rootkits keep coming back

GeeWhiz00 · May 7, 2012

Malwarebytes is able to remove the rootkits, but they keep coming back. They return slower if I boot into safe mode. The primary symptom is redirection to unwanted websites and opening up new browsing windows to unwanted websites. My DDS and attach files are below. Thanks in advance.

DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Run by aida at 20:11:16 on 2012-05-06

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.316 [GMT -4:00]

.

AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com

BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File

BHO: Foxit Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File

TB: Foxit Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ZumoDrive] c:\program files\zecter\zumodrive\ZumoLauncher.lnk

uRun: [Google Update] "c:\documents and settings\aida\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_2_202_233_Plugin.exe -update plugin

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

mRun: [ZumoDrive] "c:\program files\zecter\zumodrive\ZumoLauncher.lnk"

mRun: [PSUNMain] "c:\program files\panda security\panda cloud antivirus\PSUNMain.exe" /Traybar

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "c:\documents and settings\all users\application data\malwarebytes\malwarebytes' anti-malware\cleanup.dll",ProcessCleanupScript

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 10.0.0.1

TCP: Interfaces\{9C98642B-78C9-4923-8DFD-BE08F792C45B} : DhcpNameServer = 10.0.0.1

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} -

Notify: NecUsb3Sevices - USB3Sw32.dll

Notify: USB3Sw32 - USB3Sw32.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\aida\application data\mozilla\firefox\profiles\eswlnpz7.default\

FF - prefs.js: browser.startup.homepage - hxxp://welikehits.com/surf.php

FF - component: c:\documents and settings\aida\application data\mozilla\firefox\profiles\eswlnpz7.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\imtcp_xpcom.dll

FF - component: c:\documents and settings\aida\application data\mozilla\firefox\profiles\eswlnpz7.default\extensions\capturefoxmovie@advancity.net\components\capturefoxxpi_win32.dll

FF - component: c:\documents and settings\aida\application data\mozilla\firefox\profiles\eswlnpz7.default\extensions\screencaptureelite@plugin\platform\winnt_x86-msvc\components\SCEFF3Client.dll

FF - plugin: c:\documents and settings\aida\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\aida\application data\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\aida\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Webmail Ad Blocker: gmailnoads@mywebber.com - %profile%\extensions\gmailnoads@mywebber.com

FF - Ext: Tempomail: tempomail@ingetic..maxime.robache - %profile%\extensions\tempomail@ingetic..maxime.robache

FF - Ext: ReminderFox: {ada4b710-8346-4b82-8199-5de2b400a6ae} - %profile%\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}

FF - Ext: Capture Fox: capturefoxmovie@advancity.net - %profile%\extensions\capturefoxmovie@advancity.net

FF - Ext: iMacros for Firefox: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} - %profile%\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

FF - Ext: SearchStatus: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a} - %profile%\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}

FF - Ext: Screen Capture Elite: screencaptureelite@plugin - %profile%\extensions\screencaptureelite@plugin

FF - Ext: Click&Clean: clickclean@hotcleaner.com - %profile%\extensions\clickclean@hotcleaner.com

FF - Ext: SeoQuake: {317B5128-0B0B-49b2-B2DB-1E7560E16C74} - %profile%\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

.

============= SERVICES / DRIVERS ===============

.

R3 KTC111;Kingston EtherRx KNE111TX NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\KTC111.SYS [2003-9-15 19016]

S1 CbFs;CbFs;c:\windows\system32\drivers\cbfs.sys [2010-4-12 147416]

S1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [2010-5-4 129928]

S2 clientservice;Crcdisk;c:\windows\system32\svchost.exe -k netsvcs [2001-8-23 14336]

S2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2010-5-27 141384]

S2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2010-4-30 97032]

S2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2010-4-30 111624]

S2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2010-5-12 110920]

S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2007-7-29 20160]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-9 253088]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-5-6 40776]

S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\rkpavproc1.sys --> c:\windows\system32\drivers\RkPavproc1.sys [?]

S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2008-2-5 44928]

.

=============== Created Last 30 ================

.

2012-05-06 14:03:48 54016 -c--a-w- c:\windows\system32\drivers\tjpcg.sys

2012-05-06 09:03:21 40776 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-04-14 18:49:13 -------- d-----w- C:\8b932b19c531de31486369ac

2012-04-14 18:27:22 -------- d-----w- C:\a13e1fdda4f013cfa6a1

2012-04-13 07:02:44 200976 -c--a-w- c:\windows\system32\drivers\tmcomm.sys

2012-04-12 22:46:55 -------- d-----w- C:\3ed78a8d3e3fdb96b6d2ca8748a643

2012-04-12 19:46:14 -------- d-----w- C:\a7b9281ead74d054c51d9c102f303925

2012-04-12 18:04:45 -------- d-----w- C:\b39195a5979437de95c7ae2e

2012-04-09 17:56:24 418464 -c--a-w- c:\windows\system32\FlashPlayerApp.exe

.

==================== Find3M ====================

.

