Google links redirected through VIPSearchs

rhwillia · April 9, 2012

I have observed google links being redirected through VIPSearchs, although at this moment, things seem to be working just fine, but I have not done anything which I believe fixed the problem, other than running Malwarebytes full scan which claims to have found nothing, so I suspect the problem is not gone, but is dormant at this moment?

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.04.08.06

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Bob :: HOLMES [administrator]

4/9/2012 12:46:34 AM

mbam-log-2012-04-09 (00-46-34).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 328933

Time elapsed: 1 hour(s), 27 minute(s), 55 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Here is DDS.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Bob at 4:24:02 on 2012-04-09

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2045.1320 [GMT -5:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgemcx.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\Ask.com\Updater\Updater.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

mURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

mRun: [VMM Mode Selection] c:\program files\htc\modeselection\VMMModeSelection.exe

mRun: [ToolboxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [nwiz] nwiz.exe /install

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

mRun: [Alcmtr] ALCMTR.EXE

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [dplaysvr] %APPDATA%\dplaysvr.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

Trusted Zone: garmin.com

Trusted Zone: intuit.com\ttlc

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 97.64.183.164 97.64.209.37

TCP: Interfaces\{F25A5C49-D49B-42B7-B755-E65C1D2D3122} : DhcpNameServer = 97.64.183.164 97.64.209.37

TCP: Interfaces\{FB3E525E-4506-41A6-B498-A8458E23DAD8} : DhcpNameServer = 97.64.183.164 97.64.209.37

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 32592]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 230608]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 40016]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 295248]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]

R2 HP LaserJet Service;HP LaserJet Service;c:\program files\hp\hplaserjetservice\HPLaserJetService.exe [2010-10-25 145920]

R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2011-8-25 13672]

R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2010-5-4 503080]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-3 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-3 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-3 16720]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-4-9 40776]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2010-11-23 288000]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 MLPTDR_B;MLPTDR_B;c:\windows\system32\MLPTDR_B.SYS [2003-4-22 19904]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\flashplayerupdateservice.exe --> c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2012-04-09 05:45:33 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-04-09 03:47:29 -------- d-----w- c:\documents and settings\bob\local settings\application data\Threat Expert

2012-04-09 02:17:03 -------- d-----w- c:\program files\PC Tools

2012-04-09 02:10:24 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2012-04-09 02:10:24 -------- d-----w- c:\program files\common files\PC Tools

2012-04-09 02:09:34 -------- d-----w- c:\documents and settings\bob\application data\TestApp

2012-04-09 02:09:34 -------- d-----w- c:\documents and settings\all users\application data\PC Tools

2012-04-09 01:04:34 -------- d-----w- c:\windows\pss

2012-04-09 00:11:03 -------- d-----w- C:\TRK-INFECTED

2012-04-08 22:05:07 -------- d-----w- c:\documents and settings\bob\application data\Malwarebytes

2012-04-08 22:04:59 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2012-04-08 22:04:57 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-08 22:04:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-04-08 21:49:15 -------- d-----w- C:\TDSSKiller_Quarantine

2012-04-05 15:01:25 -------- d--h--w- C:\$AVG

2012-04-03 06:51:09 -------- d-----w- c:\documents and settings\bob\local settings\application data\Easy CD-DA Extractor

2012-04-03 06:50:50 -------- d-----w- c:\documents and settings\all users\application data\Easy CD-DA Extractor

2012-04-03 06:50:43 -------- d-----w- c:\program files\Easy CD-DA Extractor 16

2012-04-03 06:38:16 -------- d-----w- c:\documents and settings\all users\application data\AVS4YOU

2012-04-03 06:38:13 -------- d-----w- c:\documents and settings\bob\application data\AVS4YOU

2012-04-03 06:37:03 11139944 ----a-w- c:\windows\system32\libmfxsw32.dll

2012-04-03 06:36:56 1700352 ----a-w- c:\windows\system32\GdiPlus.dll

2012-04-03 06:36:55 24576 ----a-w- c:\windows\system32\msxml3a.dll

2012-04-03 06:36:54 -------- d-----w- c:\program files\AVS4YOU

2012-04-03 06:36:37 -------- d-----w- c:\program files\common files\AVSMedia

.

==================== Find3M ====================

.

2012-02-23 02:23:30 414368 ------w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys

2012-01-11 19:06:47 3072 ------w- c:\windows\system32\iacenc.dll

.

============= FINISH: 4:24:41.60 ===============

Here is attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 11/17/2010 2:33:36 AM

System Uptime: 4/9/2012 12:22:09 AM (4 hours ago)

.

