00:03:16.0875 0372 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

00:03:17.0015 0372 NwlnkFwd - ok

00:03:17.0234 0372 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

00:03:17.0390 0372 ohci1394 - ok

00:03:17.0546 0372 oracleorahomedatagatherer - ok

00:03:17.0718 0372 oracleorahomepagingserver - ok

00:03:17.0890 0372 oraclexeclragent - ok

00:03:18.0062 0372 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

00:03:18.0093 0372 ose - ok

00:03:18.0265 0372 p2pimsvc - ok

00:03:18.0421 0372 Packet - ok

00:03:18.0593 0372 pae_1394 - ok

00:03:18.0828 0372 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

00:03:18.0953 0372 Parport - ok

00:03:19.0156 0372 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

00:03:19.0250 0372 PartMgr - ok

00:03:19.0468 0372 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

00:03:19.0578 0372 ParVdm - ok

00:03:19.0734 0372 pav_service - ok

00:03:19.0968 0372 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

00:03:20.0078 0372 PCI - ok

00:03:20.0250 0372 PciBus - ok

00:03:20.0437 0372 PCIDump - ok

00:03:20.0625 0372 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

00:03:20.0718 0372 PCIIde - ok

00:03:20.0968 0372 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

00:03:21.0078 0372 Pcmcia - ok

00:03:21.0328 0372 Pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\Pcouffin.sys

00:03:21.0359 0372 Pcouffin ( UnsignedFile.Multi.Generic ) - warning

00:03:21.0359 0372 Pcouffin - detected UnsignedFile.Multi.Generic (1)