2012-05-06 02:43:00 0 -csha-w- c:\windows\system32\dds_trash_log.cmd

2012-04-14 05:13:02 70304 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-13 18:01:33 102400 -c--a-w- c:\windows\RegBootClean.exe

2012-04-11 17:55:44 22032 -c--a-w- c:\windows\DCEBoot.exe

2012-04-04 19:56:40 22344 -c--a-w- c:\windows\system32\drivers\mbam.sys

2012-03-06 22:28:49 60304 -c--a-w- c:\documents and settings\aida\g2mdlhlpx.exe

2012-03-01 11:01:32 916992 -c--a-w- c:\windows\system32\wininet.dll

2012-03-01 11:01:32 43520 -c----w- c:\windows\system32\licmgr10.dll

2012-03-01 11:01:32 1469440 -c----w- c:\windows\system32\inetcpl.cpl

2012-02-29 14:10:16 177664 -c--a-w- c:\windows\system32\wintrust.dll

2012-02-29 14:10:16 148480 -c--a-w- c:\windows\system32\imagehlp.dll

2012-02-29 12:17:40 385024 -c----w- c:\windows\system32\html.iec

.

============= FINISH: 20:17:52.07 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 9/16/2003 3:38:32 AM

System Uptime: 5/5/2012 10:41:11 PM (22 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | CUW-FX

Processor: Intel Pentium III processor | PGA 370 | 651/100mhz

.

==== Disk Partitions =========================

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe SVG Viewer 3.0

Content Buzzer

Content Notifier

Dynamic Traders Group, Inc. DT6 ver 1

EasyCleaner

ePrompter

Foxit Reader

FXDD - MetaTrader 4.00

Google Talk Plugin

GoToMeeting 5.1.0.880

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

J2SE Runtime Environment 5.0 Update 4

Java Auto Updater

Java 6 Update 20

Kcast Beta 2.0.0

Malwarebytes Anti-Malware version 1.61.0.1400

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Data Access Components KB870669

Microsoft FrontPage Client - English

Microsoft Office 2000 Premium

Microsoft Office XP Professional with FrontPage

Microsoft Silverlight

Microsoft SQL Server Compact 3.5 SP2 ENU

Microsoft Visual Studio .NET Professional 2003 - English

Mozilla Firefox (3.6.28)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero - Burning Rom

Panda Cloud Antivirus

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2183461)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360131)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2416400)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2482017)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2497640)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2530548)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2559049)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2586448)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618444)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647516)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953155)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB970483)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975254)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

SSH Secure Shell

Turbo Trader 2

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2616676-v2)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update for Windows XP (KB978207)

Update for Windows XP (KB980182)

Visual Studio .NET Professional 2003 - English

Visual Studio.NET Baseline - English

VLC media player 1.0.5

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Media Format Runtime

Windows Media Player 10

Windows XP Service Pack 3

ZumoDrive

.

==== Event Viewer Messages From Past Week ========

.

5/3/2012 12:37:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

5/3/2012 12:19:02 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: CbFs Fips P3 PSINKNC

5/3/2012 12:10:11 PM, error: Schedule [7901] - The At26.job command failed to start due to the following error: %%2147942402

5/3/2012 12:10:01 PM, error: Schedule [7901] - The At25.job command failed to start due to the following error: %%2147942402

5/3/2012 12:06:26 PM, error: Service Control Manager [7023] - The Queuemgr service terminated with the following error: The specified module could not be found.

4/29/2012 5:10:02 PM, error: Schedule [7901] - The At36.job command failed to start due to the following error: %%2147942402

4/29/2012 5:10:01 PM, error: Schedule [7901] - The At35.job command failed to start due to the following error: %%2147942402

4/29/2012 4:32:00 PM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found.

4/29/2012 4:27:47 PM, error: Service Control Manager [7022] - The Panda Cloud Antivirus Service service hung on starting.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Ziptoa service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The VAIOMediaPlatform-PhotoServer-HTTP service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The USB3 Service service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Snac service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Sfcure01 service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Savrt service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Qbfcservice service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Proxyhostdriver service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The P1131vid service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Mstdc service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Ma763004 service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The K750obex service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Eaps2kbd service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The CTSYN service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Crcdisk service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Cmudau service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The ClntMgmt.sys service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The BVRPMPR5 service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Awhost32 service terminated with the following error: The specified module could not be found.

4/29/2012 4:26:46 PM, error: Service Control Manager [7023] - The Ati2mtaa service terminated with the following error: The specified module could not be found.

4/29/2012 4:23:33 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

.

==== End Of File ===========================

Maniac · May 7, 2012

Hello GeeWhiz00 and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

BACKDOOR WARNING

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

Step 1

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

TDSSKiller log
Malwarebytes' Anti-Malware log
a new fresh DDS log file

GeeWhiz00 · May 8, 2012

I decided to clean. I'll avoid using any passwords on the infected PC.

I realized afterward that I should have done a quick Malwarebytes scan rather than a full scan that took way over 14 hours to complete!.

17:50:35.0415 2984 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18

17:50:35.0996 2984 ============================================================

17:50:35.0996 2984 Current date / time: 2012/05/07 17:50:35.0996

17:50:35.0996 2984 SystemInfo:

17:50:35.0996 2984

17:50:35.0996 2984 OS Version: 5.1.2600 ServicePack: 3.0

17:50:35.0996 2984 Product type: Workstation

17:50:35.0996 2984 ComputerName: ADMIN

17:50:35.0996 2984 UserName: aida

17:50:35.0996 2984 Windows directory: C:\WINDOWS

17:50:35.0996 2984 System windows directory: C:\WINDOWS

17:50:35.0996 2984 Processor architecture: Intel x86

17:50:35.0996 2984 Number of processors: 1

17:50:35.0996 2984 Page size: 0x1000

17:50:35.0996 2984 Boot type: Normal boot

17:50:35.0996 2984 ============================================================

17:51:09.0164 2984 Drive \Device\Harddisk0\DR0 - Size: 0x25C77C000 (9.44 Gb), SectorSize: 0x200, Cylinders: 0x4D0, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