Motherboard: clevo | | M7X0SUN

Processor: Intel Pentium III Xeon processor | uPGA 479M | 1999/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 233 GiB total, 191.126 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Base System Device

Device ID: PCI\VEN_197B&DEV_2382&SUBSYS_08021558&REV_20\4&2E819789&0&0038

Manufacturer:

Name: Base System Device

PNP Device ID: PCI\VEN_197B&DEV_2382&SUBSYS_08021558&REV_20\4&2E819789&0&0038

Service:

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Base System Device

Device ID: PCI\VEN_197B&DEV_2383&SUBSYS_08021558&REV_20\4&2E819789&0&0338

Manufacturer:

Name: Base System Device

PNP Device ID: PCI\VEN_197B&DEV_2383&SUBSYS_08021558&REV_20\4&2E819789&0&0338

Service:

.

==== System Restore Points ===================

.

RP1: 4/8/2012 8:24:31 PM - System Checkpoint

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.2)

Agere Systems HDA Modem

Amazon MP3 Downloader 1.0.12

Android SDK Tools

AnswerWorks 5.0 English Runtime

Apple Application Support

Apple Software Update

Ask Toolbar

AVG 2012

Borland C++Builder 6

Crown Print Monitor+

Easy CD-DA Extractor 16

Garmin City Navigator North America NT 2011.40 Update

Garmin USB Drivers

Garmin WebUpdater

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB976002-v5)

Hotfix for Windows XP (KB981793)

HP LaserJet Professional CP1520 Series

HP Update

HPLaserJetHelp_LearnCenter

HPLJUT

hppCP1520LaserJetService

hppLaserJetService

hppTLBXFXCP1520

hpzTLBXFX

IsoBuster 2.8.5

Java Auto Updater

Java 6 Update 27

Java 7 Update 1

Java SE Development Kit 7

magicolor 2300 DL

Malwarebytes Anti-Malware version 1.60.1.1000

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office Standard Edition 2003

Microsoft Silverlight

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)

Microsoft SQL Server Management Studio Express

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MINOLTA-QMS magicolor 2300 DL Printer Driver Software

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser

Nero BurnLite 10

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero Update

NVIDIA Drivers

Quicken 2009

QuickTime

Realtek High Definition Audio Driver

REALTEK RTL8187B Wireless LAN Driver

Rhapsody

Sansa Updater

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

TurboTax 2010

TurboTax 2010 wiaiper

TurboTax 2010 WinPerFedFormset

TurboTax 2010 WinPerReleaseEngine

TurboTax 2010 WinPerTaxSupport

TurboTax 2010 wmoiper

TurboTax 2010 wrapper

TurboTax 2011

TurboTax 2011 wiaiper

TurboTax 2011 WinPerFedFormset

TurboTax 2011 WinPerReleaseEngine

TurboTax 2011 WinPerTaxSupport

TurboTax 2011 wrapper

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

WebFldrs XP

Widevine Media Transformer Plugin 4.5.0

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)

Windows Genuine Advantage Notifications (KB905474)

Windows Internet Explorer 8

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

WinZip Self-Extractor

WModem Driver Installer

Yahoo! Detect

Yahoo! Messenger

.

==== Event Viewer Messages From Past Week ========

.

4/8/2012 9:22:37 PM, error: PCTCore [280] -

4/8/2012 9:17:05 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

4/8/2012 8:05:19 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

4/8/2012 7:46:53 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 Fips intelppm

4/8/2012 7:45:53 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

4/8/2012 4:16:48 PM, error: Service Control Manager [7034] - The Intuit Update Service v4 service terminated unexpectedly. It has done this 1 time(s).

4/8/2012 4:16:43 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).

4/8/2012 4:16:32 PM, error: Service Control Manager [7034] - The HP LaserJet Service service terminated unexpectedly. It has done this 1 time(s).

4/8/2012 2:12:10 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer DOYLE that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F25A5C49-D49B-42B7-B75. The master browser is stopping or an election is being forced.

4/8/2012 10:15:00 AM, error: Schedule [7901] - The At1.job command failed to start due to the following error: General access denied error

4/7/2012 9:33:00 PM, error: Schedule [7901] - The At3.job command failed to start due to the following error: General access denied error

4/7/2012 8:45:00 PM, error: Schedule [7901] - The At2.job command failed to start due to the following error: General access denied error

4/7/2012 2:30:02 PM, error: Schedule [7901] - The At4.job command failed to start due to the following error: General access denied error

4/6/2012 1:37:12 AM, error: BROWSER [8007] - The browser was unable to update the service status bits. The data is the error.

4/5/2012 2:31:33 AM, error: Service Control Manager [7002] - The MLPTDR_B service depends on the Parallel arbitrator group and no member of this group started.

4/3/2012 7:42:12 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0025D38DB2AA. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

4/3/2012 2:09:39 AM, error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

.

==== End Of File ===========================

Maniac · April 9, 2012

Hello rhwillia and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Please uninstall Ask Toolbar, because is bundled with many third party applications - also see this note.

Step 2

I saw that you have already run TDSSKiller, but now manually delete your TDSSKiller copy, then download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Step 3

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

TDSSKiller log
Malwarebytes' Anti-Malware log
a new fresh DDS log file

rhwillia · April 10, 2012

Here are the attached log files. I have not seen any evidence of the problem since my first post. The only thing that I remember doing around that time was to uninstall pctools SpyDoctor, which I did not expect to fix anything, since I had only installed it to attempt to deal with the redirection problem, but perhaps that did fix something?