00:03:21.0531 0372 PDCOMP - ok

00:03:21.0718 0372 PDFRAME - ok

00:03:21.0890 0372 pdiddcci - ok

00:03:22.0062 0372 PDRELI - ok

00:03:22.0250 0372 PDRFRAME - ok

00:03:22.0437 0372 perc2 - ok

00:03:22.0609 0372 perc2hib - ok

00:03:22.0859 0372 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

00:03:22.0921 0372 PlugPlay - ok

00:03:23.0125 0372 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

00:03:23.0218 0372 PolicyAgent - ok

00:03:23.0484 0372 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

00:03:23.0593 0372 PptpMiniport - ok

00:03:23.0796 0372 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

00:03:23.0906 0372 Processor - ok

00:03:24.0078 0372 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

00:03:24.0156 0372 ProtectedStorage - ok

00:03:24.0359 0372 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

00:03:24.0484 0372 PSched - ok

00:03:24.0671 0372 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

00:03:24.0765 0372 Ptilink - ok

00:03:24.0937 0372 purgeieservice - ok

00:03:25.0187 0372 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys

00:03:25.0203 0372 PxHelp20 - ok

00:03:25.0390 0372 ql1080 - ok

00:03:25.0562 0372 Ql10wnt - ok

00:03:25.0750 0372 ql12160 - ok

00:03:25.0937 0372 ql1240 - ok

00:03:26.0125 0372 ql1280 - ok

00:03:26.0296 0372 ramaint - ok

00:03:26.0500 0372 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

00:03:26.0578 0372 RasAcd - ok

00:03:26.0796 0372 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

00:03:26.0906 0372 RasAuto - ok

00:03:27.0109 0372 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

00:03:27.0218 0372 Rasl2tp - ok

00:03:27.0468 0372 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

00:03:27.0609 0372 RasMan - ok

00:03:27.0812 0372 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

00:03:27.0890 0372 RasPppoe - ok

00:03:28.0109 0372 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

00:03:28.0234 0372 Raspti - ok

00:03:28.0484 0372 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

00:03:28.0625 0372 Rdbss - ok

00:03:28.0828 0372 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

00:03:28.0937 0372 RDPCDD - ok

00:03:29.0109 0372 rdpdr - ok

00:03:29.0390 0372 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

00:03:29.0515 0372 RDPWD - ok

00:03:29.0765 0372 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

00:03:29.0890 0372 RDSessMgr - ok

00:03:30.0140 0372 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

00:03:30.0265 0372 redbook - ok

00:03:30.0468 0372 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

00:03:30.0562 0372 RemoteAccess - ok

00:03:30.0718 0372 rimsptsk - ok

00:03:30.0906 0372 RIOXDRV - ok

00:03:31.0109 0372 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

00:03:31.0203 0372 RpcLocator - ok

00:03:31.0515 0372 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll

00:03:31.0640 0372 RpcSs - ok

00:03:31.0812 0372 rp_fws - ok

00:03:32.0031 0372 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

00:03:32.0187 0372 RSVP - ok

00:03:32.0359 0372 s125mgmt - ok

00:03:32.0531 0372 s616unic - ok

00:03:32.0703 0372 sagefserver - ok

00:03:32.0859 0372 SaiNtBus - ok

00:03:33.0078 0372 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

00:03:33.0171 0372 SamSs - ok

00:03:33.0187 0372 SANDRA - ok

00:03:33.0343 0372 savrtpel - ok

00:03:33.0578 0372 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

00:03:33.0703 0372 SCardSvr - ok

00:03:33.0937 0372 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

00:03:34.0031 0372 Schedule - ok

00:03:34.0218 0372 sdbus - ok

00:03:34.0390 0372 SE26mdfl - ok

00:03:34.0640 0372 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

00:03:34.0734 0372 Secdrv - ok

00:03:34.0921 0372 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

00:03:35.0000 0372 seclogon - ok

00:03:35.0187 0372 SenFiltService - ok

00:03:35.0390 0372 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\System32\sens.dll

00:03:35.0484 0372 SENS - ok

00:03:35.0718 0372 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

00:03:35.0812 0372 serenum - ok

00:03:36.0062 0372 Serial (a9698a2e0a26d26f551c0db8d535a9fe) C:\WINDOWS\system32\DRIVERS\serial.sys

00:03:36.0109 0372 Serial ( Virus.Win32.ZAccess.k ) - infected

00:03:36.0109 0372 Serial - detected Virus.Win32.ZAccess.k (0)

00:03:36.0281 0372 service - ok

00:03:36.0562 0372 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

00:03:36.0656 0372 Sfloppy - ok

00:03:36.0828 0372 SGHIDI - ok

00:03:37.0000 0372 sglogplayer - ok

00:03:37.0281 0372 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

00:03:37.0484 0372 SharedAccess - ok

00:03:37.0703 0372 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

00:03:37.0750 0372 ShellHWDetection - ok

00:03:37.0906 0372 si3114r - ok

00:03:38.0093 0372 Simbad - ok

00:03:38.0265 0372 smserial - ok

00:03:38.0437 0372 SNP2UVC - ok

00:03:38.0609 0372 snpstd - ok

00:03:38.0796 0372 Sparrow - ok

00:03:39.0000 0372 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

00:03:39.0140 0372 splitter - ok

00:03:39.0359 0372 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

00:03:39.0390 0372 Spooler - ok

00:03:39.0593 0372 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

00:03:39.0718 0372 sr - ok

00:03:39.0968 0372 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

00:03:40.0046 0372 srservice - ok

00:03:40.0343 0372 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

00:03:40.0531 0372 Srv - ok

00:03:40.0796 0372 sscdbus (92b69020fc480219683d429dca068d71) C:\WINDOWS\system32\DRIVERS\sscdbus.sys

00:03:40.0828 0372 sscdbus - ok

00:03:41.0062 0372 sscdmdfl (77a2869d40cc84af711c321f9b0c7a78) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys

00:03:41.0078 0372 sscdmdfl - ok

00:03:41.0296 0372 sscdmdm (b4255635195a8413fcde7af5b7c4e382) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys

00:03:41.0343 0372 sscdmdm - ok

00:03:41.0562 0372 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

00:03:41.0656 0372 SSDPSRV - ok

00:03:41.0828 0372 ssfs0509 - ok

00:03:41.0984 0372 sskbfd - ok

00:03:42.0218 0372 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys

00:03:42.0234 0372 StarOpen ( UnsignedFile.Multi.Generic ) - warning

00:03:42.0234 0372 StarOpen - detected UnsignedFile.Multi.Generic (1)