17:51:09.0324 2984 ============================================================

17:51:09.0324 2984 \Device\Harddisk0\DR0:

17:51:09.0374 2984 MBR partitions:

17:51:09.0374 2984 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12E0091

17:51:09.0374 2984 ============================================================

17:51:11.0076 2984 C: <-> \Device\Harddisk0\DR0\Partition0

17:51:11.0176 2984 ============================================================

17:51:11.0176 2984 Initialize success

17:51:11.0176 2984 ============================================================

17:51:15.0383 3128 ============================================================

17:51:15.0383 3128 Scan started

17:51:15.0383 3128 Mode: Manual;

17:51:15.0383 3128 ============================================================

17:51:20.0540 3128 Abiosdsk - ok

17:51:20.0610 3128 abp480n5 - ok

17:51:20.0971 3128 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys

17:51:21.0041 3128 ac97intc - ok

17:51:21.0301 3128 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

17:51:21.0321 3128 ACPI - ok

17:51:21.0501 3128 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

17:51:21.0561 3128 ACPIEC - ok

17:51:21.0642 3128 acrsch2svc - ok

17:51:21.0892 3128 ADM8511 (b05f2367f62552a2de7e3c352b7b9885) C:\WINDOWS\system32\DRIVERS\ADM8511.SYS

17:51:21.0962 3128 ADM8511 - ok

17:51:22.0423 3128 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

17:51:22.0513 3128 AdobeFlashPlayerUpdateSvc - ok

17:51:22.0583 3128 adpu160m - ok

17:51:22.0673 3128 adsexpb - ok

17:51:22.0853 3128 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

17:51:22.0903 3128 aec - ok

17:51:23.0204 3128 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

17:51:23.0254 3128 AFD - ok

17:51:23.0304 3128 Aha154x - ok

17:51:23.0374 3128 aic78u2 - ok

17:51:23.0434 3128 aic78xx - ok

17:51:23.0584 3128 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

17:51:23.0624 3128 Alerter - ok

17:51:23.0795 3128 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

17:51:23.0795 3128 ALG - ok

17:51:23.0865 3128 AliIde - ok

17:51:23.0965 3128 amsint - ok

17:51:24.0085 3128 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll

17:51:24.0105 3128 AppMgmt - ok

17:51:24.0165 3128 asc - ok

17:51:24.0225 3128 asc3350p - ok

17:51:24.0295 3128 asc3550 - ok

17:51:24.0636 3128 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

17:51:24.0776 3128 aspnet_state - ok

17:51:24.0886 3128 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

17:51:24.0886 3128 AsyncMac - ok

17:51:25.0177 3128 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

17:51:25.0187 3128 atapi - ok

17:51:25.0267 3128 Atdisk - ok

17:51:25.0577 3128 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

17:51:25.0607 3128 Atmarpc - ok

17:51:25.0807 3128 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

17:51:25.0807 3128 AudioSrv - ok

17:51:25.0958 3128 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

17:51:25.0958 3128 audstub - ok

17:51:26.0188 3128 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

17:51:26.0208 3128 Beep - ok

17:51:26.0488 3128 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

17:51:26.0909 3128 BITS - ok

17:51:27.0149 3128 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

17:51:27.0149 3128 Browser - ok

17:51:27.0790 3128 catchme - ok

17:51:28.0101 3128 CbFs (560c3ac812597d58626d6c92fdc7f58d) C:\WINDOWS\system32\drivers\cbfs.sys

17:51:28.0101 3128 CbFs - ok

17:51:28.0211 3128 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

17:51:28.0211 3128 cbidf2k - ok

17:51:28.0281 3128 cd20xrnt - ok

17:51:28.0461 3128 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

17:51:28.0501 3128 Cdaudio - ok

17:51:29.0262 3128 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

17:51:29.0303 3128 Cdfs - ok

17:51:29.0733 3128 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

17:51:29.0783 3128 Cdrom - ok

17:51:29.0843 3128 Changer - ok

17:51:29.0903 3128 cisvc - ok

17:51:29.0963 3128 clientservice - ok

17:51:30.0094 3128 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

17:51:30.0144 3128 ClipSrv - ok

17:51:30.0304 3128 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

17:51:31.0956 3128 clr_optimization_v2.0.50727_32 - ok

17:51:32.0457 3128 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

17:51:34.0200 3128 clr_optimization_v4.0.30319_32 - ok

17:51:34.0270 3128 CmdIde - ok

17:51:34.0320 3128 COMSysApp - ok

17:51:34.0410 3128 Cpqarray - ok

17:51:34.0530 3128 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

17:51:34.0540 3128 CryptSvc - ok

17:51:34.0590 3128 crystaloutputfileserver - ok

17:51:34.0660 3128 dac2w2k - ok

17:51:34.0720 3128 dac960nt - ok

17:51:34.0780 3128 db2licd - ok

17:51:38.0175 3128 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

17:51:38.0796 3128 DcomLaunch - ok

17:51:41.0981 3128 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

17:51:42.0191 3128 Dhcp - ok

17:51:47.0379 3128 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

17:51:47.0439 3128 Disk - ok

17:51:47.0499 3128 dmadmin - ok

17:51:49.0311 3128 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

17:51:49.0862 3128 dmboot - ok

17:51:53.0928 3128 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

17:51:54.0018 3128 dmio - ok

17:51:54.0088 3128 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

17:51:54.0098 3128 dmload - ok

17:51:54.0258 3128 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

17:51:54.0258 3128 dmserver - ok

17:51:54.0359 3128 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

17:51:54.0399 3128 DMusic - ok

17:51:54.0769 3128 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

17:51:54.0799 3128 Dnscache - ok

17:51:55.0130 3128 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

17:51:55.0140 3128 Dot3svc - ok

17:51:55.0210 3128 dpti2o - ok

17:51:55.0350 3128 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

17:51:55.0350 3128 drmkaud - ok

17:51:55.0450 3128 DSI_SiUSBXp_3_1 - ok

17:51:55.0630 3128 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

17:51:55.0640 3128 EapHost - ok

17:51:55.0700 3128 ELmou - ok

17:51:55.0761 3128 emproxy - ok

17:51:56.0231 3128 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

17:51:56.0231 3128 ERSvc - ok

17:51:56.0432 3128 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

17:51:56.0532 3128 Eventlog - ok

17:51:58.0374 3128 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\System32\es.dll