Here are the new log files:

13:20:24.0859 2192 TDSS rootkit removing tool 2.7.27.0 Apr 9 2012 09:53:37

13:20:25.0359 2192 ============================================================

13:20:25.0359 2192 Current date / time: 2012/04/09 13:20:25.0359

13:20:25.0359 2192 SystemInfo:

13:20:25.0359 2192

13:20:25.0359 2192 OS Version: 5.1.2600 ServicePack: 3.0

13:20:25.0359 2192 Product type: Workstation

13:20:25.0359 2192 ComputerName: HOLMES

13:20:25.0359 2192 UserName: Bob

13:20:25.0359 2192 Windows directory: C:\WINDOWS

13:20:25.0359 2192 System windows directory: C:\WINDOWS

13:20:25.0359 2192 Processor architecture: Intel x86

13:20:25.0359 2192 Number of processors: 2

13:20:25.0359 2192 Page size: 0x1000

13:20:25.0359 2192 Boot type: Normal boot

13:20:25.0359 2192 ============================================================

13:20:27.0390 2192 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

13:20:27.0390 2192 \Device\Harddisk0\DR0:

13:20:27.0390 2192 MBR used

13:20:27.0390 2192 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681

13:20:27.0421 2192 Initialize success

13:20:27.0421 2192 ============================================================

13:21:09.0187 2792 ============================================================

13:21:09.0187 2792 Scan started

13:21:09.0187 2792 Mode: Manual; SigCheck; TDLFS;

13:21:09.0187 2792 ============================================================

13:21:09.0515 2792 Abiosdsk - ok

13:21:09.0546 2792 abp480n5 - ok

13:21:09.0625 2792 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

13:21:10.0593 2792 ACPI - ok

13:21:10.0750 2792 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

13:21:10.0906 2792 ACPIEC - ok

13:21:10.0953 2792 AdobeFlashPlayerUpdateSvc - ok

13:21:10.0968 2792 adpu160m - ok

13:21:11.0031 2792 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

13:21:11.0171 2792 aec - ok

13:21:11.0234 2792 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

13:21:11.0281 2792 AFD - ok

13:21:11.0312 2792 AgereModemAudio (39e435c90c9c4f780fa0ed05ca3c3a1b) C:\WINDOWS\system32\agrsmsvc.exe

13:21:11.0359 2792 AgereModemAudio - ok

13:21:11.0421 2792 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\WINDOWS\system32\DRIVERS\AGRSM.sys

13:21:11.0500 2792 AgereSoftModem - ok

13:21:11.0515 2792 Aha154x - ok

13:21:11.0531 2792 aic78u2 - ok

13:21:11.0546 2792 aic78xx - ok

13:21:11.0593 2792 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

13:21:11.0734 2792 Alerter - ok

13:21:11.0765 2792 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

13:21:11.0843 2792 ALG - ok

13:21:11.0859 2792 AliIde - ok

13:21:11.0859 2792 amsint - ok

13:21:11.0906 2792 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll

13:21:12.0000 2792 AppMgmt - ok

13:21:12.0015 2792 asc - ok

13:21:12.0015 2792 asc3350p - ok

13:21:12.0031 2792 asc3550 - ok

13:21:12.0171 2792 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

13:21:12.0203 2792 aspnet_state - ok

13:21:12.0296 2792 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

13:21:12.0437 2792 AsyncMac - ok

13:21:12.0453 2792 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

13:21:12.0593 2792 atapi - ok

13:21:12.0593 2792 Atdisk - ok

13:21:12.0625 2792 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

13:21:12.0765 2792 Atmarpc - ok

13:21:12.0812 2792 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

13:21:12.0937 2792 AudioSrv - ok

13:21:13.0000 2792 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

13:21:13.0125 2792 audstub - ok

13:21:13.0328 2792 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

13:21:13.0546 2792 AVGIDSAgent - ok

13:21:13.0609 2792 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys

13:21:13.0656 2792 AVGIDSDriver - ok

13:21:13.0703 2792 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys

13:21:13.0718 2792 AVGIDSEH - ok

13:21:13.0765 2792 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys

13:21:13.0765 2792 AVGIDSFilter - ok

13:21:13.0828 2792 AVGIDSShim (1e01c2166b5599802bcd61b9691f7476) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys

13:21:13.0828 2792 AVGIDSShim - ok

13:21:13.0875 2792 Avgldx86 (bf8118cd5e2255387b715b534d64acd1) C:\WINDOWS\system32\DRIVERS\avgldx86.sys

13:21:13.0906 2792 Avgldx86 - ok

13:21:13.0937 2792 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys

13:21:13.0953 2792 Avgmfx86 - ok

13:21:13.0984 2792 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys

13:21:14.0000 2792 Avgrkx86 - ok

13:21:14.0062 2792 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys

13:21:14.0078 2792 Avgtdix - ok

13:21:14.0187 2792 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files\AVG\AVG2012\avgwdsvc.exe