00:03:42.0546 0372 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

00:03:42.0750 0372 stisvc - ok

00:03:42.0984 0372 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

00:03:43.0062 0372 swenum - ok

00:03:43.0281 0372 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

00:03:43.0390 0372 swmidi - ok

00:03:43.0562 0372 SwPrv - ok

00:03:43.0750 0372 symc810 - ok

00:03:43.0921 0372 symc8xx - ok

00:03:44.0109 0372 sym_hi - ok

00:03:44.0312 0372 sym_u3 - ok

00:03:44.0578 0372 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

00:03:44.0671 0372 sysaudio - ok

00:03:44.0906 0372 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

00:03:45.0015 0372 SysmonLog - ok

00:03:45.0312 0372 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

00:03:45.0484 0372 TapiSrv - ok

00:03:45.0828 0372 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

00:03:46.0046 0372 Tcpip - ok

00:03:46.0265 0372 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

00:03:46.0359 0372 TDPIPE - ok

00:03:46.0562 0372 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

00:03:46.0671 0372 TDTCP - ok

00:03:46.0875 0372 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

00:03:46.0984 0372 TermDD - ok

00:03:47.0250 0372 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

00:03:47.0343 0372 TermService - ok

00:03:47.0500 0372 tfsndrct - ok

00:03:47.0734 0372 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

00:03:47.0750 0372 Themes - ok

00:03:47.0906 0372 tifm21 - ok

00:03:48.0093 0372 TosIde - ok

00:03:48.0265 0372 TPECioCtl - ok

00:03:48.0437 0372 TPPWRIF - ok

00:03:48.0609 0372 traprcvr - ok

00:03:48.0812 0372 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

00:03:48.0921 0372 TrkWks - ok

00:03:49.0078 0372 TuneUp.Defrag - ok

00:03:49.0359 0372 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

00:03:49.0468 0372 Udfs - ok

00:03:49.0625 0372 uhcd - ok

00:03:49.0812 0372 ultra - ok

00:03:50.0125 0372 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

00:03:50.0421 0372 Update - ok

00:03:50.0578 0372 uploadmgr (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

00:03:50.0671 0372 uploadmgr - ok

00:03:50.0906 0372 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

00:03:51.0062 0372 upnphost - ok

00:03:51.0250 0372 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

00:03:51.0328 0372 UPS - ok

00:03:51.0500 0372 USA49W2KP - ok

00:03:51.0718 0372 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys

00:03:51.0750 0372 USBAAPL ( UnsignedFile.Multi.Generic ) - warning

00:03:51.0750 0372 USBAAPL - detected UnsignedFile.Multi.Generic (1)

00:03:51.0968 0372 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

00:03:52.0062 0372 usbccgp - ok

00:03:52.0312 0372 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

00:03:52.0421 0372 usbehci - ok

00:03:52.0640 0372 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

00:03:52.0750 0372 usbhub - ok

00:03:52.0984 0372 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

00:03:53.0078 0372 usbohci - ok

00:03:53.0296 0372 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

00:03:53.0375 0372 usbprint - ok

00:03:53.0578 0372 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

00:03:53.0687 0372 usbscan - ok

00:03:53.0890 0372 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

00:03:54.0000 0372 USBSTOR - ok

00:03:54.0234 0372 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

00:03:54.0328 0372 usbuhci - ok

00:03:54.0515 0372 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

00:03:54.0625 0372 VgaSave - ok

00:03:54.0906 0372 VIAHdAudAddService (6b2c9ee4c16616e9398bbd0bc80ceb22) C:\WINDOWS\system32\drivers\viahduaa.sys