17:51:58.0895 3128 EventSystem - ok

17:52:02.0540 3128 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

17:52:02.0721 3128 Fastfat - ok

17:52:02.0871 3128 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

17:52:02.0891 3128 FastUserSwitchingCompatibility - ok

17:52:03.0031 3128 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

17:52:03.0041 3128 Fdc - ok

17:52:03.0331 3128 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

17:52:03.0331 3128 Fips - ok

17:52:03.0452 3128 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

17:52:03.0492 3128 Flpydisk - ok

17:52:04.0163 3128 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

17:52:04.0243 3128 FltMgr - ok

17:52:04.0904 3128 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

17:52:05.0434 3128 FontCache3.0.0.0 - ok

17:52:05.0535 3128 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

17:52:05.0535 3128 Fs_Rec - ok

17:52:05.0605 3128 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

17:52:05.0625 3128 Ftdisk - ok

17:52:05.0725 3128 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys

17:52:05.0795 3128 gameenum - ok

17:52:06.0276 3128 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

17:52:06.0346 3128 Gpc - ok

17:52:06.0917 3128 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

17:52:07.0027 3128 helpsvc - ok

17:52:07.0097 3128 HidServ - ok

17:52:07.0247 3128 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

17:52:07.0247 3128 HidUsb - ok

17:52:07.0548 3128 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

17:52:07.0608 3128 hkmsvc - ok

17:52:07.0668 3128 hpn - ok

17:52:07.0728 3128 hpt3xx - ok

17:52:08.0359 3128 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

17:52:08.0529 3128 HTTP - ok

17:52:08.0639 3128 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

17:52:08.0689 3128 HTTPFilter - ok

17:52:08.0749 3128 i2omgmt - ok

17:52:08.0809 3128 i2omp - ok

17:52:09.0390 3128 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

17:52:09.0430 3128 i8042prt - ok

17:52:10.0622 3128 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys

17:52:10.0782 3128 i81x - ok

17:52:11.0383 3128 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys

17:52:11.0413 3128 iAimFP0 - ok

17:52:11.0513 3128 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys

17:52:11.0513 3128 iAimFP1 - ok

17:52:11.0573 3128 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys

17:52:11.0583 3128 iAimFP2 - ok

17:52:11.0714 3128 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys

17:52:11.0734 3128 iAimFP3 - ok

17:52:12.0084 3128 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys

17:52:12.0114 3128 iAimFP4 - ok

17:52:12.0214 3128 iAimFP5 (0308aef61941e4af478fa1a0f83812f5) C:\WINDOWS\system32\DRIVERS\wADV07nt.sys

17:52:12.0214 3128 iAimFP5 - ok

17:52:12.0284 3128 iAimFP6 (714038a8aa5de08e12062202cd7eaeb5) C:\WINDOWS\system32\DRIVERS\wADV08nt.sys

17:52:12.0294 3128 iAimFP6 - ok

17:52:12.0415 3128 iAimFP7 (7bb3aa595e4507a788de1cdc63f4c8c4) C:\WINDOWS\system32\DRIVERS\wADV09nt.sys

17:52:12.0445 3128 iAimFP7 - ok

17:52:12.0735 3128 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys

17:52:12.0755 3128 iAimTV0 - ok

17:52:12.0855 3128 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys

17:52:12.0855 3128 iAimTV1 - ok

17:52:12.0935 3128 iAimTV2 - ok

17:52:13.0065 3128 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys

17:52:13.0075 3128 iAimTV3 - ok

17:52:13.0186 3128 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys

17:52:13.0216 3128 iAimTV4 - ok

17:52:13.0336 3128 iAimTV5 (791cc45de6e50445be72e8ad6401ff45) C:\WINDOWS\system32\DRIVERS\wATV10nt.sys

17:52:13.0356 3128 iAimTV5 - ok

17:52:13.0466 3128 iAimTV6 (352fa0e98bc461ce1ce5d41f64db558d) C:\WINDOWS\system32\DRIVERS\wATV06nt.sys

17:52:13.0476 3128 iAimTV6 - ok

17:52:15.0399 3128 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

17:52:15.0799 3128 idsvc - ok

17:52:15.0869 3128 imagesrv - ok

17:52:16.0611 3128 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

17:52:16.0631 3128 Imapi - ok

17:52:16.0781 3128 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

17:52:16.0801 3128 ImapiService - ok

17:52:16.0881 3128 ini910u - ok

17:52:16.0931 3128 ino_flpy - ok

17:52:17.0582 3128 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

17:52:17.0582 3128 IntelIde - ok

17:52:18.0473 3128 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

17:52:18.0503 3128 Ip6Fw - ok

17:52:18.0593 3128 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

17:52:18.0603 3128 IpFilterDriver - ok

17:52:18.0734 3128 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

17:52:18.0744 3128 IpInIp - ok

17:52:19.0465 3128 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

17:52:19.0555 3128 IpNat - ok

17:52:19.0655 3128 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

17:52:19.0695 3128 IPSec - ok

17:52:19.0875 3128 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

17:52:19.0895 3128 IRENUM - ok

17:52:20.0837 3128 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

17:52:20.0857 3128 isapnp - ok

17:52:22.0509 3128 JavaQuickStarterService (1834c96fb1f9280bcf6ddfa6de8338bf) C:\Program Files\Java\jre6\bin\jqs.exe