13:21:14.0203 2792 avgwd - ok

13:21:14.0265 2792 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

13:21:14.0437 2792 Beep - ok

13:21:14.0484 2792 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

13:21:14.0640 2792 BITS - ok

13:21:14.0687 2792 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

13:21:14.0859 2792 Browser - ok

13:21:14.0906 2792 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

13:21:15.0062 2792 cbidf2k - ok

13:21:15.0093 2792 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

13:21:15.0218 2792 CCDECODE - ok

13:21:15.0218 2792 cd20xrnt - ok

13:21:15.0234 2792 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

13:21:15.0406 2792 Cdaudio - ok

13:21:15.0421 2792 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

13:21:15.0546 2792 Cdfs - ok

13:21:15.0562 2792 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

13:21:15.0687 2792 Cdrom - ok

13:21:15.0687 2792 Changer - ok

13:21:15.0718 2792 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

13:21:15.0859 2792 CiSvc - ok

13:21:15.0875 2792 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

13:21:16.0000 2792 ClipSrv - ok

13:21:16.0062 2792 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:21:16.0062 2792 clr_optimization_v2.0.50727_32 - ok

13:21:16.0125 2792 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:21:16.0140 2792 clr_optimization_v4.0.30319_32 - ok

13:21:16.0156 2792 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

13:21:16.0281 2792 CmBatt - ok

13:21:16.0296 2792 CmdIde - ok

13:21:16.0328 2792 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

13:21:16.0453 2792 Compbatt - ok

13:21:16.0468 2792 COMSysApp - ok

13:21:16.0500 2792 Cpqarray - ok

13:21:16.0531 2792 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

13:21:16.0671 2792 CryptSvc - ok

13:21:16.0671 2792 dac2w2k - ok

13:21:16.0687 2792 dac960nt - ok

13:21:16.0750 2792 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

13:21:16.0828 2792 DcomLaunch - ok

13:21:16.0859 2792 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

13:21:17.0000 2792 Dhcp - ok

13:21:17.0015 2792 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

13:21:17.0140 2792 Disk - ok

13:21:17.0156 2792 dmadmin - ok

13:21:17.0203 2792 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

13:21:17.0375 2792 dmboot - ok

13:21:17.0421 2792 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

13:21:17.0546 2792 dmio - ok

13:21:17.0578 2792 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

13:21:17.0734 2792 dmload - ok

13:21:17.0796 2792 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

13:21:17.0921 2792 dmserver - ok

13:21:17.0953 2792 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

13:21:18.0093 2792 DMusic - ok

13:21:18.0140 2792 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

13:21:18.0171 2792 Dnscache - ok

13:21:18.0218 2792 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

13:21:18.0343 2792 Dot3svc - ok

13:21:18.0359 2792 dpti2o - ok

13:21:18.0390 2792 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

13:21:18.0515 2792 drmkaud - ok

13:21:18.0562 2792 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

13:21:18.0687 2792 EapHost - ok

13:21:18.0718 2792 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

13:21:18.0843 2792 ERSvc - ok

13:21:18.0906 2792 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

13:21:19.0000 2792 Eventlog - ok

13:21:19.0046 2792 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

13:21:19.0109 2792 EventSystem - ok

13:21:19.0125 2792 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

13:21:19.0265 2792 Fastfat - ok

13:21:19.0328 2792 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

13:21:19.0437 2792 FastUserSwitchingCompatibility - ok

13:21:19.0453 2792 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

13:21:19.0640 2792 Fdc - ok

13:21:19.0687 2792 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

13:21:19.0812 2792 Fips - ok

13:21:19.0843 2792 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

13:21:19.0968 2792 Flpydisk - ok

13:21:20.0031 2792 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

13:21:20.0156 2792 FltMgr - ok

13:21:20.0296 2792 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

13:21:20.0296 2792 FontCache3.0.0.0 - ok

13:21:20.0343 2792 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

13:21:20.0468 2792 Fs_Rec - ok

13:21:20.0500 2792 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

13:21:20.0671 2792 Ftdisk - ok

13:21:20.0734 2792 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

13:21:20.0859 2792 Gpc - ok

13:21:20.0859 2792 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

13:21:21.0000 2792 HDAudBus - ok

13:21:21.0046 2792 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

13:21:21.0187 2792 helpsvc - ok

13:21:21.0187 2792 HidServ - ok

13:21:21.0234 2792 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

13:21:21.0359 2792 hkmsvc - ok

13:21:21.0468 2792 HP LaserJet Service (d1e9cb573a9edf7be12e9c57f32e97f7) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe

13:21:21.0484 2792 HP LaserJet Service ( UnsignedFile.Multi.Generic ) - warning

13:21:21.0484 2792 HP LaserJet Service - detected UnsignedFile.Multi.Generic (1)