00:03:55.0015 0372 VIAHdAudAddService - ok

00:03:55.0187 0372 ViaIde - ok

00:03:55.0359 0372 videoacceleratorengine - ok

00:03:55.0531 0372 VNUSB - ok

00:03:55.0750 0372 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

00:03:55.0859 0372 VolSnap - ok

00:03:56.0031 0372 vsbus - ok

00:03:56.0218 0372 vsmon - ok

00:03:56.0484 0372 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

00:03:56.0656 0372 VSS - ok

00:03:56.0828 0372 vzcdbsvc - ok

00:03:57.0046 0372 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

00:03:57.0171 0372 W32Time - ok

00:03:57.0390 0372 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

00:03:57.0500 0372 Wanarp - ok

00:03:57.0671 0372 wap3gx - ok

00:03:57.0843 0372 Wdf01000 - ok

00:03:58.0015 0372 WDICA - ok

00:03:58.0250 0372 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

00:03:58.0359 0372 wdmaud - ok

00:03:58.0593 0372 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

00:03:58.0687 0372 WebClient - ok

00:03:58.0843 0372 win32sl - ok

00:03:59.0140 0372 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

00:03:59.0218 0372 winmgmt - ok

00:03:59.0390 0372 winvnc - ok

00:03:59.0609 0372 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll

00:03:59.0687 0372 WmdmPmSN - ok

00:03:59.0921 0372 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

00:04:00.0046 0372 WmiApSrv - ok

00:04:00.0421 0372 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe

00:04:00.0921 0372 WMPNetworkSvc - ok

00:04:01.0171 0372 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

00:04:01.0203 0372 WpdUsb - ok

00:04:01.0625 0372 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

00:04:02.0000 0372 WPFFontCache_v0400 - ok

00:04:02.0250 0372 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

00:04:02.0375 0372 wuauserv - ok

00:04:02.0640 0372 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

00:04:02.0734 0372 WudfPf - ok

00:04:02.0953 0372 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

00:04:03.0015 0372 WudfRd - ok

00:04:03.0234 0372 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll

00:04:03.0281 0372 WudfSvc - ok

00:04:03.0625 0372 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

00:04:03.0812 0372 WZCSVC - ok

00:04:04.0046 0372 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

00:04:04.0203 0372 xmlprov - ok

00:04:04.0375 0372 {a7447300-8075-4b0d-83f1-3d75c8ebc623} - ok

00:04:04.0406 0372 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

00:04:04.0718 0372 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

00:04:04.0718 0372 \Device\Harddisk0\DR0 - detected TDSS File System (1)

00:04:04.0750 0372 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1

00:04:04.0921 0372 \Device\Harddisk1\DR1 - ok

00:04:04.0937 0372 MBR (0x1B8) (4ee85860a9fb58e2f5e265a4d29dd339) \Device\Harddisk2\DR4

00:04:05.0031 0372 \Device\Harddisk2\DR4 - ok

00:04:05.0031 0372 Boot (0x1200) (86be2e19de0ce07e25cefc15a2995d8f) \Device\Harddisk0\DR0\Partition0

00:04:05.0031 0372 \Device\Harddisk0\DR0\Partition0 - ok

00:04:05.0031 0372 Boot (0x1200) (90c163a7e1b491257ec4337544de6d04) \Device\Harddisk1\DR1\Partition0

00:04:05.0046 0372 \Device\Harddisk1\DR1\Partition0 - ok

00:04:05.0046 0372 Boot (0x1200) (6ec5e9d43d6bf868ef056faeea7e3d46) \Device\Harddisk2\DR4\Partition0

00:04:05.0046 0372 \Device\Harddisk2\DR4\Partition0 - ok

00:04:05.0046 0372 ============================================================

00:04:05.0046 0372 Scan finished

00:04:05.0046 0372 ============================================================

00:04:05.0156 0368 Detected object count: 8

00:04:05.0156 0368 Actual detected object count: 8

00:05:07.0750 0368 Aspi32 ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:07.0750 0368 Aspi32 ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:07.0750 0368 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:07.0750 0368 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:07.0750 0368 mbamchameleon ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:07.0750 0368 mbamchameleon ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:07.0750 0368 Pcouffin ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:07.0750 0368 Pcouffin ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:08.0187 0368 C:\WINDOWS\system32\DRIVERS\serial.sys - copied to quarantine

00:05:08.0937 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\@ - copied to quarantine

00:05:08.0937 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\cfg.ini - copied to quarantine

00:05:08.0953 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\Desktop.ini - copied to quarantine

00:05:09.0000 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\L\memrclzg - copied to quarantine

00:05:09.0031 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\oemid - copied to quarantine

00:05:09.0046 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000001.@ - copied to quarantine

00:05:09.0187 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000002.@ - copied to quarantine

00:05:09.0203 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000004.@ - copied to quarantine

00:05:09.0265 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000000.@ - copied to quarantine

00:05:09.0312 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000004.@ - copied to quarantine

00:05:09.0359 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000032.@ - copied to quarantine

00:05:09.0375 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\version - copied to quarantine

00:05:10.0562 0368 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\serial.sys) error 1813

00:05:23.0140 0368 Backup copy found, using it..

00:05:23.0343 0368 C:\WINDOWS\system32\DRIVERS\serial.sys - will be cured on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\3039687044 - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\cfg.ini - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\Desktop.ini - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\oemid - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000001.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000002.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\00000004.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000000.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000004.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\U\80000032.@ - will be deleted on reboot

00:05:41.0218 0368 C:\WINDOWS\$NtUninstallKB60759$\4099414287\version - will be deleted on reboot

00:05:41.0218 0368 Serial ( Virus.Win32.ZAccess.k ) - User select action: Cure

00:05:41.0218 0368 StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:41.0218 0368 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:41.0218 0368 USBAAPL ( UnsignedFile.Multi.Generic ) - skipped by user

00:05:41.0218 0368 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Skip

00:05:41.0218 0368 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

00:05:41.0218 0368 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

00:05:56.0687 1400 Deinitialize success

LDTate · March 23, 2012

If there was no rebooot after running TDSKiller, please reboot it before moving on.

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

grey hair · March 23, 2012

ComboFix all done. Log is below. Desktop seems ok at the moment, no AVG threats showing yet.

ComboFix 12-03-22.01 - Owner 24/03/2012 1:11.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.592 [GMT 10:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\Owner\Application Data\vso_ts_preview.xml

c:\documents and settings\Owner\g2mdlhlpx.exe

c:\documents and settings\Owner\WINDOWS

c:\program files\Internet Explorer\SET4C.tmp

c:\program files\Internet Explorer\SET50.tmp

c:\program files\Internet Explorer\SET51.tmp

c:\program files\Program Files

c:\program files\Program Files\Common Files\Adobe\Color\ACE1Cache.lst

c:\program files\Program Files\Common Files\Adobe\TypeSpt\AdobeFnt.lst

c:\program files\Program Files\Common Files\Adobe\Web\AdobeWeb.dll

c:\program files\Program Files\Common Files\Adobe\Workflow\Options.txt

c:\windows\iun6002.exe

c:\windows\system32\dds_trash_log.cmd

c:\windows\system32\PowerToyReadme.htm

c:\windows\system32\SET67.tmp

c:\windows\system32\SET68.tmp

c:\windows\system32\SET69.tmp

c:\windows\system32\SET6A.tmp

c:\windows\system32\SET6B.tmp

c:\windows\system32\SET6C.tmp

c:\windows\system32\SET6D.tmp

c:\windows\system32\SET6E.tmp

c:\windows\system32\SET6F.tmp

c:\windows\system32\SET72.tmp

c:\windows\system32\SET73.tmp

c:\windows\system32\SET74.tmp

c:\windows\system32\SET75.tmp

c:\windows\system32\SET76.tmp

c:\windows\system32\SET77.tmp

c:\windows\system32\SET79.tmp

c:\windows\system32\SET7A.tmp

c:\windows\system32\SET7B.tmp

c:\windows\system32\SET7C.tmp

c:\windows\system32\SET7D.tmp

c:\windows\system32\SET7E.tmp

c:\windows\system32\SET7F.tmp

c:\windows\system32\SET81.tmp

c:\windows\system32\SET82.tmp

c:\windows\system32\SET83.tmp

c:\windows\system32\SET84.tmp

c:\windows\system32\SET85.tmp

c:\windows\system32\SET86.tmp

c:\windows\system32\SET87.tmp

c:\windows\system32\SET88.tmp

c:\windows\system32\SET89.tmp

c:\windows\system32\SET8A.tmp

c:\windows\system32\SET8B.tmp

c:\windows\system32\SET8C.tmp

c:\windows\system32\SET8E.tmp

c:\windows\system32\SET8F.tmp

c:\windows\system32\SET90.tmp

c:\windows\system32\SET91.tmp

c:\windows\system32\SET92.tmp

c:\windows\system32\SET93.tmp

c:\windows\system32\SET94.tmp

c:\windows\system32\SET96.tmp

c:\windows\system32\SET97.tmp

c:\windows\system32\SET98.tmp

c:\windows\system32\SET99.tmp

c:\windows\system32\SET9A.tmp

c:\windows\system32\SET9B.tmp

c:\windows\system32\SET9C.tmp

c:\windows\system32\SET9D.tmp

c:\windows\system32\SET9E.tmp

c:\windows\system32\SET9F.tmp

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SERVICE

-------\Service_service

.

((((((((((((((((((((((((( Files Created from 2012-02-23 to 2012-03-23 )))))))))))))))))))))))))))))))

.

2012-03-23 14:05 . 2012-03-23 14:05 -------- d-----w- C:\TDSSKiller_Quarantine

2012-03-23 03:32 . 2012-03-23 03:32 24064 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2012-03-21 08:14 . 2012-03-21 08:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2012-03-20 14:25 . 2012-03-20 14:25 -------- d-----w- c:\program files\Microsoft Research

2012-03-03 06:33 . 2012-03-03 06:33 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll

2012-03-03 06:33 . 2012-03-03 06:33 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll

2012-03-03 06:33 . 2012-03-03 06:33 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll

2012-03-03 06:33 . 2012-03-17 03:44 646072 ----a-w- c:\program files\Mozilla Firefox\nss3.dll

2012-03-03 06:33 . 2012-03-17 03:44 371640 ----a-w- c:\program files\Mozilla Firefox\nssckbi.dll

2012-03-03 06:33 . 2012-03-17 03:44 109496 ----a-w- c:\program files\Mozilla Firefox\nssdbm3.dll

2012-03-03 06:33 . 2012-03-17 03:44 105400 ----a-w- c:\program files\Mozilla Firefox\nssutil3.dll

2012-03-03 06:33 . 2012-03-17 03:44 269240 ----a-w- c:\program files\Mozilla Firefox\updater.exe

2012-03-03 06:33 . 2012-03-17 03:44 19896 ----a-w- c:\program files\Mozilla Firefox\xpcom.dll

2012-02-29 04:44 . 2012-01-11 19:06 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll

2012-02-29 04:44 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\iacenc.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-23 14:06 . 2006-02-28 12:00 64512 ----a-w- c:\windows\system32\drivers\serial.sys

2012-02-28 14:03 . 2011-05-19 22:33 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-27 05:34 . 2007-11-23 13:01 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-02-27 05:34 . 2010-05-01 05:55 472808 ----a-w- c:\windows\system32\deployJava1.dll

2012-02-03 09:22 . 2006-02-28 12:00 1860096 ----a-w- c:\windows\system32\win32k.sys

2012-01-09 16:20 . 2006-09-05 00:45 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2008-12-16 07:07 . 2008-10-23 07:21 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2008-12-16 07:07 . 2008-10-23 07:21 126360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2008-10-23 07:21 . 2008-10-23 07:21 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

2012-03-17 03:44 . 2012-03-03 06:33 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{9eb64fa9-57c4-4a41-9940-e12e0418b693}"= "c:\program files\CashKeywords\prxtbCas1.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]

2011-05-09 09:49 176936 ----a-w- c:\program files\CashKeywords\prxtbCas1.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{9eb64fa9-57c4-4a41-9940-e12e0418b693}"= "c:\program files\CashKeywords\prxtbCas1.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{9EB64FA9-57C4-4A41-9940-E12E0418B693}"= "c:\program files\CashKeywords\prxtbCas1.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-04 68856]

"ISUSPM"="c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]

"Greenshot"="c:\program files\Greenshot\Greenshot.exe" [2010-07-11 548864]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]

"nwiz"="nwiz.exe" [2005-10-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-10 86016]

"CAP3ON"="c:\windows\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-07-18 22528]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]

"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-04-10 29757440]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

"Nuance PDF Reader-reminder"="c:\program files\Nuance\PDF Reader\Ereg\Ereg.exe" [2010-07-05 333088]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-24 210472]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]

"ASUS Update Checker"="c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe" [2008-12-11 114688]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-11-12 141336]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-11-12 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-11-12 141336]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]

Canon LASER SHOT LBP-1120 Status Window.LNK - c:\windows\system32\spool\drivers\w32x86\3\CAP3LAK.EXE [2007-11-20 30720]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-11-17 10:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2009-10-09 06:47 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]

2007-02-23 06:32 126976 ----a-w- c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"g:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"g:\\Program Files\\WM Recorder 10\\WMR90.exe"=

"c:\\Program Files\\WinHTTrack\\WinHTTrack.exe"=

"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=

"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\CNAB3RPK.EXE"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=

"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=

"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13/09/2010 3:27 PM 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16/03/2011 4:03 PM 32592]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/01/2011 6:41 AM 230608]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [5/04/2011 12:59 AM 295248]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12/10/2011 6:25 AM 4433248]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2/08/2011 6:09 AM 192776]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [14/04/2011 9:28 PM 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [10/02/2011 7:53 AM 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/02/2011 7:53 AM 16720]

R3 Pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [30/11/2009 8:28 AM 47360]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [24/11/2008 12:22 PM 222976]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 1:16 PM 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/12/2009 1:20 PM 135664]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/12/2009 1:20 PM 135664]

S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [23/03/2012 1:32 PM 24064]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 1:16 PM 753504]

.

NETSVCS REQUIRES REPAIRS - current entries shown

6to4

AppMgmt

AudioSrv

Browser

CryptSvc

DMServer

DHCP

ERSvc

EventSystem

FastUserSwitchingCompatibility

HidServ

Ias

Iprip

Irmon

LanmanServer

LanmanWorkstation

Messenger

Netman

Nla

Ntmssvc

NWCWorkstation

Nwsapagent

Rasauto

bridge

ibmsmbus

mferkdk

si3114r

p2pimsvc

cics.region1

nfmservice

b57w2k

gmer

vzcdbsvc

Bcim

GBFSHook

ssfs0509

lyncusbserv

CTEDSPFX.DLL

tifm21

winvnc

pae_1394

s616unic

SE26mdfl

vsbus

ATNT40K

NTACCESS

MREMP50a64

ntsvcmgr

sskbfd

aeaudio

sglogplayer

cdfsvc

smserial

SGHIDI

mwstick

TuneUp.Defrag

traprcvr

snpstd

NVNET

navapel

iviVD

avgfwsrv

oracleorahomedatagatherer

rdpdr

purgeieservice

pav_service

backupexecnamingservice

pdiddcci

aslm75

DM9102

NAL

ngdbserv

{a7447300-8075-4b0d-83f1-3d75c8ebc623}

tfsndrct

s116nd5

mcdetect.exe

Packet

videoacceleratorengine

BrSerIf

Wdf01000

bdselfpr

emu10k

backupexecjobengine

s125mgmt

mpservice

mcupdmgr.exe

filemon701

SaiNtBus

ramaint

sagefserver

oraclexeclragent

iAimTV5

savrtpel

win32sl

PciBus

klif

mbr

uhcd

AppnApi

downloadmanagerlite

cxpt_service

VNUSB

lexbces

SNP2UVC

USA49W2KP

bvrp_pci

NICSer_WPC300N

mfeavfk

oracleorahomepagingserver

vsmon

dlbx_device

lirsgt

rimsptsk

rp_fws

nmwcdcm

lvckap

bocdrive

TPPWRIF

isdrv122

sdbus

RIOXDRV

ctxhttp

HidBth

wap3gx

ggsemc

TPECioCtl

uploadmgr

Rasman

Remoteaccess

Schedule

Seclogon

SENS

Sharedaccess

SRService

Tapisrv

Themes

TrkWks

W32Time

WZCSVC

Wmi

WmdmPmSp

winmgmt

wscsvc

xmlprov

BITS

wuauserv

ShellHWDetection

helpsvc

WmdmPmSN

napagent

hkmsvc

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

.

Contents of the 'Scheduled Tasks' folder

.

2012-03-19 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 01:50]

.

2012-03-23 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-04 08:42]

.

2012-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-20 03:20]

.

2012-03-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-20 03:20]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com.au/

uInternet Settings,ProxyOverride = *.local

Trusted Zone: iinet.net.au\www

Trusted Zone: microsoft.com\*.update

Trusted Zone: windowsupdate.com\download

TCP: DhcpNameServer = 10.1.1.1

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\4a4uylfi.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-OPSE reminder - c:\program files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe

SafeBoot-58671161.sys

AddRemove-BlueVoda_Website_Builder_1.0 - c:\windows\iun6002.exe

AddRemove-WYSIWYG_Web_Builder_5 - c:\windows\iun6002.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-03-24 01:44

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ISUSPM = "c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" -scheduler??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????R???????C??????x?+}???????????}?????????????](}0??????????????????? ??|????0??|????????j??|????0???????[??????????????

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1409082233-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{747D0EF3-6199-5A17-059C-25698D5821F6}*]

@Allowed: (Read) (RestrictedCode)

"abekgmihmimkejidodpaegdeleabffljgd"=hex:61,61,00,ff

"mabkbmaddopnenjcoomefibbah"=hex:61,61,00,ff

.

[HKEY_USERS\S-1-5-21-1409082233-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AAD3E7F6-F954-5B53-909C-6EF38F9BBDD7}*]

@Allowed: (Read) (RestrictedCode)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1536)

c:\windows\system32\WININET.dll

c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\progra~1\AVG\AVG2012\avgrsx.exe

c:\program files\AVG\AVG2012\avgcsrvx.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\AVG\AVG2012\avgnsx.exe

c:\program files\AVG\AVG2012\avgemcx.exe

c:\windows\system32\CAP3RSK.EXE

c:\windows\system32\CNAB3RPK.EXE

c:\windows\system32\wscntfy.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

.

**************************************************************************

.

Completion time: 2012-03-24 01:53:59 - machine was rebooted

ComboFix-quarantined-files.txt 2012-03-23 15:53

ComboFix2.txt 2011-04-06 07:44

.

Pre-Run: 50,409,730,048 bytes free

Post-Run: 51,518,496,768 bytes free

.

- - End Of File - - 4CBDB6EBDD893C530726F80478995E3D

LDTate · March 23, 2012

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\program files\CashKeywords\prxtbCas1.dll

Folder::
c:\program files\CashKeywords


ClearJavaCache::


Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9eb64fa9-57c4-4a41-9940-e12e0418b693}"=- 
[-HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9eb64fa9-57c4-4a41-9940-e12e0418b693}"=-
[-HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9EB64FA9-57C4-4A41-9940-E12E0418B693}"=-
[-HKEY_CLASSES_ROOT\clsid\{9eb64fa9-57c4-4a41-9940-e12e0418b693}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

grey hair · March 23, 2012

ComboFix done, see log below. It did report both times it ran (now and last night) that infection was called rootkit.zeroaccess! which was inserted in tcp/ip stack. Desktop seems to be running ok at the moment, little bit sluggish but far better than it was for past 4 days.

Thanks for help to date.

.............................

ComboFix 12-03-22.01 - Owner 24/03/2012 8:00.4.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.601 [GMT 10:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

FILE ::

"c:\program files\CashKeywords\prxtbCas1.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\CashKeywords

c:\program files\CashKeywords\CashKeywordsToolbarHelper.exe

c:\program files\CashKeywords\CashKeywordsToolbarHelper1.exe

c:\program files\CashKeywords\INSTALL.LOG

c:\program files\CashKeywords\ldrtbCas0.dll

c:\program files\CashKeywords\prxtbCas0.dll

c:\program files\CashKeywords\prxtbCas1.dll

c:\program files\CashKeywords\tbCas1.dll

c:\program files\CashKeywords\tbCash.dll

c:\program files\CashKeywords\toolbar.cfg

c:\program files\CashKeywords\uninstall.exe

c:\program files\CashKeywords\UNWISE.EXE