17:52:22.0619 3128 JavaQuickStarterService - ok

17:52:22.0709 3128 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

17:52:22.0709 3128 Kbdclass - ok

17:52:22.0900 3128 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

17:52:23.0370 3128 kbdhid - ok

17:52:23.0751 3128 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

17:52:23.0771 3128 kmixer - ok

17:52:23.0891 3128 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

17:52:23.0901 3128 KSecDD - ok

17:52:24.0452 3128 KTC111 (50a0090cbbf7ff701230ee1314598aef) C:\WINDOWS\system32\DRIVERS\KTC111.SYS

17:52:24.0462 3128 KTC111 - ok

17:52:24.0572 3128 L8042Kbd (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\crcdisk.dll

17:52:24.0582 3128 L8042Kbd ( Backdoor.Multi.ZAccess.gen ) - infected

17:52:24.0582 3128 L8042Kbd - detected Backdoor.Multi.ZAccess.gen (0)

17:52:24.0692 3128 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

17:52:24.0712 3128 lanmanserver - ok

17:52:24.0872 3128 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

17:52:24.0892 3128 lanmanworkstation - ok

17:52:24.0953 3128 lbrtfdc - ok

17:52:25.0353 3128 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

17:52:25.0363 3128 LmHosts - ok

17:52:26.0294 3128 Macromedia Licensing Service (a8382713f5870e4af1de4e8f7af9d882) C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

17:52:26.0395 3128 Macromedia Licensing Service - ok

17:52:27.0416 3128 MDM (6a7c978720e23f0622650dbe765acb09) c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

17:52:27.0626 3128 MDM - ok

17:52:27.0757 3128 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

17:52:27.0807 3128 Messenger - ok

17:52:27.0867 3128 mfesmfk - ok

17:52:28.0287 3128 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

17:52:28.0287 3128 mnmdd - ok

17:52:28.0448 3128 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\System32\mnmsrvc.exe

17:52:28.0458 3128 mnmsrvc - ok

17:52:28.0578 3128 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

17:52:28.0588 3128 Modem - ok

17:52:28.0738 3128 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

17:52:28.0768 3128 Mouclass - ok

17:52:28.0908 3128 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

17:52:28.0918 3128 mouhid - ok

17:52:29.0379 3128 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

17:52:29.0389 3128 MountMgr - ok

17:52:29.0449 3128 mraid35x - ok

17:52:29.0589 3128 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

17:52:29.0609 3128 MRxDAV - ok

17:52:31.0262 3128 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

17:52:31.0532 3128 MRxSmb - ok

17:52:31.0782 3128 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\System32\msdtc.exe

17:52:31.0792 3128 MSDTC - ok

17:52:32.0213 3128 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

17:52:32.0223 3128 Msfs - ok

17:52:32.0283 3128 MSIServer - ok

17:52:32.0383 3128 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

17:52:32.0393 3128 MSKSSRV - ok

17:52:32.0503 3128 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

17:52:32.0513 3128 MSPCLOCK - ok

17:52:32.0604 3128 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

17:52:32.0614 3128 MSPQM - ok

17:52:32.0774 3128 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

17:52:32.0784 3128 mssmbios - ok

17:52:32.0924 3128 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

17:52:33.0325 3128 Mup - ok

17:52:33.0805 3128 NanoServiceMain (9799191f31740eb7979c3b012aa6ba5b) C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

17:52:33.0835 3128 NanoServiceMain - ok

17:52:34.0516 3128 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

17:52:34.0626 3128 napagent - ok

17:52:35.0488 3128 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

17:52:35.0578 3128 NDIS - ok

17:52:35.0668 3128 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

17:52:35.0668 3128 NdisTapi - ok

17:52:35.0808 3128 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

17:52:35.0808 3128 Ndisuio - ok

17:52:36.0319 3128 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

17:52:36.0359 3128 NdisWan - ok

17:52:36.0910 3128 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

17:52:36.0930 3128 NDProxy - ok

17:52:36.0990 3128 NecUsb3 - ok

17:52:37.0461 3128 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

17:52:37.0471 3128 NetBIOS - ok

17:52:37.0591 3128 NetBT (7b0238b9b720e2f19ec2d435ba3acf54) C:\WINDOWS\system32\DRIVERS\netbt.sys

17:52:37.0601 3128 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\netbt.sys. Real md5: 7b0238b9b720e2f19ec2d435ba3acf54, Fake md5: 74b2b2f5bea5e9a3dc021d685551bd3d

17:52:37.0611 3128 NetBT ( Virus.Win32.ZAccess.k ) - infected

17:52:37.0611 3128 NetBT - detected Virus.Win32.ZAccess.k (0)