13:21:21.0484 2792 hpn - ok

13:21:21.0546 2792 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

13:21:21.0578 2792 HTTP - ok

13:21:21.0625 2792 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

13:21:21.0781 2792 HTTPFilter - ok

13:21:21.0781 2792 i2omgmt - ok

13:21:21.0796 2792 i2omp - ok

13:21:21.0843 2792 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

13:21:21.0968 2792 i8042prt - ok

13:21:22.0156 2792 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

13:21:22.0218 2792 idsvc - ok

13:21:22.0250 2792 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

13:21:22.0390 2792 Imapi - ok

13:21:22.0453 2792 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

13:21:22.0578 2792 ImapiService - ok

13:21:22.0593 2792 ini910u - ok

13:21:22.0765 2792 IntcAzAudAddService (4aaa8312732655f93a254d1fa695eb79) C:\WINDOWS\system32\drivers\RtkHDAud.sys

13:21:23.0062 2792 IntcAzAudAddService - ok

13:21:23.0078 2792 IntelIde - ok

13:21:23.0140 2792 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

13:21:23.0281 2792 intelppm - ok

13:21:23.0390 2792 IntuitUpdateService (3dc635b66dd7412e1c9c3a77b8d78f25) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

13:21:23.0406 2792 IntuitUpdateService - ok

13:21:23.0453 2792 IntuitUpdateServiceV4 (1663a135865f0ba6e853353e98e67f2a) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

13:21:23.0468 2792 IntuitUpdateServiceV4 - ok

13:21:23.0515 2792 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

13:21:23.0671 2792 Ip6Fw - ok

13:21:23.0734 2792 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

13:21:23.0890 2792 IpFilterDriver - ok

13:21:23.0937 2792 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

13:21:24.0125 2792 IpInIp - ok

13:21:24.0156 2792 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

13:21:24.0296 2792 IpNat - ok

13:21:24.0359 2792 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

13:21:24.0468 2792 IPSec - ok

13:21:24.0515 2792 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

13:21:24.0593 2792 IRENUM - ok

13:21:24.0609 2792 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

13:21:24.0750 2792 isapnp - ok

13:21:24.0812 2792 JavaQuickStarterService (92e16f5d034e7864da308ba6309a98b7) C:\Program Files\Java\jre7\bin\jqs.exe

13:21:24.0828 2792 JavaQuickStarterService - ok

13:21:24.0859 2792 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

13:21:24.0968 2792 Kbdclass - ok

13:21:24.0984 2792 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

13:21:25.0125 2792 kmixer - ok

13:21:25.0156 2792 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

13:21:25.0218 2792 KSecDD - ok

13:21:25.0265 2792 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

13:21:25.0296 2792 lanmanserver - ok

13:21:25.0359 2792 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

13:21:25.0375 2792 lanmanworkstation - ok

13:21:25.0390 2792 lbrtfdc - ok

13:21:25.0437 2792 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

13:21:25.0562 2792 LmHosts - ok

13:21:25.0578 2792 MCSTRM - ok

13:21:25.0625 2792 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

13:21:25.0781 2792 Messenger - ok

13:21:25.0812 2792 MLPTDR_B (a514e1cc9f469054abfd99ebaa174c30) C:\WINDOWS\system32\MLPTDR_B.sys

13:21:25.0843 2792 MLPTDR_B - ok

13:21:25.0890 2792 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

13:21:26.0000 2792 mnmdd - ok

13:21:26.0062 2792 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

13:21:26.0203 2792 mnmsrvc - ok

13:21:26.0218 2792 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

13:21:26.0343 2792 Modem - ok

13:21:26.0359 2792 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

13:21:26.0484 2792 Mouclass - ok

13:21:26.0515 2792 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

13:21:26.0640 2792 MountMgr - ok

13:21:26.0656 2792 mraid35x - ok

13:21:26.0703 2792 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

13:21:26.0828 2792 MRxDAV - ok

13:21:26.0890 2792 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

13:21:26.0953 2792 MRxSmb - ok

13:21:26.0968 2792 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

13:21:27.0078 2792 MSDTC - ok

13:21:27.0093 2792 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

13:21:27.0250 2792 Msfs - ok

13:21:27.0265 2792 MSIServer - ok

13:21:27.0296 2792 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

13:21:27.0421 2792 MSKSSRV - ok

13:21:27.0437 2792 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

13:21:27.0562 2792 MSPCLOCK - ok

13:21:27.0593 2792 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

13:21:27.0734 2792 MSPQM - ok

13:21:27.0781 2792 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

13:21:27.0906 2792 mssmbios - ok

13:21:27.0968 2792 MSSQL$SQLEXPRESS - ok

13:21:28.0000 2792 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe

13:21:28.0015 2792 MSSQLServerADHelper - ok

13:21:28.0046 2792 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

13:21:28.0187 2792 MSTEE - ok

13:21:28.0203 2792 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

13:21:28.0234 2792 Mup - ok

13:21:28.0265 2792 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

13:21:28.0406 2792 NABTSFEC - ok

13:21:28.0468 2792 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

13:21:28.0625 2792 napagent - ok

13:21:28.0703 2792 NAUpdate (9d1cce440552500ded3a62f9d779cdb4) C:\Program Files\Nero\Update\NASvc.exe