17:52:37.0761 3128 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

17:52:37.0791 3128 NetDDE - ok

17:52:37.0851 3128 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

17:52:37.0861 3128 NetDDEdsdm - ok

17:52:38.0352 3128 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

17:52:38.0372 3128 Netlogon - ok

17:52:38.0542 3128 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

17:52:38.0572 3128 Netman - ok

17:52:39.0714 3128 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

17:52:40.0355 3128 NetTcpPortSharing - ok

17:52:40.0555 3128 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

17:52:40.0665 3128 Nla - ok

17:52:40.0765 3128 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

17:52:40.0775 3128 Npfs - ok

17:52:44.0340 3128 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

17:52:44.0601 3128 Ntfs - ok

17:52:44.0671 3128 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe

17:52:44.0671 3128 NtLmSsp - ok

17:52:46.0824 3128 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

17:52:47.0465 3128 NtmsSvc - ok

17:52:47.0585 3128 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

17:52:47.0585 3128 Null - ok

17:52:47.0665 3128 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

17:52:47.0665 3128 NwlnkFlt - ok

17:52:47.0775 3128 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

17:52:47.0805 3128 NwlnkFwd - ok

17:52:47.0876 3128 oracleservicelocalora - ok

17:52:48.0657 3128 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys

17:52:48.0677 3128 P3 - ok

17:52:48.0787 3128 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

17:52:48.0797 3128 Parport - ok

17:52:49.0318 3128 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

17:52:49.0368 3128 PartMgr - ok

17:52:49.0538 3128 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

17:52:49.0548 3128 ParVdm - ok

17:52:49.0728 3128 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

17:52:49.0748 3128 PCI - ok

17:52:49.0798 3128 PCIDump - ok

17:52:49.0868 3128 PCIIde - ok

17:52:50.0579 3128 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

17:52:50.0660 3128 Pcmcia - ok

17:52:50.0720 3128 pcx1unic - ok

17:52:50.0780 3128 PDCOMP - ok

17:52:50.0850 3128 PDFRAME - ok

17:52:50.0910 3128 PDRELI - ok

17:52:50.0970 3128 PDRFRAME - ok

17:52:51.0030 3128 perc2 - ok

17:52:51.0090 3128 perc2hib - ok

17:52:51.0290 3128 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

17:52:51.0300 3128 PlugPlay - ok

17:52:51.0371 3128 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

17:52:51.0371 3128 PolicyAgent - ok

17:52:51.0461 3128 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

17:52:51.0471 3128 PptpMiniport - ok

17:52:51.0511 3128 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

17:52:51.0521 3128 ProtectedStorage - ok

17:52:52.0142 3128 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

17:52:52.0182 3128 PSched - ok

17:52:53.0403 3128 PSINAflt (469943fb4398df5662dd5d06193c0bb0) C:\WINDOWS\system32\DRIVERS\PSINAflt.sys

17:52:53.0413 3128 PSINAflt - ok

17:52:54.0956 3128 PSINFile (b573f1ee01046612576907bb08ad8e6f) C:\WINDOWS\system32\DRIVERS\PSINFile.sys

17:52:54.0956 3128 PSINFile - ok

17:52:57.0469 3128 PSINKNC (51b0bab73ec899399e5d6034105d6f21) C:\WINDOWS\system32\DRIVERS\psinknc.sys

17:52:57.0479 3128 PSINKNC - ok

17:52:57.0990 3128 PSINProc (d3730032f61fca2d2ae6a2daf90347b1) C:\WINDOWS\system32\DRIVERS\PSINProc.sys

17:52:57.0990 3128 PSINProc - ok

17:52:58.0150 3128 PSINProt (47345c84b45003d4b5975cda5f026787) C:\WINDOWS\system32\DRIVERS\PSINProt.sys

17:52:58.0160 3128 PSINProt - ok

17:52:58.0351 3128 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

17:52:58.0361 3128 Ptilink - ok

17:52:58.0421 3128 ql1080 - ok

17:52:58.0501 3128 Ql10wnt - ok

17:52:58.0561 3128 ql12160 - ok

17:52:58.0621 3128 ql1240 - ok

17:52:58.0691 3128 ql1280 - ok

17:52:58.0741 3128 qserver - ok

17:52:58.0821 3128 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

17:52:58.0821 3128 RasAcd - ok

17:52:59.0222 3128 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

17:52:59.0312 3128 RasAuto - ok

17:52:59.0773 3128 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

17:52:59.0793 3128 Rasl2tp - ok

17:53:00.0724 3128 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

17:53:00.0754 3128 RasMan - ok

17:53:00.0864 3128 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

17:53:00.0884 3128 RasPppoe - ok

17:53:01.0064 3128 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

17:53:01.0064 3128 Raspti - ok

17:53:01.0565 3128 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

17:53:01.0605 3128 Rdbss - ok

17:53:01.0946 3128 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

17:53:01.0966 3128 RDPCDD - ok

17:53:02.0256 3128 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

17:53:02.0306 3128 rdpdr - ok

17:53:02.0837 3128 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

17:53:02.0947 3128 RDPWD - ok

17:53:03.0127 3128 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

17:53:03.0147 3128 RDSessMgr - ok

17:53:03.0518 3128 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

17:53:03.0538 3128 redbook - ok

17:53:03.0648 3128 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

17:53:03.0658 3128 RemoteAccess - ok

17:53:03.0778 3128 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll

17:53:03.0788 3128 RemoteRegistry - ok

17:53:03.0848 3128 RkPavproc1 - ok

17:53:04.0119 3128 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\System32\locator.exe

17:53:04.0159 3128 RpcLocator - ok

17:53:05.0911 3128 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll

17:53:05.0931 3128 RpcSs - ok

17:53:06.0002 3128 RR2Vbi - ok

17:53:06.0092 3128 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\System32\rsvp.exe

17:53:06.0132 3128 RSVP - ok

17:53:06.0252 3128 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

17:53:06.0252 3128 SamSs - ok

17:53:06.0382 3128 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

17:53:06.0422 3128 SCardSvr - ok

17:53:07.0944 3128 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

17:53:08.0145 3128 Schedule - ok

17:53:08.0375 3128 SDTHOOK (f88d17b93621eeb8bef33b81e3af9207) C:\WINDOWS\system32\DRIVERS\SDTHOOK.sys

17:53:08.0385 3128 SDTHOOK - ok

17:53:08.0455 3128 SE2Bmdfl - ok

17:53:08.0555 3128 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

17:53:08.0565 3128 Secdrv - ok

17:53:08.0776 3128 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

17:53:08.0786 3128 seclogon - ok

17:53:09.0066 3128 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

17:53:09.0076 3128 SENS - ok

17:53:09.0146 3128 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

17:53:09.0156 3128 serenum - ok

17:53:09.0937 3128 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

17:53:09.0987 3128 Serial - ok

17:53:10.0368 3128 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

17:53:10.0388 3128 Sfloppy - ok

17:53:11.0369 3128 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

17:53:11.0479 3128 SharedAccess - ok

17:53:11.0680 3128 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

17:53:11.0690 3128 ShellHWDetection - ok

17:53:11.0750 3128 Simbad - ok

17:53:12.0341 3128 SNMP (60c377be6b3cc83f6a8584934b181d2e) C:\WINDOWS\System32\snmp.exe

17:53:12.0381 3128 SNMP - ok

17:53:12.0521 3128 SNMPTRAP (80a050795a107a76c2b1cd4cfbe010e6) C:\WINDOWS\System32\snmptrap.exe

17:53:12.0571 3128 SNMPTRAP - ok

17:53:12.0631 3128 Sparrow - ok

17:53:12.0691 3128 spbbcsvc - ok

17:53:12.0791 3128 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

17:53:12.0791 3128 splitter - ok

17:53:13.0232 3128 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

17:53:13.0252 3128 Spooler - ok

17:53:13.0623 3128 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\System32\DRIVERS\sr.sys

17:53:13.0663 3128 sr - ok

17:53:13.0833 3128 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

17:53:13.0883 3128 srservice - ok

17:53:15.0736 3128 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

17:53:15.0946 3128 Srv - ok

17:53:16.0356 3128 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

17:53:16.0376 3128 SSDPSRV - ok

17:53:17.0158 3128 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

17:53:17.0418 3128 stisvc - ok

17:53:17.0518 3128 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

17:53:17.0548 3128 swenum - ok

17:53:17.0678 3128 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

17:53:17.0678 3128 swmidi - ok

17:53:17.0748 3128 SwPrv - ok

17:53:17.0829 3128 symc810 - ok

17:53:17.0889 3128 symc8xx - ok

17:53:17.0949 3128 sym_hi - ok

17:53:18.0019 3128 sym_u3 - ok

17:53:18.0119 3128 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

17:53:18.0129 3128 sysaudio - ok

17:53:18.0229 3128 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

17:53:18.0249 3128 SysmonLog - ok

17:53:18.0880 3128 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

17:53:18.0910 3128 TapiSrv - ok

17:53:19.0511 3128 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

17:53:19.0671 3128 Tcpip - ok

17:53:19.0761 3128 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

17:53:19.0791 3128 TDPIPE - ok

17:53:19.0892 3128 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

17:53:19.0922 3128 TDTCP - ok

17:53:20.0072 3128 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

17:53:20.0082 3128 TermDD - ok

17:53:20.0352 3128 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

17:53:20.0633 3128 TermService - ok

17:53:20.0793 3128 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

17:53:20.0803 3128 Themes - ok

17:53:20.0923 3128 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\System32\tlntsvr.exe

17:53:20.0973 3128 TlntSvr - ok

17:53:21.0033 3128 TosIde - ok

17:53:21.0444 3128 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

17:53:21.0454 3128 TrkWks - ok

17:53:21.0624 3128 U2SP (228d8e60bc9c5238587b0bf1654ec580) C:\WINDOWS\system32\DRIVERS\u2s2kxp.sys

17:53:21.0634 3128 U2SP - ok

17:53:22.0295 3128 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

17:53:22.0305 3128 Udfs - ok

17:53:22.0365 3128 ultra - ok

17:53:22.0485 3128 UMWdf (c81b8635dee0d3ef5f64b3dd643023a5) C:\WINDOWS\System32\wdfmgr.exe