13:21:28.0734 2792 NAUpdate - ok

13:21:28.0765 2792 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

13:21:28.0906 2792 NDIS - ok

13:21:28.0921 2792 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

13:21:29.0031 2792 NdisIP - ok

13:21:29.0078 2792 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

13:21:29.0109 2792 NdisTapi - ok

13:21:29.0125 2792 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

13:21:29.0265 2792 Ndisuio - ok

13:21:29.0281 2792 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

13:21:29.0406 2792 NdisWan - ok

13:21:29.0453 2792 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

13:21:29.0484 2792 NDProxy - ok

13:21:29.0546 2792 Net Driver HPZ12 (80b7a96f908da13617e7e6832c5c6a64) C:\WINDOWS\system32\HPZinw12.dll

13:21:29.0546 2792 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

13:21:29.0546 2792 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

13:21:29.0562 2792 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

13:21:29.0687 2792 NetBIOS - ok

13:21:29.0734 2792 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

13:21:29.0859 2792 NetBT - ok

13:21:29.0906 2792 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

13:21:30.0062 2792 NetDDE - ok

13:21:30.0078 2792 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

13:21:30.0203 2792 NetDDEdsdm - ok

13:21:30.0250 2792 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

13:21:30.0390 2792 Netlogon - ok

13:21:30.0453 2792 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

13:21:30.0578 2792 Netman - ok

13:21:30.0750 2792 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:21:30.0765 2792 NetTcpPortSharing - ok

13:21:30.0921 2792 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

13:21:31.0000 2792 Nla - ok

13:21:31.0062 2792 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

13:21:31.0234 2792 Npfs - ok

13:21:31.0265 2792 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

13:21:31.0406 2792 Ntfs - ok

13:21:31.0453 2792 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

13:21:31.0578 2792 NtLmSsp - ok

13:21:31.0640 2792 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

13:21:31.0781 2792 NtmsSvc - ok

13:21:31.0843 2792 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

13:21:31.0953 2792 Null - ok

13:21:32.0171 2792 nv (83c814ba5911f0ae8e79eeed235bc1fb) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

13:21:32.0468 2792 nv - ok

13:21:32.0515 2792 NVSvc (269f22e521238c8258a720820a997987) C:\WINDOWS\system32\nvsvc32.exe

13:21:32.0531 2792 NVSvc - ok

13:21:32.0578 2792 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

13:21:32.0734 2792 NwlnkFlt - ok

13:21:32.0750 2792 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

13:21:32.0875 2792 NwlnkFwd - ok

13:21:32.0937 2792 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

13:21:32.0937 2792 ose - ok

13:21:33.0000 2792 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys

13:21:33.0125 2792 Parport - ok

13:21:33.0140 2792 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

13:21:33.0265 2792 PartMgr - ok

13:21:33.0296 2792 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

13:21:33.0453 2792 ParVdm - ok

13:21:33.0453 2792 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

13:21:33.0593 2792 PCI - ok

13:21:33.0609 2792 PCIDump - ok

13:21:33.0640 2792 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

13:21:33.0765 2792 PCIIde - ok

13:21:33.0812 2792 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

13:21:33.0937 2792 Pcmcia - ok

13:21:33.0953 2792 PDCOMP - ok

13:21:33.0953 2792 PDFRAME - ok

13:21:33.0968 2792 PDRELI - ok

13:21:33.0984 2792 PDRFRAME - ok

13:21:34.0000 2792 perc2 - ok

13:21:34.0015 2792 perc2hib - ok

13:21:34.0109 2792 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

13:21:34.0171 2792 PlugPlay - ok

13:21:34.0234 2792 Pml Driver HPZ12 (0c155c5d8942b3cbcf9506a9d376b9ad) C:\WINDOWS\system32\HPZipm12.dll

13:21:34.0234 2792 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

13:21:34.0234 2792 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

13:21:34.0296 2792 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

13:21:34.0406 2792 PolicyAgent - ok

13:21:34.0468 2792 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

13:21:34.0656 2792 PptpMiniport - ok

13:21:34.0703 2792 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

13:21:34.0812 2792 ProtectedStorage - ok

13:21:34.0828 2792 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

13:21:34.0953 2792 PSched - ok

13:21:34.0984 2792 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

13:21:35.0093 2792 Ptilink - ok

13:21:35.0109 2792 ql1080 - ok

13:21:35.0125 2792 Ql10wnt - ok

13:21:35.0140 2792 ql12160 - ok

13:21:35.0156 2792 ql1240 - ok

13:21:35.0156 2792 ql1280 - ok

13:21:35.0187 2792 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

13:21:35.0312 2792 RasAcd - ok

13:21:35.0359 2792 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

13:21:35.0468 2792 RasAuto - ok

13:21:35.0484 2792 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

13:21:35.0609 2792 Rasl2tp - ok

13:21:35.0656 2792 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

13:21:35.0781 2792 RasMan - ok

13:21:35.0812 2792 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

13:21:35.0953 2792 RasPppoe - ok

13:21:35.0968 2792 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

13:21:36.0078 2792 Raspti - ok

13:21:36.0140 2792 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

13:21:36.0265 2792 Rdbss - ok

13:21:36.0281 2792 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

13:21:36.0406 2792 RDPCDD - ok

13:21:36.0437 2792 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

13:21:36.0546 2792 rdpdr - ok

13:21:36.0609 2792 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

13:21:36.0656 2792 RDPWD - ok

13:21:36.0703 2792 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

13:21:36.0828 2792 RDSessMgr - ok

13:21:36.0859 2792 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

13:21:36.0984 2792 redbook - ok

13:21:37.0046 2792 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

13:21:37.0171 2792 RemoteAccess - ok

13:21:37.0218 2792 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll

13:21:37.0343 2792 RemoteRegistry - ok

13:21:37.0375 2792 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

13:21:37.0500 2792 RpcLocator - ok

13:21:37.0546 2792 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

13:21:37.0609 2792 RpcSs - ok

13:21:37.0671 2792 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

13:21:37.0796 2792 RSVP - ok

13:21:37.0875 2792 RTL8187B (b8a68977ab5c05990696fc0237fda96a) C:\WINDOWS\system32\DRIVERS\RTL8187B.sys

13:21:37.0921 2792 RTL8187B - ok

13:21:37.0968 2792 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

13:21:38.0093 2792 SamSs - ok

13:21:38.0109 2792 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

13:21:38.0218 2792 SCardSvr - ok

13:21:38.0281 2792 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

13:21:38.0421 2792 Schedule - ok

13:21:38.0468 2792 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys

13:21:38.0609 2792 sdbus - ok

13:21:38.0656 2792 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

13:21:38.0734 2792 Secdrv - ok

13:21:38.0765 2792 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

13:21:38.0890 2792 seclogon - ok

13:21:38.0906 2792 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

13:21:39.0046 2792 SENS - ok

13:21:39.0078 2792 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys

13:21:39.0203 2792 Serial - ok

13:21:39.0250 2792 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

13:21:39.0359 2792 Sfloppy - ok

13:21:39.0421 2792 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

13:21:39.0546 2792 SharedAccess - ok

13:21:39.0609 2792 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

13:21:39.0625 2792 ShellHWDetection - ok

13:21:39.0640 2792 Simbad - ok

13:21:39.0703 2792 SiSGbeXP (441b5b4f9f4a3c5d61af9c872d7b65b1) C:\WINDOWS\system32\DRIVERS\SiSGbeXP.sys

13:21:39.0750 2792 SiSGbeXP - ok

13:21:39.0781 2792 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

13:21:39.0921 2792 SLIP - ok

13:21:39.0937 2792 Sparrow - ok

13:21:39.0968 2792 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

13:21:40.0109 2792 splitter - ok

13:21:40.0171 2792 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

13:21:40.0203 2792 Spooler - ok

13:21:40.0328 2792 SQLBrowser (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

13:21:40.0359 2792 SQLBrowser - ok

13:21:40.0359 2792 SQLWriter (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

13:21:40.0375 2792 SQLWriter - ok

13:21:40.0406 2792 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

13:21:40.0515 2792 sr - ok

13:21:40.0578 2792 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

13:21:40.0687 2792 srservice - ok

13:21:40.0734 2792 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

13:21:40.0812 2792 Srv - ok

13:21:40.0843 2792 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

13:21:40.0953 2792 SSDPSRV - ok

13:21:40.0968 2792 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

13:21:41.0156 2792 stisvc - ok

13:21:41.0171 2792 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

13:21:41.0312 2792 streamip - ok

13:21:41.0328 2792 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

13:21:41.0453 2792 swenum - ok

13:21:41.0468 2792 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

13:21:41.0578 2792 swmidi - ok

13:21:41.0593 2792 SwPrv - ok

13:21:41.0609 2792 symc810 - ok

13:21:41.0625 2792 symc8xx - ok

13:21:41.0640 2792 sym_hi - ok

13:21:41.0656 2792 sym_u3 - ok

13:21:41.0687 2792 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

13:21:41.0843 2792 sysaudio - ok

13:21:41.0859 2792 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

13:21:41.0984 2792 SysmonLog - ok

13:21:42.0015 2792 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

13:21:42.0140 2792 TapiSrv - ok

13:21:42.0203 2792 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

13:21:42.0265 2792 Tcpip - ok

13:21:42.0296 2792 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

13:21:42.0421 2792 TDPIPE - ok

13:21:42.0453 2792 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

13:21:42.0593 2792 TDTCP - ok

13:21:42.0593 2792 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

13:21:42.0718 2792 TermDD - ok

13:21:42.0765 2792 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

13:21:42.0890 2792 TermService - ok

13:21:42.0937 2792 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

13:21:42.0968 2792 Themes - ok

13:21:43.0015 2792 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe

13:21:43.0093 2792 TlntSvr - ok

13:21:43.0109 2792 TosIde - ok

13:21:43.0140 2792 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

13:21:43.0265 2792 TrkWks - ok

13:21:43.0296 2792 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

13:21:43.0421 2792 Udfs - ok

13:21:43.0437 2792 ultra - ok

13:21:43.0500 2792 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

13:21:43.0640 2792 Update - ok

13:21:43.0671 2792 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

13:21:43.0750 2792 upnphost - ok

13:21:43.0765 2792 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

13:21:43.0906 2792 UPS - ok

13:21:43.0921 2792 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

13:21:44.0046 2792 usbccgp - ok

13:21:44.0078 2792 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

13:21:44.0218 2792 usbehci - ok

13:21:44.0250 2792 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

13:21:44.0359 2792 usbhub - ok

13:21:44.0375 2792 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

13:21:44.0484 2792 usbohci - ok

13:21:44.0546 2792 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

13:21:44.0671 2792 USBSTOR - ok

13:21:44.0718 2792 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

13:21:44.0843 2792 usbvideo - ok

13:21:44.0859 2792 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

13:21:44.0968 2792 VgaSave - ok

13:21:44.0984 2792 ViaIde - ok

13:21:45.0000 2792 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

13:21:45.0125 2792 VolSnap - ok

13:21:45.0140 2792 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

13:21:45.0218 2792 VSS - ok

13:21:45.0250 2792 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

13:21:45.0375 2792 W32Time - ok

13:21:45.0406 2792 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

13:21:45.0531 2792 Wanarp - ok

13:21:45.0531 2792 WDICA - ok

13:21:45.0562 2792 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

13:21:45.0671 2792 wdmaud - ok

13:21:45.0703 2792 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

13:21:45.0828 2792 WebClient - ok

13:21:45.0890 2792 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

13:21:46.0015 2792 winmgmt - ok

13:21:46.0062 2792 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll

13:21:46.0093 2792 WmdmPmSN - ok

13:21:46.0156 2792 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll

13:21:46.0234 2792 Wmi - ok

13:21:46.0250 2792 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

13:21:46.0390 2792 WmiAcpi - ok

13:21:46.0421 2792 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

13:21:46.0546 2792 WmiApSrv - ok

13:21:46.0671 2792 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe

13:21:46.0750 2792 WMPNetworkSvc - ok

13:21:46.0828 2792 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

13:21:46.0843 2792 WpdUsb - ok

13:21:47.0000 2792 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

13:21:47.0046 2792 WPFFontCache_v0400 - ok

13:21:47.0093 2792 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

13:21:47.0281 2792 WS2IFSL - ok

13:21:47.0343 2792 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

13:21:47.0468 2792 wscsvc - ok

13:21:47.0515 2792 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

13:21:47.0625 2792 WSTCODEC - ok

13:21:47.0656 2792 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

13:21:47.0812 2792 wuauserv - ok

13:21:47.0859 2792 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

13:21:47.0906 2792 WudfPf - ok

13:21:47.0937 2792 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

13:21:47.0968 2792 WudfRd - ok

13:21:47.0984 2792 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll

13:21:48.0000 2792 WudfSvc - ok

13:21:48.0062 2792 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

13:21:48.0218 2792 WZCSVC - ok

13:21:48.0250 2792 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

13:21:48.0375 2792 xmlprov - ok

13:21:48.0406 2792 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

13:21:48.0703 2792 \Device\Harddisk0\DR0 - ok

13:21:48.0703 2792 Boot (0x1200) (f6c8b74245d171394710c4621d0386a9) \Device\Harddisk0\DR0\Partition0

13:21:48.0703 2792 \Device\Harddisk0\DR0\Partition0 - ok

13:21:48.0703 2792 ============================================================

13:21:48.0703 2792 Scan finished

13:21:48.0703 2792 ============================================================

13:21:48.0812 2724 Detected object count: 3

13:21:48.0812 2724 Actual detected object count: 3

13:23:08.0234 2724 HP LaserJet Service ( UnsignedFile.Multi.Generic ) - skipped by user

13:23:08.0234 2724 HP LaserJet Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:23:08.0234 2724 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

13:23:08.0234 2724 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:23:08.0234 2724 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

13:23:08.0234 2724 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:26:38.0593 2172 Deinitialize success

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.04.10.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Bob :: HOLMES [administrator]

4/10/2012 8:55:04 AM

mbam-log-2012-04-10 (08-55-04).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 223693

Time elapsed: 19 minute(s), 52 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Bob at 9:35:24 on 2012-04-10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2045.1156 [GMT -5:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgemcx.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Nero\Update\NASvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe

C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

mURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil11f_ActiveX.exe -update activex