17:53:22.0495 3128 UMWdf - ok

17:53:22.0756 3128 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

17:53:22.0826 3128 Update - ok

17:53:22.0976 3128 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

17:53:23.0006 3128 upnphost - ok

17:53:23.0437 3128 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

17:53:23.0447 3128 UPS - ok

17:53:23.0557 3128 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

17:53:23.0557 3128 usbccgp - ok

17:53:23.0697 3128 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

17:53:23.0707 3128 usbhub - ok

17:53:23.0997 3128 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

17:53:24.0098 3128 usbprint - ok

17:53:24.0528 3128 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

17:53:24.0558 3128 usbscan - ok

17:53:24.0718 3128 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

17:53:24.0769 3128 USBSTOR - ok

17:53:24.0999 3128 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

17:53:25.0009 3128 usbuhci - ok

17:53:25.0119 3128 vet-filt - ok

17:53:25.0339 3128 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

17:53:25.0359 3128 VgaSave - ok

17:53:25.0440 3128 ViaIde - ok

17:53:25.0560 3128 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

17:53:25.0570 3128 VolSnap - ok

17:53:25.0760 3128 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

17:53:25.0800 3128 VSS - ok

17:53:25.0880 3128 w200mdfl - ok

17:53:26.0261 3128 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

17:53:26.0291 3128 W32Time - ok

17:53:26.0411 3128 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

17:53:26.0411 3128 Wanarp - ok

17:53:26.0501 3128 WDICA - ok

17:53:26.0651 3128 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

17:53:26.0661 3128 wdmaud - ok

17:53:26.0952 3128 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

17:53:26.0962 3128 WebClient - ok

17:53:27.0042 3128 webrootspysweeperservice - ok

17:53:27.0142 3128 websensepolicyserver - ok

17:53:27.0442 3128 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

17:53:27.0452 3128 winmgmt - ok

17:53:27.0673 3128 WmdmPmSN (a477391b7a8b0a0daabadb17cf533a4b) C:\WINDOWS\System32\MsPMSNSv.dll

17:53:27.0683 3128 WmdmPmSN - ok

17:53:27.0953 3128 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll

17:53:28.0073 3128 Wmi - ok

17:53:28.0264 3128 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\System32\wbem\wmiapsrv.exe

17:53:28.0274 3128 WmiApSrv - ok

17:53:28.0764 3128 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

17:53:28.0905 3128 WPFFontCache_v0400 - ok

17:53:29.0105 3128 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

17:53:29.0125 3128 wuauserv - ok

17:53:29.0355 3128 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

17:53:29.0425 3128 WZCSVC - ok

17:53:29.0595 3128 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

17:53:29.0616 3128 xmlprov - ok

17:53:29.0776 3128 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

17:53:31.0729 3128 \Device\Harddisk0\DR0 - ok

17:53:32.0069 3128 Boot (0x1200) (af08ed6153a75f30b7d14bcd184ec016) \Device\Harddisk0\DR0\Partition0

17:53:32.0079 3128 \Device\Harddisk0\DR0\Partition0 - ok

17:53:32.0099 3128 ============================================================

17:53:32.0109 3128 Scan finished

17:53:32.0109 3128 ============================================================

17:53:32.0199 3120 Detected object count: 2

17:53:32.0199 3120 Actual detected object count: 2

17:57:13.0427 3120 L8042Kbd ( Backdoor.Multi.ZAccess.gen ) - skipped by user

17:57:13.0427 3120 L8042Kbd ( Backdoor.Multi.ZAccess.gen ) - User select action: Skip

17:57:13.0918 3120 C:\WINDOWS\system32\DRIVERS\netbt.sys - copied to quarantine

17:57:15.0530 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\@ - copied to quarantine

17:57:15.0600 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\cfg.ini - copied to quarantine

17:57:15.0691 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\Desktop.ini - copied to quarantine

17:57:15.0821 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\L\akygdmgo - copied to quarantine

17:57:15.0901 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\oemid - copied to quarantine

17:57:16.0021 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000001.@ - copied to quarantine

17:57:16.0382 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000002.@ - copied to quarantine

17:57:16.0502 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000004.@ - copied to quarantine

17:57:16.0612 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000000.@ - copied to quarantine

17:57:16.0722 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000004.@ - copied to quarantine

17:57:16.0782 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000032.@ - copied to quarantine

17:57:16.0822 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\version - copied to quarantine

17:57:23.0101 3120 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\netbt.sys) error 1813

17:57:42.0659 3120 Backup copy found, using it..

17:57:44.0091 3120 C:\WINDOWS\system32\DRIVERS\netbt.sys - will be cured on reboot

17:57:53.0976 3120 C:\WINDOWS\$NtUninstallKB33768$\1303206663 - will be deleted on reboot

17:57:53.0976 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\@ - will be deleted on reboot

17:57:53.0996 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\cfg.ini - will be deleted on reboot

17:57:54.0006 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\Desktop.ini - will be deleted on reboot

17:57:54.0046 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\oemid - will be deleted on reboot

17:57:54.0046 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000001.@ - will be deleted on reboot

17:57:54.0046 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000002.@ - will be deleted on reboot

17:57:54.0066 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\00000004.@ - will be deleted on reboot

17:57:54.0076 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000000.@ - will be deleted on reboot

17:57:54.0086 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000004.@ - will be deleted on reboot

17:57:54.0086 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\U\80000032.@ - will be deleted on reboot

17:57:54.0086 3120 C:\WINDOWS\$NtUninstallKB33768$\3152164874\version - will be deleted on reboot

17:57:54.0126 3120 NetBT ( Virus.Win32.ZAccess.k ) - User select action: Cure

18:02:00.0110 2896 Deinitialize success

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.05.07.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

aida :: ADMIN [administrator]

5/7/2012 6:22:43 PM

mbam-log-2012-05-07 (18-22-43).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 271054

Time elapsed: 14 hour(s), 39 minute(s), 51 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 1

C:\WINDOWS\system32\crcdisk.dll (RootKit.0Access.H) -> Delete on reboot.

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 2

C:\WINDOWS\system32\crcdisk.dll (RootKit.0Access.H) -> Delete on reboot.

C:\TDSSKiller_Quarantine\07.05.2012_17.50.35\rtkt0000\zafs0000\tsk0002.dta (Rootkit.0Access) -> Quarantined and deleted successfully.

(end)

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Run by aida at 10:56:57 on 2012-05-08

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.331 [GMT -4:00]

.

AV: Panda Cloud Antivirus *Disabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter