brightjoy2 Posted May 15, 2012 ID:551535 Share Posted May 15, 2012 Tried deleting the virus but Avira scans there are still 4 but access is denied. But the Malwarebyte full scan says nothing is detected. When computer is restarted, the SMART repair data recovery pop up is no longer there but there is still nothing but a blue screen with nothing listed under programs. In the background dd.exe file needs to close pop up appears instead and the error message of a corrupted file keeps running like 50 times flooding the screen. Need HELP please... I've attached the dds. files here. Thanks alot..DDS (Ver_2011-08-26.01) - NTFSx86Internet Explorer: 8.0.6001.18702Run by Jeff at 16:53:09 on 2012-05-14Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2015.1226 [GMT -8:00].AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}.============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Avira\AntiVir Desktop\sched.exesvchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\HP\QuickPlay\QPService.exeC:\Program Files\HP\HP Software Update\HPWuSchd2.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exeC:\Program Files\ActivIdentity\ActivClient\accrdsub.exeC:\Program Files\Avira\AntiVir Desktop\avgnt.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\TomTom HOME 2\TomTomHOMERunner.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\ActivIdentity\ActivClient\acevents.exeC:\Program Files\ActivIdentity\ActivClient\accoca.exeC:\Program Files\Avira\AntiVir Desktop\avguard.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\WINDOWS\system32\svchost.exe -k hpdevmgmtC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Avira\AntiVir Desktop\avshadow.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exec:\PROGRA~1\mcafee\SITEAD~1\McSACore.exeC:\WINDOWS\System32\svchost.exe -k HPZ12C:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\System32\svchost.exe -k HPZ12svchost.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\TomTom HOME 2\TomTomHOMEService.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\WINDOWS\system32\mqsvc.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\WINDOWS\system32\mqtgsvc.exeC:\WINDOWS\system32\rundll32.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\WINDOWS\System32\svchost.exe -k HTTPFilterC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Java\jre6\bin\jucheck.exeC:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.yahoo.com/uSearch Page = hxxp://search.live.comuSearch Bar = hxxp://search.live.com/sphome.aspxuSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%smSearchAssistant = hxxp://search.live.com/sphome.aspxuURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dlluURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dllBHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dllBHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dllBHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLLBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dllTB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dllTB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} - "c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll"TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No FileEB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dlluRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimizeduRun: [Device Detection] c:\program files\fujifilm\myfinepix studio\dd.exemRun: [ehTray] c:\windows\ehome\ehtray.exemRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exemRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartupmRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInitmRun: [nwiz] nwiz.exe /installquiet /nodetectmRun: [MsmqIntCert] regsvr32 /s mqrt.dllmRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exemRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exemRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startupmRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /StartmRun: [Cpqset] c:\program files\hewlett-packard\default settings\cpqset.exemRun: [RecGuard] c:\windows\sminst\RecGuard.exemRun: [Reminder] c:\windows\creator\Remind_XP.exemRun: [hpqSRMon]mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [<NO NAME>]mRun: [accrdsub] "c:\program files\actividentity\activclient\accrdsub.exe"mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /minmRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttrayStartupFolder: c:\docume~1\jeff\startm~1\programs\startup\vongot~1.lnk - c:\program files\vongo\Tray.exeIE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllIE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllTrusted Zone: ahrn.com\wwwTrusted Zone: ahrn.com\www*Trusted Zone: chase.comTrusted Zone: internetTrusted Zone: mcafee.comDPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cabDPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0TCP: Interfaces\{8D7DC3B9-18BF-4DC8-97E5-50572F9D29C8} : DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLLHandler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dllHandler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dllHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: ackpbsc - c:\windows\system32\ackpbsc.dllNotify: acunlock - c:\program files\actividentity\activclient\acunlock.dll.================= FIREFOX ===================.FF - ProfilePath - c:\documents and settings\jeff\application data\mozilla\firefox\profiles\wifw4z5k.default\FF - prefs.js: browser.search.selectedEngine - Secure SearchFF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLLFF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLLFF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dllFF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dllFF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll.============= SERVICES / DRIVERS ===============.R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-12-20 11608]R2 accoca;ActivClient Middleware Service;c:\program files\actividentity\activclient\accoca.exe [2007-5-15 182576]R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-12-20 136360]R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-12-20 269480]R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-12-20 66616]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-5-14 654408]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\McSACore.exe [2009-12-3 95200]R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-12-10 92008]R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.361.0\SeaPort.EXE [2012-2-10 240408]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-5-14 22344]S2 0062421329956074mcinstcleanup;McAfee Application Installer Cleanup (0062421329956074);c:\windows\temp\006242~1.exe -cleanup -nolog --> c:\windows\temp\006242~1.EXE -cleanup -nolog [?]S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.361.0\BBSvc.EXE [2012-2-10 193816]S2 MOBCleanup;MOBCleanup;"c:\docume~1\jeff\locals~1\temp\mobcleanup.exe" --> c:\docume~1\jeff\locals~1\temp\MOBCleanup.exe [?]S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [2006-6-6 61952]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 257696]S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [2010-1-6 57856]S3 usbvm328;HP Camera;c:\windows\system32\drivers\usbvm326.sys [2011-2-14 219648]S3 vmfilter323;VC0326 filter service for Serome;c:\windows\system32\drivers\vmfilter323.sys [2011-2-14 475264].=============== Created Last 30 ================.2012-05-14 16:44:21 -------- d-----w- c:\documents and settings\jeff\application data\Malwarebytes2012-05-14 16:44:15 22344 ----a-w- c:\windows\system32\drivers\mbam.sys2012-05-14 16:44:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-05-14 16:44:15 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes2012-04-23 17:24:12 -------- d--h--w- c:\program files\PureEdge1.==================== Find3M ====================.2012-05-05 00:10:22 70304 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-05-05 00:10:22 419488 ---ha-w- c:\windows\system32\FlashPlayerApp.exe2012-04-11 13:14:41 2148352 ---ha-w- c:\windows\system32\ntoskrnl.exe2012-04-11 13:12:06 1862272 ---ha-w- c:\windows\system32\win32k.sys2012-04-11 12:35:51 2026496 ---ha-w- c:\windows\system32\ntkrnlpa.exe2012-03-01 11:01:32 916992 ---ha-w- c:\windows\system32\wininet.dll2012-03-01 11:01:32 43520 ---ha-w- c:\windows\system32\licmgr10.dll2012-03-01 11:01:32 1469440 ---h--w- c:\windows\system32\inetcpl.cpl2012-02-29 14:10:16 177664 ---ha-w- c:\windows\system32\wintrust.dll2012-02-29 14:10:16 148480 ---ha-w- c:\windows\system32\imagehlp.dll2012-02-29 12:17:40 385024 ---ha-w- c:\windows\system32\html.iec2001-06-20 21:19:18 40960 ---ha-w- c:\program files\ACMonitor_X83.exe.=================== ROOTKIT ====================.Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.netWindows 5.1.2600.CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.device: opened successfullyuser: error reading MBR.Disk trace:called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sysc:\windows\system32\drivers\nvata.sys NVIDIA Corporation NVIDIA nForce IDE Driver1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8A59DAB8]3 CLASSPNP[0xF74E7FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000007d[0x8A591BE0]5 ACPI[0xF735E620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000007c[0x8A4FA658]kernel: MBR read successfully_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x7a; }user != kernel MBR !!!.============= FINISH: 16:54:11.25 =============== Link to post Share on other sites More sharing options...
Jintan Posted May 15, 2012 ID:551543 Share Posted May 15, 2012 Welcome to Malwarebytes brightjoy2,The logs don't quite reflect the likely bootkit/rootkit infection on that system, so let's take some different looks at things, then decide on repairs.To make sure you have an accurate view of files there, make sure you can View Hidden Files. Also uncheck "Hide Extensions for Known File Types"To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Here are some antivirus disable tips if needed.-------Click here and download OldTimer's OTL to your desktop, then click that to open the scan display. At the top click "Scan All Users", then click "Run Scan". Make no other changes at this time.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are also saved in the same location as OTL.exe. Post the contents of those back here please.-----------Click here and download the installer for Gmer to your desktop, then click that file to run Gmer.Once the opening scan finishes, click on Scan (again, before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan). When completed, click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.-----------Download aswMBR ( 511KB ) to your desktop.Double click the aswMBR.exe icon to run itIf you can have an open Internet connection, and allow it to download the latest Avast engine detections.If avast! antivirus is already installed, just do the next step.Click the Scan button to start the scanOn completion of the scan, click the save log button, save it to your desktop and post it in your next reply.A lot, but comprehensive, and will make sure we get a good view of everything. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 15, 2012 Author ID:551551 Share Posted May 15, 2012 Thanks alot for your help. The OTL logs are as followsOTL logfile created on: 5/14/2012 6:47:15 PM - Run 1OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Jeff\DesktopWindows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1.97 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 62.19% Memory free3.82 Gb Paging File | 3.19 Gb Available in Paging File | 83.56% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 80.59 Gb Total Space | 22.81 Gb Free Space | 28.30% Space Free | Partition Type: NTFSDrive D: | 11.53 Gb Total Space | 1.26 Gb Free Space | 10.93% Space Free | Partition Type: FAT32Computer Name: STOLL | User Name: Jeff | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2012/05/14 18:46:51 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jeff\Desktop\OTL.exePRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2012/02/10 11:28:06 | 000,193,816 | -H-- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.EXEPRC - [2012/01/13 12:21:10 | 000,095,200 | -H-- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exePRC - [2011/06/30 09:56:40 | 000,269,480 | -H-- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exePRC - [2011/04/28 07:55:25 | 000,136,360 | -H-- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exePRC - [2010/12/13 09:39:54 | 000,281,768 | -H-- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exePRC - [2010/12/10 04:29:00 | 000,092,008 | -H-- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exePRC - [2010/12/10 04:28:56 | 000,247,144 | -H-- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exePRC - [2010/02/10 18:27:24 | 000,386,872 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jucheck.exePRC - [2010/01/14 22:11:00 | 000,076,968 | -H-- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exePRC - [2008/04/13 16:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2007/05/15 12:08:40 | 000,182,576 | -H-- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accoca.exePRC - [2007/05/15 12:08:38 | 000,095,024 | -H-- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\acevents.exePRC - [2007/05/15 12:08:08 | 000,293,168 | -H-- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe========== Modules (No Company Name) ==========MOD - [2011/11/03 07:28:36 | 001,292,288 | -H-- | M] () -- C:\WINDOWS\system32\quartz.dllMOD - [2011/02/04 18:48:30 | 000,291,840 | -H-- | M] () -- C:\WINDOWS\system32\sbe.dllMOD - [2010/06/17 15:27:22 | 000,355,688 | -H-- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dllMOD - [2008/04/13 16:11:59 | 000,014,336 | -H-- | M] () -- C:\WINDOWS\system32\msdmo.dllMOD - [2008/04/13 16:11:51 | 000,059,904 | -H-- | M] () -- C:\WINDOWS\system32\devenum.dllMOD - [2006/07/11 20:55:04 | 000,172,032 | -H-- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\common\CLDataSync.dll========== Win32 Services (SafeList) ==========SRV - File not found [Auto | Stopped] -- C:\DOCUME~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe -- (MOBCleanup)SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)SRV - File not found [Auto | Stopped] -- C:\WINDOWS\TEMP\006242~1.EXE -- (0062421329956074mcinstcleanup) McAfee Application Installer Cleanup (0062421329956074)SRV - [2012/05/04 16:10:23 | 000,257,696 | -H-- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2012/02/10 11:28:06 | 000,240,408 | -H-- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.EXE -- (BBUpdate)SRV - [2012/02/10 11:28:06 | 000,193,816 | -H-- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE -- (BBSvc)SRV - [2012/01/13 12:21:10 | 000,095,200 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)SRV - [2011/06/30 09:56:40 | 000,269,480 | -H-- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)SRV - [2011/04/28 07:55:25 | 000,136,360 | -H-- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)SRV - [2010/12/10 04:29:00 | 000,092,008 | -H-- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)SRV - [2007/05/15 12:08:40 | 000,182,576 | -H-- | M] (ActivIdentity) [Auto | Running] -- C:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)SRV - [2006/06/12 12:27:28 | 000,126,976 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe -- (AddFiltr)SRV - [2006/05/09 12:11:10 | 000,176,128 | -H-- | M] (Starz Entertainment Group LLC) [Auto | Stopped] -- C:\Program Files\Vongo\VongoService.exe -- (Vongo Service)SRV - [2005/10/06 17:12:30 | 000,855,552 | -H-- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)========== Driver Services (SafeList) ==========DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\UIUSYS.SYS -- (UIUSys)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)DRV - File not found [Kernel | System | Stopped] -- -- (Changer)DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)DRV - [2011/06/30 09:56:41 | 000,138,192 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)DRV - [2011/06/30 09:56:41 | 000,066,616 | -H-- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)DRV - [2010/06/17 15:27:22 | 000,028,520 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)DRV - [2010/06/17 15:27:12 | 000,011,608 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)DRV - [2010/01/06 19:19:00 | 000,057,856 | -H-- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SCR3XX2K.sys -- (SCR3XX2K)DRV - [2009/06/22 03:48:44 | 000,091,776 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC)DRV - [2008/05/08 06:02:52 | 000,203,136 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST)DRV - [2007/04/13 04:56:45 | 000,475,264 | RH-- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmfilter323.sys -- (vmfilter323)DRV - [2007/04/13 04:56:45 | 000,219,648 | RH-- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbvm326.sys -- (usbvm328)DRV - [2006/08/29 14:12:28 | 000,990,592 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)DRV - [2006/08/29 14:11:08 | 000,208,384 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)DRV - [2006/08/29 14:10:56 | 000,728,576 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)DRV - [2006/06/19 04:37:34 | 000,036,864 | -H-- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)DRV - [2006/06/06 12:39:56 | 000,061,952 | -H-- | M] (Ricoh) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\5U870CAP.sys -- (5U870CAP_VID_1262&PID_25FD)DRV - [2006/06/01 16:02:36 | 000,572,928 | -H-- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)DRV - [2006/05/12 12:05:02 | 000,057,320 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)DRV - [2006/04/28 09:12:00 | 000,429,184 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)DRV - [2006/03/05 15:49:36 | 000,011,136 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)DRV - [2006/03/02 16:31:04 | 000,013,056 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)DRV - [2006/03/02 16:31:02 | 000,034,176 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)DRV - [2006/01/26 16:04:16 | 000,099,584 | -H-- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)DRV - [2005/11/15 20:28:32 | 000,028,928 | -H-- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)DRV - [2005/10/31 18:08:00 | 000,308,992 | -H-- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)DRV - [2005/10/31 17:54:50 | 000,051,584 | -H-- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)DRV - [2005/09/19 13:24:20 | 000,005,760 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)DRV - [2005/09/19 13:24:10 | 000,009,344 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)DRV - [2005/09/19 13:23:52 | 000,007,808 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)DRV - [2004/08/03 22:31:34 | 000,020,992 | -H-- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspxIE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspxIE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.comIE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRCIE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\SearchScopes\{F5CB2064-D2FA-4E5D-9A55-C05764F1FB0E}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b2ie7IE - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ==========FF - prefs.js..browser.search.defaultenginename: "Secure Search"FF - prefs.js..browser.search.selectedEngine: "Secure Search"FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p="FF - user.js - File not foundFF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/08/04 14:59:39 | 000,000,000 | -H-D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/03/04 11:16:00 | 000,000,000 | -H-D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/10 10:11:25 | 000,000,000 | -H-D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/06 19:04:38 | 000,000,000 | -H-D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2012/03/16 15:12:17 | 000,000,000 | -H-D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2012/05/06 19:04:39 | 000,000,000 | -H-D | M]FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/08/04 14:59:39 | 000,000,000 | -H-D | M][2011/03/01 14:46:11 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Jeff\Application Data\Mozilla\Extensions[2011/03/01 14:46:11 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Jeff\Application Data\Mozilla\Extensions\home2@tomtom.com[2012/05/05 15:55:48 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\wifw4z5k.default\extensions[2012/02/07 19:15:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions[2012/01/29 07:55:53 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll[2007/06/11 03:34:00 | 002,115,816 | -H-- | M] () -- C:\Program Files\mozilla firefox\plugins\NPSWF32.dll[2012/01/29 05:36:35 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml[2010/09/20 10:31:51 | 000,002,024 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml[2012/01/29 05:36:35 | 000,002,040 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xmlO1 HOSTS File: ([2006/03/15 20:00:00 | 000,000,734 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (Bing Bar Helper) - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3 - HKLM\..\Toolbar: (Bing Bar) - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O3 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.O3 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [accrdsub] C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity)O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe ()O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)O4 - HKLM..\Run: [hpqSRMon] File not foundO4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe (SoftThinks)O4 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005..\Run: [Device Detection] C:\Program Files\FUJIFILM\MyFinePix Studio\dd.exe ()O4 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\StartUp\Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (Starz)O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\StartUp\Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (Starz)O4 - Startup: C:\Documents and Settings\Jeff\Start Menu\Programs\StartUp\Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (Starz)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: ahrn.com ([www] http in Trusted sites)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: ahrn.com ([www*] https in Trusted sites)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: army.mil ([]* in Local intranet)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: chase.com ([]https in Trusted sites)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: internet ([]about in Trusted sites)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: mcafee.com ([]http in Trusted sites)O15 - HKU\S-1-5-21-2278501756-2133485100-4214599645-1005\..Trusted Domains: mcafee.com ([]https in Trusted sites)O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DDRevision Class)O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D7DC3B9-18BF-4DC8-97E5-50572F9D29C8}: DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O20 - Winlogon\Notify\ackpbsc: DllName - (C:\WINDOWS\system32\ackpbsc.dll) - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity)O20 - Winlogon\Notify\acunlock: DllName - (C:\Program Files\ActivIdentity\ActivClient\acunlock.dll) - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity)O24 - Desktop WallPaper: C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]O32 - AutoRun File - [2007/09/26 03:18:56 | 000,000,090 | -H-- | M] () - D:\Autorun.inf -- [ FAT32 ]O32 - AutoRun File - [2004/04/30 14:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB -- [ FAT32 ]O34 - HKLM BootExecute: (autocheck autochk *)O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)========== Files/Folders - Created Within 30 Days ==========[2012/05/14 18:46:47 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jeff\Desktop\OTL.exe[2012/05/14 16:53:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Jeff\Start Menu\Programs\Administrative Tools[2012/05/14 16:52:11 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Jeff\Desktop\dds.com[2012/05/14 08:44:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jeff\Application Data\Malwarebytes[2012/05/14 08:44:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware[2012/05/14 08:44:15 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2012/05/14 08:44:15 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2012/05/14 08:44:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2012/05/14 08:29:24 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Jeff\Recent[2012/05/11 16:04:17 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Jeff\Start Menu\Programs\Data Recovery[2012/04/30 09:33:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight[2012/04/30 09:33:41 | 000,000,000 | -H-D | C] -- C:\Program Files\Microsoft Silverlight[2012/04/23 09:33:32 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Jeff\Desktop\PureEdge[2012/04/23 09:24:12 | 000,000,000 | -H-D | C] -- C:\Program Files\PureEdge1[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2012/05/14 18:46:51 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jeff\Desktop\OTL.exe[2012/05/14 18:39:45 | 000,001,350 | -H-- | M] () -- C:\hpqp.ini[2012/05/14 18:37:33 | 000,000,039 | -H-- | M] () -- C:\XP_TV.ini[2012/05/14 18:37:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2012/05/14 17:10:15 | 000,000,830 | -H-- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job[2012/05/14 16:52:14 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Jeff\Desktop\dds.com[2012/05/14 08:44:16 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk[2012/05/14 08:28:10 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl[2012/05/12 20:20:25 | 000,000,855 | -H-- | M] () -- C:\Documents and Settings\Jeff\Application Data\Microsoft\Internet Explorer\Quick Launch\Data_Recovery.lnk[2012/05/12 20:20:25 | 000,000,176 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-883o8ZUhSyoNkar[2012/05/12 20:20:25 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-883o8ZUhSyoNka[2012/05/12 20:20:19 | 000,000,256 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\883o8ZUhSyoNka[2012/05/12 20:19:46 | 000,000,664 | -H-- | M] () -- C:\WINDOWS\System32\d3d9caps.dat[2012/05/11 16:04:19 | 000,000,837 | -H-- | M] () -- C:\Documents and Settings\Jeff\Desktop\Data_Recovery.lnk[2012/05/11 15:57:21 | 000,051,048 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml[2012/05/10 16:18:06 | 000,330,688 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2012/05/10 15:49:29 | 000,452,834 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat[2012/05/10 15:49:29 | 000,074,842 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat[2012/05/06 19:04:39 | 000,001,729 | -H-- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk[2012/05/06 18:57:40 | 000,077,386 | -H-- | M] () -- C:\WINDOWS\hpqins05.dat[2012/05/06 18:55:56 | 000,000,059 | -H-- | M] () -- C:\WINDOWS\WININIT.INI[2012/05/06 18:53:41 | 000,001,018 | -H-- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk[2012/05/04 16:10:22 | 000,419,488 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe[2012/05/04 16:10:22 | 000,070,304 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl[2012/04/30 19:15:56 | 009,080,143 | -H-- | M] () -- C:\Documents and Settings\Jeff\Desktop\TC_3-22.20.pdf[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files Created - No Company Name ==========[2012/05/14 08:44:16 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk[2012/05/12 20:20:24 | 000,000,855 | -H-- | C] () -- C:\Documents and Settings\Jeff\Application Data\Microsoft\Internet Explorer\Quick Launch\Data_Recovery.lnk[2012/05/11 16:04:19 | 000,000,837 | -H-- | C] () -- C:\Documents and Settings\Jeff\Desktop\Data_Recovery.lnk[2012/05/11 16:04:19 | 000,000,176 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-883o8ZUhSyoNkar[2012/05/11 16:04:19 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-883o8ZUhSyoNka[2012/05/11 16:04:11 | 000,000,256 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\883o8ZUhSyoNka[2012/05/06 18:53:41 | 000,001,018 | -H-- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk[2012/05/06 18:52:06 | 000,077,386 | -H-- | C] () -- C:\WINDOWS\hpqins05.dat[2012/04/30 19:15:56 | 009,080,143 | -H-- | C] () -- C:\Documents and Settings\Jeff\Desktop\TC_3-22.20.pdf[2012/02/15 17:37:00 | 000,003,072 | -H-- | C] () -- C:\WINDOWS\System32\iacenc.dll[2011/02/14 13:40:57 | 000,135,168 | RH-- | C] () -- C:\WINDOWS\System32\setupfilter.exe[2011/02/14 13:25:05 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat[2010/08/04 14:57:49 | 000,023,097 | -H-- | C] () -- C:\WINDOWS\hpqins15.dat========== Alternate Data Streams ==========@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2< End of report >OTL Extras logfile created on: 5/14/2012 6:47:15 PM - Run 1OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Jeff\DesktopWindows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1.97 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 62.19% Memory free3.82 Gb Paging File | 3.19 Gb Available in Paging File | 83.56% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 80.59 Gb Total Space | 22.81 Gb Free Space | 28.30% Space Free | Partition Type: NTFSDrive D: | 11.53 Gb Total Space | 1.26 Gb Free Space | 10.93% Space Free | Partition Type: FAT32Computer Name: STOLL | User Name: Jeff | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*.html [@ = NetscapeHTML] -- C:\Program Files\Netscape\Netscape Browser\netscape.exe (Netscape)========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*htmlfile [edit] -- Reg Error: Key error.http [open] -- C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCAPE.EXE -url "%1" (Netscape)https [open] -- C:\PROGRA~1\NETSCAPE\NETSCA~1\NETSCAPE.EXE -url "%1" (Netscape)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 0"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2========== Firewall Settings ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"" ="DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"" ="C:\Program Files\Vongo\VongoService.exe" = C:\Program Files\Vongo\VongoService.exe:*:enabled:VongoService -- (Starz Entertainment Group LLC)"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)"C:\Program Files\BearShare\BearShare.exe" = C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare -- (Free Peers, Inc.)"C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{069730C2-755A-485B-A205-27A1AAFA836A}" = InstantShareAlert"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1"{13BCF6CB-2F54-4962-9B11-32F07048ACF3}" = HP User Guides 0031"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate"{1CB34CE9-0E6B-493F-BB66-3425E5DF76E5}" = CP_CalendarTemplates1"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement"{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2"{2656D0AB-9EA4-4C58-A117-635F3CED8B93}" = Microsoft UI Engine"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java 6 Update 17"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006"{2A548002-9042-4083-A270-B67473DE1073}" = SkinsHP1"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.10 A2"{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support"{3FE0CFAB-584A-4AA5-B8CD-C32284CFA308}" = RandMap"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 G2"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 2.3"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant"{494D17B5-3369-4905-8C4B-80C972C5E0FF}" = CP_Panorama1Config"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics"{4DA4012B-39AF-48c2-B23B-A4D570D233A6}" = cp_LightScribeConfig"{4F923F90-46D1-4492-9CC6-13FBBA00E7EC}" = C4400"{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery"{52FBAE98-D389-4281-8C14-21B4046CCB4E}" = SonicAC3Encoder"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder"{54F0998F-73C8-4b51-8286-FE903C231BED}" = cp_PosterPrintConfig"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc"{6815FCDD-401D-481E-BA88-31B4754C2B46}" = Macromedia Flash Player 8"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6A28AB0B-22B1-494C-AF61-B386EA1736C0}" = LightScribe 1.4.97.1"{6B407945-AE16-4A2A-BAAF-497FE62EDED3}" = PS_AIO_03_C4400_Software_Min"{6B437F94-056F-4791-AF2C-0D10E2706AF0}" = PanoStandAlone"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder"{766633B3-1AFA-44B6-A3FC-1DE991CD9C52}" = CP_Package_Basic1"{79F8E1D4-36C1-439C-95FA-F695050B5B07}" = Sonic_PrimoSDK"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan"{80AE27BA-B0ED-4288-A8B9-D8194BCF4115}" = cp_UpdateProjectsConfig"{838A1BC9-95CA-4880-9BE3-2A7D23600A2B}" = Macromedia Shockwave Player"{869C3062-4745-4949-B6C9-98AF24D89030}" = PhotoGallery"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{90140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 14"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{939F8208-C8CE-4AFF-B7BA-ACEB2E74A6CB}" ="{954B7F64-D1D4-476F-8919-99585D0A6ABF}" = PS_AIO_03_C4400_Software"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9D4ABB0C-F60B-44A6-956C-A4A63D5495C9}" = CueTour"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = TourSetup"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module"{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient CAC 6.1 x86"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1"{B11E71BA-498C-42D4-9F1A-9D7A89D9DA61}" = CP_AtenaShokunin1Config"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module"{B16AF568-A644-483C-A6DA-5028CD019C8C}" = SonicMPEGEncoder"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR"{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5"{BBD3BF67-5B89-4CBB-BA58-5818ED5F3290}" = cp_OnlineProjectsConfig"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant"{C9CE9393-B568-428D-AD5B-55452B9748DB}" = PS_AIO_03_C4400_ProductContext"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp"{DB7E00C9-6DEF-489A-8112-D8F81614F45A}" = Vongo"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1"{E6B43401-E818-4961-AFED-118DD8E87642}" = RAF"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy"{F7B72805-2F58-4C04-AE9E-E7AD6A6EF62E}" = C4400_Help"{FB09F05F-85C6-4205-B28D-5BF071D276C3}" = muvee autoProducer 5.0"{FC8D25A7-FF1B-41BB-BB3B-9A06C0A60AE0}" = InstantShareDevices"{FF1F4E8E-A833-4c4b-A14A-45D5B841B5D8}" = HP Photosmart C4400 All-In-One Driver Software 10.0 Rel .3"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter"CNXT_HDAUDIO" = Conexant HD Audio"CNXT_MODEM_PCI_VEN_14F1&DEV_5045_at8ven5m" = Soft Data Fax Modem with SmartCP"HP Game Console" = HP Game Console and games"HP Imaging Device Functions" = HP Imaging Device Functions 10.0"HP Photo & Imaging" = HP Photosmart Premier Software 6.0"HP Photosmart Essential" = HP Photosmart Essential 2.5"HP Rhapsody" = HP Rhapsody"HP Smart Web Printing" = HP Smart Web Printing 4.60"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0"HPExtendedCapabilities" = HP Customer Participation Program 10.0"HPOCR" = OCR Software by I.R.I.S. 10.0"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"ie8" = Windows Internet Explorer 8"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"Money2006b" = Microsoft Money 2006"Mozilla Firefox 10.0 (x86 en-US)" = Mozilla Firefox 10.0 (x86 en-US)"MyFinePix Studio_is1" = FUJIFILM MyFinePix Studio 3.1"Netscape Browser" = Netscape Browser (remove only)"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"NVIDIA Drivers" = NVIDIA Drivers"Office14.SingleImage" = Microsoft Office Home and Student 2010"Shop for HP Supplies" = Shop for HP Supplies"SynTPDeinstKey" = Synaptics Pointing Device Driver"TomTom HOME" = TomTom HOME 2.8.0.2146"Windows Media Format Runtime" = Windows Media Format Runtime"Windows XP Service Pack" = Windows XP Service Pack 3"WMCSetup" = Windows Media Connect"Yahoo! Companion" = Yahoo! Toolbar for Internet Explorer"Yahoo! Toolbar" = Yahoo! Toolbar========== Last 10 Event Log Errors ==========[ Application Events ]Error - 5/14/2012 6:50:32 PM | Computer Name = STOLL | Source = Application Error | ID = 1000Description = Faulting application dd.exe, version 1.12.0.0, faulting module dd.exe, version 1.12.0.0, fault address 0x0003ae67.Error - 5/14/2012 6:52:30 PM | Computer Name = STOLL | Source = Media Center Scheduler | ID = 0Description =Error - 5/14/2012 8:58:02 PM | Computer Name = STOLL | Source = MSDTC | ID = 4404Description = MS DTC Tracing infrastructure : the initialization of the tracinginfrastructure failed. Internal Information : msdtc_trace : File: d:\comxp_sp3\com\com1x\dtc\dtc\trace\src\tracelib.cpp, Line: 1115, StartTrace Failed, hr=0x800700a1 Error - 5/14/2012 8:58:03 PM | Computer Name = STOLL | Source = Media Center Scheduler | ID = 0Description =Error - 5/14/2012 8:59:20 PM | Computer Name = STOLL | Source = Application Error | ID = 1000Description = Faulting application dd.exe, version 1.12.0.0, faulting module dd.exe, version 1.12.0.0, fault address 0x0003ae67.Error - 5/14/2012 9:00:23 PM | Computer Name = STOLL | Source = Media Center Scheduler | ID = 0Description =Error - 5/14/2012 10:37:40 PM | Computer Name = STOLL | Source = MSDTC | ID = 4404Description = MS DTC Tracing infrastructure : the initialization of the tracinginfrastructure failed. Internal Information : msdtc_trace : File: d:\comxp_sp3\com\com1x\dtc\dtc\trace\src\tracelib.cpp, Line: 1115, StartTrace Failed, hr=0x800700a1 Error - 5/14/2012 10:37:41 PM | Computer Name = STOLL | Source = Media Center Scheduler | ID = 0Description =Error - 5/14/2012 10:38:58 PM | Computer Name = STOLL | Source = Application Error | ID = 1000Description = Faulting application dd.exe, version 1.12.0.0, faulting module dd.exe, version 1.12.0.0, fault address 0x0003ae67.Error - 5/14/2012 10:40:46 PM | Computer Name = STOLL | Source = Media Center Scheduler | ID = 0Description =[ System Events ]Error - 5/14/2012 2:27:01 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7026Description = The following boot-start or system-start driver(s) failed to load: AliIde IntelIde Pcmcia ViaIdeError - 5/14/2012 2:42:28 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7000Description = The MOBCleanup service failed to start due to the following error: %%2Error - 5/14/2012 2:43:58 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7022Description = The HP CUE DeviceDiscovery Service service hung on starting.Error - 5/14/2012 2:43:58 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7026Description = The following boot-start or system-start driver(s) failed to load: AliIde IntelIde Pcmcia ViaIdeError - 5/14/2012 6:49:54 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7000Description = The MOBCleanup service failed to start due to the following error: %%2Error - 5/14/2012 6:51:20 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7022Description = The HP CUE DeviceDiscovery Service service hung on starting.Error - 5/14/2012 8:58:40 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7000Description = The MOBCleanup service failed to start due to the following error: %%2Error - 5/14/2012 9:00:07 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7022Description = The HP CUE DeviceDiscovery Service service hung on starting.Error - 5/14/2012 10:38:16 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7000Description = The MOBCleanup service failed to start due to the following error: %%2Error - 5/14/2012 10:39:43 PM | Computer Name = STOLL | Source = Service Control Manager | ID = 7022Description = The HP CUE DeviceDiscovery Service service hung on starting.< End of report > Link to post Share on other sites More sharing options...
brightjoy2 Posted May 15, 2012 Author ID:551571 Share Posted May 15, 2012 The GMER log---- System - GMER 1.0.15 ----SSDT EE8A668C ZwCloseSSDT EE8A6646 ZwCreateKeySSDT EE8A6696 ZwCreateSectionSSDT EE8A663C ZwCreateThreadSSDT EE8A664B ZwDeleteKeySSDT EE8A6655 ZwDeleteValueKeySSDT EE8A6687 ZwDuplicateObjectSSDT EE8A665A ZwLoadKeySSDT EE8A6628 ZwOpenProcessSSDT EE8A662D ZwOpenThreadSSDT EE8A6664 ZwReplaceKeySSDT EE8A665F ZwRestoreKeySSDT EE8A669B ZwSetContextThreadSSDT EE8A6650 ZwSetValueKeySSDT EE8A6637 ZwTerminateProcess---- Kernel code sections - GMER 1.0.15 ----.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6249360, 0x225D9D, 0xE8000020]---- Devices - GMER 1.0.15 ----AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)---- Disk sectors - GMER 1.0.15 ----Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior---- EOF - GMER 1.0.15 ---- Link to post Share on other sites More sharing options...
brightjoy2 Posted May 15, 2012 Author ID:551701 Share Posted May 15, 2012 Finally the AVAST. Keep giving me a blue screen saying dump of physical memory when I ran it. Took me the 4 times to finally get this done. Thanks for helping again.aswMBR version 0.9.9.1665 Copyright© 2011 AVAST SoftwareRun date: 2012-05-15 10:01:38-----------------------------10:01:38.656 OS Version: Windows 5.1.2600 Service Pack 310:01:38.656 Number of processors: 2 586 0x480210:01:38.656 ComputerName: STOLL UserName: Jeff10:01:39.593 Initialize success10:01:55.734 AVAST engine defs: 1205140110:02:00.421 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000007c10:02:00.421 Disk 0 Vendor: Size: 0MB BusType: 010:02:00.500 Disk 0 MBR read error 010:02:00.500 Disk 0 MBR scan10:02:01.125 Disk 0 unknown MBR code10:02:01.140 MBR BIOS signature not found 010:02:01.218 Disk 0 scanning C:\WINDOWS\system32\drivers10:02:19.468 Service scanning10:02:43.937 Modules scanning10:02:50.765 Disk 0 trace - called modules:10:02:50.812 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys10:02:50.828 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5901e8]10:02:50.843 3 CLASSPNP.SYS[f74e7fd7] -> nt!IofCallDriver -> \Device\0000007d[0x8a59ef18]10:02:50.890 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\0000007c[0x8a4b6658]10:02:51.296 AVAST engine scan C:\WINDOWS10:03:00.484 AVAST engine scan C:\WINDOWS\system3210:07:51.859 AVAST engine scan C:\WINDOWS\system32\drivers10:08:16.046 AVAST engine scan C:\Documents and Settings\Jeff10:08:36.109 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Jeff\Desktop\MBR.dat"10:08:36.125 The log file has been saved successfully to "C:\Documents and Settings\Jeff\Desktop\aswMBR.txt" Link to post Share on other sites More sharing options...
Jintan Posted May 15, 2012 ID:551809 Share Posted May 15, 2012 Really looking like bootkit MBR (MasterBoot Record) infection there. Please do everything you can to make sure AntiVir is completely disabled.Just to be sure, reboot to Safe Mode for this next step. At startup tap the F8 key about once per half-second, then select Safe Mode with Networking from the menu that will appear.Click here and download Kaspersky's TDSSKiller to your desktop, but as you download it, rename it to larry.com then click that file to run TDSSKiller.In the display that opens click Start scan. Once that completes, follow any prompts to act on anything it located, including as reboot (Reboot Now) if requested.When the scan completes it will create a log file on your C drive.Similar in name to this:C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txtYour copy will be different - some of those numbers will reflect the date/time it was just run by you there.Copy/paste those contents back here please. If it does locate malware, but does not prompt for a reboot, go ahead and do reboot.Assuming it did locate malware, and display a Reboot Now, do that, then run it again after the reboot, and post back both logs please. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 15, 2012 Author ID:551825 Share Posted May 15, 2012 15:48:21.0921 0952 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:1815:48:22.0390 0952 ============================================================15:48:22.0390 0952 Current date / time: 2012/05/15 15:48:22.039015:48:22.0390 0952 SystemInfo:15:48:22.0390 0952 15:48:22.0390 0952 OS Version: 5.1.2600 ServicePack: 3.015:48:22.0390 0952 Product type: Workstation15:48:22.0390 0952 ComputerName: STOLL15:48:22.0390 0952 UserName: Jeff15:48:22.0390 0952 Windows directory: C:\WINDOWS15:48:22.0390 0952 System windows directory: C:\WINDOWS15:48:22.0390 0952 Processor architecture: Intel x8615:48:22.0390 0952 Number of processors: 215:48:22.0390 0952 Page size: 0x100015:48:22.0390 0952 Boot type: Safe boot with network15:48:22.0390 0952 ============================================================15:48:24.0656 0952 Drive \Device\Harddisk0\DR0 - Size: 0x174A446000 (93.16 Gb), SectorSize: 0x200, Cylinders: 0x2F81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000005015:48:24.0656 0952 ============================================================15:48:24.0656 0952 \Device\Harddisk0\DR0:15:48:24.0656 0952 MBR partitions:15:48:24.0656 0952 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xA13099A15:48:24.0656 0952 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0xA13489A, BlocksNum 0x171A8E415:48:24.0656 0952 ============================================================15:48:24.0890 0952 C: <-> \Device\Harddisk0\DR0\Partition015:48:24.0906 0952 D: <-> \Device\Harddisk0\DR0\Partition115:48:24.0906 0952 ============================================================15:48:24.0906 0952 Initialize success15:48:24.0906 0952 ============================================================15:48:28.0265 1020 ============================================================15:48:28.0265 1020 Scan started15:48:28.0265 1020 Mode: Manual;15:48:28.0265 1020 ============================================================15:48:28.0562 1020 0062421329956074mcinstcleanup - ok15:48:28.0703 1020 5U870CAP_VID_1262&PID_25FD (d2142fee659d97b2b05820f21594bfe2) C:\WINDOWS\system32\Drivers\5U870CAP.sys15:48:28.0703 1020 5U870CAP_VID_1262&PID_25FD - ok15:48:28.0718 1020 Abiosdsk - ok15:48:28.0843 1020 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS15:48:28.0843 1020 abp480n5 - ok15:48:28.0937 1020 accoca (ec4a5d4e36a8e49261cd823450e0ba51) C:\Program Files\ActivIdentity\ActivClient\accoca.exe15:48:28.0937 1020 accoca - ok15:48:28.0984 1020 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys15:48:28.0984 1020 ACPI - ok15:48:29.0000 1020 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys15:48:29.0000 1020 ACPIEC - ok15:48:29.0109 1020 AddFiltr (746742588c07db53731143229e2ee450) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe15:48:29.0109 1020 AddFiltr - ok15:48:29.0218 1020 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe15:48:29.0218 1020 AdobeFlashPlayerUpdateSvc - ok15:48:29.0265 1020 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys15:48:29.0265 1020 adpu160m - ok15:48:29.0328 1020 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys15:48:29.0328 1020 aec - ok15:48:29.0375 1020 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys15:48:29.0375 1020 AFD - ok15:48:29.0437 1020 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys15:48:29.0437 1020 agp440 - ok15:48:29.0453 1020 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys15:48:29.0453 1020 agpCPQ - ok15:48:29.0500 1020 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys15:48:29.0500 1020 Aha154x - ok15:48:29.0531 1020 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys15:48:29.0531 1020 aic78u2 - ok15:48:29.0546 1020 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys15:48:29.0546 1020 aic78xx - ok15:48:29.0625 1020 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll15:48:29.0625 1020 Alerter - ok15:48:29.0640 1020 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe15:48:29.0640 1020 ALG - ok15:48:29.0671 1020 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys15:48:29.0671 1020 AliIde - ok15:48:29.0687 1020 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys15:48:29.0687 1020 alim1541 - ok15:48:29.0718 1020 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys15:48:29.0718 1020 amdagp - ok15:48:29.0750 1020 AmdK8 (0a4d13b388c814560bd69c3a496ecfa8) C:\WINDOWS\system32\DRIVERS\AmdK8.sys15:48:29.0765 1020 AmdK8 - ok15:48:29.0796 1020 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys15:48:29.0796 1020 amsint - ok15:48:29.0968 1020 AntiVirSchedulerService (b4837fe56d76b2e9ea90e5365cf6a2be) C:\Program Files\Avira\AntiVir Desktop\sched.exe15:48:29.0968 1020 AntiVirSchedulerService - ok15:48:30.0015 1020 AntiVirService (df5a3016052755c910a206058b4a1729) C:\Program Files\Avira\AntiVir Desktop\avguard.exe15:48:30.0015 1020 AntiVirService - ok15:48:30.0046 1020 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll15:48:30.0062 1020 AppMgmt - ok15:48:30.0093 1020 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys15:48:30.0109 1020 Arp1394 - ok15:48:30.0140 1020 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys15:48:30.0140 1020 asc - ok15:48:30.0187 1020 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys15:48:30.0187 1020 asc3350p - ok15:48:30.0218 1020 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys15:48:30.0234 1020 asc3550 - ok15:48:30.0406 1020 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe15:48:30.0453 1020 aspnet_state - ok15:48:30.0500 1020 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys15:48:30.0500 1020 AsyncMac - ok15:48:30.0531 1020 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys15:48:30.0546 1020 atapi - ok15:48:30.0546 1020 Atdisk - ok15:48:30.0593 1020 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys15:48:30.0593 1020 Atmarpc - ok15:48:30.0640 1020 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll15:48:30.0640 1020 AudioSrv - ok15:48:30.0687 1020 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys15:48:30.0687 1020 audstub - ok15:48:30.0718 1020 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys15:48:30.0718 1020 avgio - ok15:48:30.0765 1020 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys15:48:30.0765 1020 avgntflt - ok15:48:30.0812 1020 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys15:48:30.0828 1020 avipbb - ok15:48:30.0937 1020 BBSvc (a2494901e7226b356b8c1005c45f1c5f) C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.exe15:48:30.0953 1020 BBSvc - ok15:48:31.0062 1020 BBUpdate (63b1cbbae4790b5bac98f01bf9449722) C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exe15:48:31.0062 1020 BBUpdate - ok15:48:31.0125 1020 BCM43XX (114234fafec7060392195170e1c4d45e) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys15:48:31.0140 1020 BCM43XX - ok15:48:31.0171 1020 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys15:48:31.0171 1020 Beep - ok15:48:31.0234 1020 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll15:48:31.0359 1020 BITS - ok15:48:31.0406 1020 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll15:48:31.0406 1020 Browser - ok15:48:31.0421 1020 BTWUSB (4272bab9291d26da5ac913bc79c3ce85) C:\WINDOWS\system32\Drivers\btwusb.sys15:48:31.0421 1020 BTWUSB - ok15:48:31.0484 1020 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys15:48:31.0484 1020 cbidf - ok15:48:31.0500 1020 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys15:48:31.0500 1020 cbidf2k - ok15:48:31.0562 1020 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys15:48:31.0562 1020 CCDECODE - ok15:48:31.0593 1020 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys15:48:31.0593 1020 cd20xrnt - ok15:48:31.0640 1020 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys15:48:31.0640 1020 Cdaudio - ok15:48:31.0656 1020 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys15:48:31.0671 1020 Cdfs - ok15:48:31.0718 1020 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys15:48:31.0718 1020 Cdrom - ok15:48:31.0734 1020 Changer - ok15:48:31.0812 1020 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe15:48:31.0812 1020 CiSvc - ok15:48:31.0828 1020 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe15:48:31.0828 1020 ClipSrv - ok15:48:31.0968 1020 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe15:48:32.0031 1020 clr_optimization_v2.0.50727_32 - ok15:48:32.0078 1020 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys15:48:32.0078 1020 CmBatt - ok15:48:32.0125 1020 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys15:48:32.0125 1020 CmdIde - ok15:48:32.0171 1020 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys15:48:32.0171 1020 Compbatt - ok15:48:32.0187 1020 COMSysApp - ok15:48:32.0250 1020 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys15:48:32.0250 1020 Cpqarray - ok15:48:32.0296 1020 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll15:48:32.0296 1020 CryptSvc - ok15:48:32.0328 1020 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys15:48:32.0343 1020 dac2w2k - ok15:48:32.0390 1020 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys15:48:32.0390 1020 dac960nt - ok15:48:32.0453 1020 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll15:48:32.0453 1020 DcomLaunch - ok15:48:32.0500 1020 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll15:48:32.0515 1020 Dhcp - ok15:48:32.0546 1020 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys15:48:32.0546 1020 Disk - ok15:48:32.0562 1020 dmadmin - ok15:48:32.0640 1020 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys15:48:32.0718 1020 dmboot - ok15:48:32.0734 1020 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys15:48:32.0734 1020 dmio - ok15:48:32.0765 1020 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys15:48:32.0765 1020 dmload - ok15:48:32.0812 1020 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll15:48:32.0812 1020 dmserver - ok15:48:32.0843 1020 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys15:48:32.0843 1020 DMusic - ok15:48:32.0875 1020 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll15:48:32.0875 1020 Dnscache - ok15:48:32.0921 1020 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll15:48:32.0937 1020 Dot3svc - ok15:48:32.0968 1020 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys15:48:32.0968 1020 dpti2o - ok15:48:32.0984 1020 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys15:48:32.0984 1020 drmkaud - ok15:48:33.0015 1020 eabfiltr (b5cb3084046146fd2587d8c9b219feb4) C:\WINDOWS\system32\DRIVERS\eabfiltr.sys15:48:33.0015 1020 eabfiltr - ok15:48:33.0078 1020 eabusb (231f4547ae1e4b3e60eca66c3a96d218) C:\WINDOWS\system32\DRIVERS\eabusb.sys15:48:33.0078 1020 eabusb - ok15:48:33.0125 1020 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll15:48:33.0125 1020 EapHost - ok15:48:33.0218 1020 ehRecvr (d039a0c347632622934906bd59a4e1ea) C:\WINDOWS\eHome\ehRecvr.exe15:48:33.0218 1020 ehRecvr - ok15:48:33.0281 1020 ehSched (a53243709439ac2a4c216b817f8d7411) C:\WINDOWS\eHome\ehSched.exe15:48:33.0281 1020 ehSched - ok15:48:33.0312 1020 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll15:48:33.0312 1020 ERSvc - ok15:48:33.0343 1020 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe15:48:33.0359 1020 Eventlog - ok15:48:33.0406 1020 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll15:48:33.0406 1020 EventSystem - ok15:48:33.0453 1020 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys15:48:33.0453 1020 Fastfat - ok15:48:33.0500 1020 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll15:48:33.0500 1020 FastUserSwitchingCompatibility - ok15:48:33.0515 1020 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys15:48:33.0531 1020 Fdc - ok15:48:33.0562 1020 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys15:48:33.0578 1020 Fips - ok15:48:33.0578 1020 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys15:48:33.0578 1020 Flpydisk - ok15:48:33.0656 1020 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys15:48:33.0656 1020 FltMgr - ok15:48:33.0796 1020 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe15:48:33.0796 1020 FontCache3.0.0.0 - ok15:48:33.0812 1020 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys15:48:33.0812 1020 Fs_Rec - ok15:48:33.0859 1020 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys15:48:33.0875 1020 Ftdisk - ok15:48:33.0890 1020 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys15:48:33.0890 1020 Gpc - ok15:48:33.0921 1020 HBtnKey (4d4d97671c63c3af869b3518e6054204) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys15:48:33.0921 1020 HBtnKey - ok15:48:33.0953 1020 HdAudAddService (2a6e9a118da2dd0439551a7eb3a8f65e) C:\WINDOWS\system32\drivers\CHDAud.sys15:48:33.0968 1020 HdAudAddService - ok15:48:34.0015 1020 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys15:48:34.0015 1020 HDAudBus - ok15:48:34.0093 1020 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll15:48:34.0093 1020 helpsvc - ok15:48:34.0109 1020 HidServ - ok15:48:34.0171 1020 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll15:48:34.0171 1020 hkmsvc - ok15:48:34.0234 1020 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys15:48:34.0234 1020 hpn - ok15:48:34.0359 1020 hpqcxs08 (0a3c6aa4a9fc38c20ba4eac2c3351c05) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll15:48:34.0421 1020 hpqcxs08 - ok15:48:34.0484 1020 hpqddsvc (df446ba625cc441617843e87798ce048) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll15:48:34.0484 1020 hpqddsvc - ok15:48:34.0531 1020 hpqwmiex (04c1dcbb226c6ae647b794833ce3ceb6) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe15:48:34.0546 1020 hpqwmiex - ok15:48:34.0578 1020 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys15:48:34.0593 1020 HPZid412 - ok15:48:34.0609 1020 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys15:48:34.0609 1020 HPZipr12 - ok15:48:34.0656 1020 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys15:48:34.0656 1020 HPZius12 - ok15:48:34.0703 1020 HSFHWAZL (8e60293c44e3f6f7f09defb60023a37d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys15:48:34.0734 1020 HSFHWAZL - ok15:48:34.0796 1020 HSF_DPV (4c2aab15ad6229134f70e5c950e6185c) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys15:48:34.0875 1020 HSF_DPV - ok15:48:34.0921 1020 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys15:48:34.0921 1020 HTTP - ok15:48:34.0984 1020 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll15:48:35.0000 1020 HTTPFilter - ok15:48:35.0046 1020 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys15:48:35.0046 1020 i2omgmt - ok15:48:35.0078 1020 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys15:48:35.0078 1020 i2omp - ok15:48:35.0109 1020 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys15:48:35.0109 1020 i8042prt - ok15:48:35.0187 1020 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\iaStor.sys15:48:35.0203 1020 iaStor - ok15:48:35.0343 1020 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe15:48:35.0343 1020 IDriverT - ok15:48:35.0578 1020 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe15:48:35.0593 1020 idsvc - ok15:48:35.0703 1020 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys15:48:35.0703 1020 Imapi - ok15:48:35.0750 1020 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe15:48:35.0750 1020 ImapiService - ok15:48:35.0796 1020 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys15:48:35.0796 1020 ini910u - ok15:48:35.0843 1020 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys15:48:35.0843 1020 IntelIde - ok15:48:35.0890 1020 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys15:48:35.0890 1020 Ip6Fw - ok15:48:35.0906 1020 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys15:48:35.0921 1020 IpFilterDriver - ok15:48:35.0968 1020 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys15:48:35.0968 1020 IpInIp - ok15:48:36.0000 1020 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys15:48:36.0000 1020 IpNat - ok15:48:36.0031 1020 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys15:48:36.0031 1020 IPSec - ok15:48:36.0062 1020 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys15:48:36.0062 1020 IRENUM - ok15:48:36.0078 1020 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys15:48:36.0078 1020 isapnp - ok15:48:36.0234 1020 JavaQuickStarterService (39133291cb607bdd87cfc565a4a1e7a5) C:\Program Files\Java\jre6\bin\jqs.exe15:48:36.0234 1020 JavaQuickStarterService - ok15:48:36.0250 1020 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys15:48:36.0265 1020 Kbdclass - ok15:48:36.0281 1020 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys15:48:36.0281 1020 kbdhid - ok15:48:36.0312 1020 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys15:48:36.0312 1020 kmixer - ok15:48:36.0359 1020 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys15:48:36.0359 1020 KSecDD - ok15:48:36.0406 1020 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll15:48:36.0406 1020 lanmanserver - ok15:48:36.0437 1020 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll15:48:36.0453 1020 lanmanworkstation - ok15:48:36.0468 1020 lbrtfdc - ok15:48:36.0578 1020 LightScribeService (86e8bcaa91fc2acfacd99cf2bf9f1f47) C:\Program Files\Common Files\LightScribe\LSSrvc.exe15:48:36.0578 1020 LightScribeService - ok15:48:36.0625 1020 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll15:48:36.0625 1020 LmHosts - ok15:48:36.0671 1020 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys15:48:36.0671 1020 MBAMProtector - ok15:48:36.0734 1020 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe15:48:36.0750 1020 MBAMService - ok15:48:36.0843 1020 McAfee SiteAdvisor Service (6c3d154fff0a97a6c3d9f78d60c41655) c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe15:48:36.0843 1020 McAfee SiteAdvisor Service - ok15:48:36.0906 1020 McrdSvc (df0a511f38f16016bf658fca0090cb87) C:\WINDOWS\ehome\mcrdsvc.exe15:48:36.0921 1020 McrdSvc - ok15:48:36.0953 1020 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys15:48:36.0953 1020 mdmxsdk - ok15:48:36.0984 1020 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll15:48:36.0984 1020 Messenger - ok15:48:37.0015 1020 MHN (b7521f69c0a9b29d356157229376fb21) C:\WINDOWS\System32\mhn.dll15:48:37.0015 1020 MHN - ok15:48:37.0046 1020 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys15:48:37.0046 1020 MHNDRV - ok15:48:37.0093 1020 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys15:48:37.0093 1020 mnmdd - ok15:48:37.0140 1020 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe15:48:37.0140 1020 mnmsrvc - ok15:48:37.0328 1020 MOBCleanup - ok15:48:37.0375 1020 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys15:48:37.0375 1020 Modem - ok15:48:37.0390 1020 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys15:48:37.0390 1020 Mouclass - ok15:48:37.0421 1020 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys15:48:37.0421 1020 MountMgr - ok15:48:37.0453 1020 MQAC (eee50bf24caeedb515a8f3b22756d3bb) C:\WINDOWS\system32\drivers\mqac.sys15:48:37.0453 1020 MQAC - ok15:48:37.0500 1020 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys15:48:37.0500 1020 mraid35x - ok15:48:37.0531 1020 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys15:48:37.0531 1020 MRxDAV - ok15:48:37.0593 1020 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys15:48:37.0593 1020 MRxSmb - ok15:48:37.0640 1020 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe15:48:37.0640 1020 MSDTC - ok15:48:37.0671 1020 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys15:48:37.0671 1020 Msfs - ok15:48:37.0687 1020 MSIServer - ok15:48:37.0734 1020 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys15:48:37.0734 1020 MSKSSRV - ok15:48:37.0796 1020 MSMQ (e9b5f354ae80325283fd5c1c05217b01) C:\WINDOWS\system32\mqsvc.exe15:48:37.0796 1020 MSMQ - ok15:48:37.0828 1020 MSMQTriggers (10e6b9022b0a5c9c41e2da6aeae5d404) C:\WINDOWS\system32\mqtgsvc.exe15:48:37.0843 1020 MSMQTriggers - ok15:48:37.0859 1020 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys15:48:37.0859 1020 MSPCLOCK - ok15:48:37.0890 1020 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys15:48:37.0890 1020 MSPQM - ok15:48:37.0937 1020 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys15:48:37.0937 1020 mssmbios - ok15:48:37.0968 1020 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys15:48:37.0968 1020 MSTEE - ok15:48:38.0015 1020 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys15:48:38.0015 1020 Mup - ok15:48:38.0062 1020 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys15:48:38.0062 1020 NABTSFEC - ok15:48:38.0125 1020 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll15:48:38.0125 1020 napagent - ok15:48:38.0171 1020 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys15:48:38.0171 1020 NDIS - ok15:48:38.0218 1020 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys15:48:38.0218 1020 NdisIP - ok15:48:38.0265 1020 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys15:48:38.0265 1020 NdisTapi - ok15:48:38.0296 1020 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys15:48:38.0296 1020 Ndisuio - ok15:48:38.0312 1020 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys15:48:38.0312 1020 NdisWan - ok15:48:38.0375 1020 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys15:48:38.0375 1020 NDProxy - ok15:48:38.0406 1020 Net Driver HPZ12 (51c6d8bfbd4ea5b62a1ba7f4469250d3) C:\WINDOWS\system32\HPZinw12.dll15:48:38.0421 1020 Net Driver HPZ12 - ok15:48:38.0437 1020 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys15:48:38.0437 1020 NetBIOS - ok15:48:38.0468 1020 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys15:48:38.0468 1020 NetBT - ok15:48:38.0515 1020 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe15:48:38.0515 1020 NetDDE - ok15:48:38.0531 1020 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe15:48:38.0531 1020 NetDDEdsdm - ok15:48:38.0578 1020 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe15:48:38.0593 1020 Netlogon - ok15:48:38.0625 1020 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll15:48:38.0625 1020 Netman - ok15:48:38.0765 1020 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe15:48:38.0765 1020 NetTcpPortSharing - ok15:48:38.0828 1020 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys15:48:38.0828 1020 NIC1394 - ok15:48:38.0875 1020 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll15:48:38.0875 1020 Nla - ok15:48:38.0921 1020 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys15:48:38.0921 1020 Npfs - ok15:48:38.0937 1020 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys15:48:38.0953 1020 Ntfs - ok15:48:39.0000 1020 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe15:48:39.0000 1020 NtLmSsp - ok15:48:39.0046 1020 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll15:48:39.0062 1020 NtmsSvc - ok15:48:39.0109 1020 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys15:48:39.0109 1020 Null - ok15:48:39.0265 1020 nv (bbb8ab2ffd7a79cd9d7751008e3de579) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys15:48:39.0421 1020 nv - ok15:48:39.0546 1020 nvata (3ac5eedd35b7437d53960f3998bfa462) C:\WINDOWS\system32\DRIVERS\nvata.sys15:48:39.0546 1020 nvata - ok15:48:39.0578 1020 NVENETFD (22eedb34c4d7613a25b10c347c6c4c21) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys15:48:39.0578 1020 NVENETFD - ok15:48:39.0593 1020 nvnetbus (5e3f6ad5cad0f12d3cccd06fd964087a) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys15:48:39.0593 1020 nvnetbus - ok15:48:39.0640 1020 nvsmu (e0f76fab86fec98778047d0c7c39cbb9) C:\WINDOWS\system32\DRIVERS\nvsmu.sys15:48:39.0640 1020 nvsmu - ok15:48:39.0687 1020 NVSvc (a323e7dd1a00898b1c40b9b5b340c0db) C:\WINDOWS\system32\nvsvc32.exe15:48:39.0687 1020 NVSvc - ok15:48:39.0734 1020 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys15:48:39.0734 1020 NwlnkFlt - ok15:48:39.0796 1020 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys15:48:39.0796 1020 NwlnkFwd - ok15:48:39.0843 1020 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys15:48:39.0843 1020 ohci1394 - ok15:48:39.0937 1020 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE15:48:39.0937 1020 ose - ok15:48:40.0218 1020 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE15:48:40.0453 1020 osppsvc - ok15:48:40.0687 1020 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys15:48:40.0687 1020 Parport - ok15:48:40.0750 1020 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys15:48:40.0750 1020 PartMgr - ok15:48:40.0781 1020 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys15:48:40.0796 1020 ParVdm - ok15:48:40.0796 1020 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys15:48:40.0812 1020 PCI - ok15:48:40.0828 1020 PCIDump - ok15:48:40.0843 1020 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys15:48:40.0843 1020 PCIIde - ok15:48:40.0890 1020 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys15:48:40.0906 1020 Pcmcia - ok15:48:40.0906 1020 PDCOMP - ok15:48:40.0937 1020 PDFRAME - ok15:48:40.0953 1020 PDRELI - ok15:48:40.0984 1020 PDRFRAME - ok15:48:41.0015 1020 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys15:48:41.0015 1020 perc2 - ok15:48:41.0062 1020 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys15:48:41.0062 1020 perc2hib - ok15:48:41.0140 1020 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe15:48:41.0140 1020 PlugPlay - ok15:48:41.0187 1020 Pml Driver HPZ12 (79834aa2fbf9fe81eebb229024f6f7fc) C:\WINDOWS\system32\HPZipm12.dll15:48:41.0187 1020 Pml Driver HPZ12 - ok15:48:41.0203 1020 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe15:48:41.0203 1020 PolicyAgent - ok15:48:41.0250 1020 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys15:48:41.0250 1020 PptpMiniport - ok15:48:41.0265 1020 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe15:48:41.0265 1020 ProtectedStorage - ok15:48:41.0296 1020 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys15:48:41.0296 1020 PSched - ok15:48:41.0328 1020 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys15:48:41.0328 1020 Ptilink - ok15:48:41.0359 1020 PxHelp20 (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys15:48:41.0359 1020 PxHelp20 - ok15:48:41.0390 1020 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys15:48:41.0390 1020 ql1080 - ok15:48:41.0406 1020 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys15:48:41.0406 1020 Ql10wnt - ok15:48:41.0437 1020 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys15:48:41.0437 1020 ql12160 - ok15:48:41.0468 1020 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys15:48:41.0468 1020 ql1240 - ok15:48:41.0484 1020 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys15:48:41.0500 1020 ql1280 - ok15:48:41.0515 1020 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys15:48:41.0531 1020 RasAcd - ok15:48:41.0562 1020 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll15:48:41.0562 1020 RasAuto - ok15:48:41.0593 1020 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys15:48:41.0593 1020 Rasl2tp - ok15:48:41.0640 1020 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll15:48:41.0640 1020 RasMan - ok15:48:41.0671 1020 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys15:48:41.0687 1020 RasPppoe - ok15:48:41.0687 1020 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys15:48:41.0687 1020 Raspti - ok15:48:41.0734 1020 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys15:48:41.0734 1020 Rdbss - ok15:48:41.0750 1020 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys15:48:41.0750 1020 RDPCDD - ok15:48:41.0796 1020 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys15:48:41.0796 1020 rdpdr - ok15:48:41.0843 1020 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys15:48:41.0843 1020 RDPWD - ok15:48:41.0890 1020 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe15:48:41.0906 1020 RDSessMgr - ok15:48:41.0953 1020 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys15:48:41.0953 1020 redbook - ok15:48:42.0000 1020 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll15:48:42.0000 1020 RemoteAccess - ok15:48:42.0015 1020 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll15:48:42.0031 1020 RemoteRegistry - ok15:48:42.0062 1020 rimmptsk (7a6648b61661b1421ffab762e391e33f) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys15:48:42.0062 1020 rimmptsk - ok15:48:42.0078 1020 rimsptsk (8f7012d1b6a71ee9c23ce93dcdbf9f4b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys15:48:42.0078 1020 rimsptsk - ok15:48:42.0125 1020 rismxdp (3ac17802740c3a4764dc9750e92e6233) C:\WINDOWS\system32\DRIVERS\rixdptsk.sys15:48:42.0140 1020 rismxdp - ok15:48:42.0187 1020 RMCAST (96f7a9a7bf0c9c0440a967440065d33c) C:\WINDOWS\system32\drivers\RMCast.sys15:48:42.0203 1020 RMCAST - ok15:48:42.0234 1020 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe15:48:42.0250 1020 RpcLocator - ok15:48:42.0312 1020 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll15:48:42.0328 1020 RpcSs - ok15:48:42.0375 1020 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe15:48:42.0375 1020 RSVP - ok15:48:42.0390 1020 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS15:48:42.0390 1020 rtl8139 - ok15:48:42.0437 1020 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe15:48:42.0453 1020 SamSs - ok15:48:42.0468 1020 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe15:48:42.0468 1020 SCardSvr - ok15:48:42.0500 1020 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll15:48:42.0500 1020 Schedule - ok15:48:42.0562 1020 SCR3XX2K (b590c6b740a85130e88d35d007691eb4) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys15:48:42.0562 1020 SCR3XX2K - ok15:48:42.0609 1020 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys15:48:42.0609 1020 sdbus - ok15:48:42.0656 1020 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys15:48:42.0656 1020 Secdrv - ok15:48:42.0687 1020 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll15:48:42.0687 1020 seclogon - ok15:48:42.0718 1020 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll15:48:42.0718 1020 SENS - ok15:48:42.0750 1020 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys15:48:42.0750 1020 Serial - ok15:48:42.0812 1020 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys15:48:42.0812 1020 Sfloppy - ok15:48:42.0875 1020 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll15:48:42.0875 1020 SharedAccess - ok15:48:42.0906 1020 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll15:48:42.0921 1020 ShellHWDetection - ok15:48:42.0921 1020 Simbad - ok15:48:42.0968 1020 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys15:48:42.0968 1020 sisagp - ok15:48:43.0000 1020 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys15:48:43.0000 1020 SLIP - ok15:48:43.0062 1020 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys15:48:43.0062 1020 Sparrow - ok15:48:43.0078 1020 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys15:48:43.0078 1020 splitter - ok15:48:43.0125 1020 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe15:48:43.0125 1020 Spooler - ok15:48:43.0171 1020 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys15:48:43.0171 1020 sr - ok15:48:43.0218 1020 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll15:48:43.0218 1020 srservice - ok15:48:43.0265 1020 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys15:48:43.0281 1020 Srv - ok15:48:43.0296 1020 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll15:48:43.0296 1020 SSDPSRV - ok15:48:43.0343 1020 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys15:48:43.0343 1020 ssmdrv - ok15:48:43.0390 1020 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll15:48:43.0406 1020 stisvc - ok15:48:43.0453 1020 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys15:48:43.0453 1020 streamip - ok15:48:43.0484 1020 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys15:48:43.0484 1020 swenum - ok15:48:43.0500 1020 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys15:48:43.0500 1020 swmidi - ok15:48:43.0515 1020 SwPrv - ok15:48:43.0578 1020 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys15:48:43.0578 1020 symc810 - ok15:48:43.0593 1020 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys15:48:43.0593 1020 symc8xx - ok15:48:43.0625 1020 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys15:48:43.0625 1020 sym_hi - ok15:48:43.0640 1020 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys15:48:43.0640 1020 sym_u3 - ok15:48:43.0687 1020 SynTP (60cb9f7c95791fe56a6e86868f4467ba) C:\WINDOWS\system32\DRIVERS\SynTP.sys15:48:43.0687 1020 SynTP - ok15:48:43.0703 1020 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys15:48:43.0703 1020 sysaudio - ok15:48:43.0765 1020 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe15:48:43.0765 1020 SysmonLog - ok15:48:43.0796 1020 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll15:48:43.0812 1020 TapiSrv - ok15:48:43.0859 1020 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys15:48:43.0859 1020 Tcpip - ok15:48:43.0906 1020 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys15:48:43.0921 1020 TDPIPE - ok15:48:43.0937 1020 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys15:48:43.0937 1020 TDTCP - ok15:48:43.0968 1020 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys15:48:43.0968 1020 TermDD - ok15:48:44.0031 1020 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll15:48:44.0031 1020 TermService - ok15:48:44.0093 1020 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll15:48:44.0093 1020 Themes - ok15:48:44.0140 1020 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe15:48:44.0140 1020 TlntSvr - ok15:48:44.0265 1020 TomTomHOMEService (572a16fbad52ab1ac8e3d44baaf99694) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe15:48:44.0265 1020 TomTomHOMEService - ok15:48:44.0312 1020 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys15:48:44.0328 1020 TosIde - ok15:48:44.0328 1020 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll15:48:44.0343 1020 TrkWks - ok15:48:44.0390 1020 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys15:48:44.0390 1020 Udfs - ok15:48:44.0406 1020 UIUSys - ok15:48:44.0453 1020 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys15:48:44.0453 1020 ultra - ok15:48:44.0500 1020 UMWdf (9651e5d850b6f6bd7c77c70aa06f02bf) C:\WINDOWS\system32\wdfmgr.exe15:48:44.0515 1020 UMWdf - ok15:48:44.0578 1020 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys15:48:44.0593 1020 Update - ok15:48:44.0625 1020 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll15:48:44.0625 1020 upnphost - ok15:48:44.0640 1020 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe15:48:44.0640 1020 UPS - ok15:48:44.0703 1020 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys15:48:44.0703 1020 usbaudio - ok15:48:44.0750 1020 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys15:48:44.0750 1020 usbccgp - ok15:48:44.0796 1020 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys15:48:44.0796 1020 usbehci - ok15:48:44.0812 1020 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys15:48:44.0812 1020 usbhub - ok15:48:44.0828 1020 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys15:48:44.0828 1020 usbohci - ok15:48:44.0859 1020 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys15:48:44.0859 1020 usbprint - ok15:48:44.0875 1020 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys15:48:44.0875 1020 usbscan - ok15:48:44.0890 1020 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS15:48:44.0906 1020 USBSTOR - ok15:48:44.0937 1020 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys15:48:44.0937 1020 usbuhci - ok15:48:44.0984 1020 usbvm328 (6dc94d0d4f2472056d14e987f729eccb) C:\WINDOWS\system32\Drivers\usbvm326.sys15:48:44.0984 1020 usbvm328 - ok15:48:45.0031 1020 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys15:48:45.0031 1020 VgaSave - ok15:48:45.0062 1020 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys15:48:45.0062 1020 viaagp - ok15:48:45.0093 1020 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys15:48:45.0093 1020 ViaIde - ok15:48:45.0171 1020 vmfilter323 (6c21422d47ed3d8f65ed667bfd1cc759) C:\WINDOWS\system32\drivers\vmfilter323.sys15:48:45.0171 1020 vmfilter323 - ok15:48:45.0203 1020 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys15:48:45.0203 1020 VolSnap - ok15:48:45.0343 1020 Vongo Service (322aaa3b17e1fc664915350cdde92eb8) C:\Program Files\Vongo\VongoService.exe15:48:45.0359 1020 Vongo Service - ok15:48:45.0406 1020 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe15:48:45.0421 1020 VSS - ok15:48:45.0453 1020 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll15:48:45.0468 1020 W32Time - ok15:48:45.0515 1020 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys15:48:45.0515 1020 Wanarp - ok15:48:45.0531 1020 WDICA - ok15:48:45.0562 1020 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys15:48:45.0562 1020 wdmaud - ok15:48:45.0578 1020 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll15:48:45.0578 1020 WebClient - ok15:48:45.0656 1020 winachsf (e17d31cd52dcb7745ac5330eea062d0b) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys15:48:45.0671 1020 winachsf - ok15:48:45.0750 1020 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll15:48:45.0750 1020 winmgmt - ok15:48:46.0015 1020 wlidsvc (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE15:48:46.0078 1020 wlidsvc - ok15:48:46.0218 1020 WMConnectCDS (cd99c9feae87c1963273f6b150251e33) C:\Program Files\Windows Media Connect 2\wmccds.exe15:48:46.0234 1020 WMConnectCDS - ok15:48:46.0421 1020 WmdmPmSN (b9715b9c18bc6c8f4b66733d208cc9f7) C:\WINDOWS\system32\MsPMSNSv.dll15:48:46.0421 1020 WmdmPmSN - ok15:48:46.0500 1020 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll15:48:46.0515 1020 Wmi - ok15:48:46.0593 1020 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys15:48:46.0593 1020 WmiAcpi - ok15:48:46.0671 1020 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe15:48:46.0671 1020 WmiApSrv - ok15:48:46.0718 1020 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll15:48:46.0734 1020 wscsvc - ok15:48:46.0765 1020 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS15:48:46.0765 1020 WSTCODEC - ok15:48:46.0796 1020 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll15:48:46.0828 1020 wuauserv - ok15:48:46.0875 1020 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll15:48:46.0890 1020 WZCSVC - ok15:48:46.0921 1020 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll15:48:46.0921 1020 xmlprov - ok15:48:47.0000 1020 MBR (0x1B8) (665277635dc8ba83deae12eadedb75a0) \Device\Harddisk0\DR015:48:47.0015 1020 \Device\Harddisk0\DR0 - ok15:48:47.0031 1020 Boot (0x1200) (0c244233af3399cf72a2036305143af3) \Device\Harddisk0\DR0\Partition015:48:47.0031 1020 \Device\Harddisk0\DR0\Partition0 - ok15:48:47.0093 1020 Boot (0x1200) (5b9d4a6e33305397a5038ea01fb2397a) \Device\Harddisk0\DR0\Partition115:48:47.0093 1020 \Device\Harddisk0\DR0\Partition1 - ok15:48:47.0093 1020 ============================================================15:48:47.0093 1020 Scan finished Link to post Share on other sites More sharing options...
Jintan Posted May 16, 2012 ID:551827 Share Posted May 16, 2012 Surely was not the results I expected in any way.Be sure to continue to temporarily disable any protective software when running the scan tools we use here.Download ComboFix.exe from here to your desktop, then click that to run that scan. Agree to any warnings you might receive.Be sure to install the Recovery Console if you are asked to do so. When the scan completes, a text window with your log will open. Please copy and paste that log back here.A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.Also run TDSSKiller after that, and post that log please. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 16, 2012 Author ID:551832 Share Posted May 16, 2012 I am wondering if I had disable the Avira in the safemode. I tried to reboot in safe mode with networking to be sure if I had turn it off. Realise that I'm not so sure after all but the Avira control center said service stopped, instead of disabled. If you can tell me how to disable it again, I'll retry it one more time Link to post Share on other sites More sharing options...
Jintan Posted May 16, 2012 ID:551841 Share Posted May 16, 2012 Usually in Safe Mode, although there still are active services running, the antivirus' most active components are disabled. So let's see how you do with the most recent steps. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 16, 2012 Author ID:551851 Share Posted May 16, 2012 ComboFix 12-05-15.04 - Jeff 05/15/2012 17:12:37.1.2 - x86 NETWORKMicrosoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2015.1715 [GMT -8:00]Running from: c:\documents and settings\Jeff\Desktop\ComboFix.exeAV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\documents and settings\All Users\Application Data\883o8ZUhSyoNkac:\documents and settings\All Users\Application Data\TEMPc:\documents and settings\J\GoToAssistDownloadHelper.exec:\documents and settings\J\WINDOWSc:\documents and settings\Jeff\WINDOWSc:\windows\system32\systemD:\Autorun.inf.Infected copy of c:\windows\system32\Version.dll was found and disinfectedRestored copy from - c:\windows\ServicePackFiles\i386\version.dll..((((((((((((((((((((((((( Files Created from 2012-04-16 to 2012-05-16 )))))))))))))))))))))))))))))))..2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\documents and settings\Jeff\Application Data\Malwarebytes2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2012-05-14 16:44 . 2012-04-04 23:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys2012-04-30 17:33 . 2012-05-11 00:18 -------- d--h--w- c:\program files\Microsoft Silverlight2012-04-23 17:24 . 2012-04-23 17:24 -------- d--h--w- c:\program files\PureEdge1...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-05-05 00:10 . 2012-04-05 23:58 70304 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-05-05 00:10 . 2012-04-05 23:58 419488 ---ha-w- c:\windows\system32\FlashPlayerApp.exe2012-04-11 13:14 . 2006-03-16 04:00 2148352 ---ha-w- c:\windows\system32\ntoskrnl.exe2012-04-11 13:12 . 2006-03-16 04:00 1862272 ---ha-w- c:\windows\system32\win32k.sys2012-04-11 12:35 . 2006-03-16 04:00 2026496 ---ha-w- c:\windows\system32\ntkrnlpa.exe2012-03-01 11:01 . 2006-03-16 04:00 916992 ---ha-w- c:\windows\system32\wininet.dll2012-03-01 11:01 . 2006-03-16 04:00 43520 ---ha-w- c:\windows\system32\licmgr10.dll2012-03-01 11:01 . 2006-03-16 04:00 1469440 ---h--w- c:\windows\system32\inetcpl.cpl2012-02-29 14:10 . 2006-03-16 04:00 177664 ---ha-w- c:\windows\system32\wintrust.dll2012-02-29 14:10 . 2006-03-16 04:00 148480 ---ha-w- c:\windows\system32\imagehlp.dll2012-02-29 12:17 . 2006-03-16 04:00 385024 ---ha-w- c:\windows\system32\html.iec2001-06-20 21:19 . 2001-06-19 21:34 40960 ---ha-w- c:\program files\ACMonitor_X83.exe2012-01-29 15:55 . 2012-02-08 03:15 134104 ---ha-w- c:\program files\mozilla firefox\components\browsercomps.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]2012-02-10 19:28 1307928 ---ha-w- c:\program files\Microsoft\BingBar\7.1.361.0\BingExt.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-12-10 247144]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-27 15026056]"Device Detection"="c:\program files\FUJIFILM\MyFinePix Studio\dd.exe" [2011-06-07 404664].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-11 149280]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]"nwiz"="nwiz.exe" [2006-08-18 1617920]"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 61952]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-12 102400]"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408].c:\documents and settings\Default User\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\Administrator\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\Jeff\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\All Users\Start Menu\Programs\Startup\ActivClient Agent.lnk - c:\program files\ActivIdentity\ActivClient\acsagent.exe [2007-5-15 130864]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]2007-05-15 20:08 112640 ---ha-w- c:\windows\system32\ackpbsc.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]2007-05-15 20:08 281088 ---ha-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\WINDOWS\\system32\\mqsvc.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"="c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"="c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"="c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"="c:\\Program Files\\BearShare\\BearShare.exe"="c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=.R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 12:08 PM 182576]R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/20/2010 8:13 PM 136360]R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE [2/10/2012 11:28 AM 193816]R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/14/2012 8:44 AM 654408]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [12/3/2009 1:37 PM 95200]R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [12/10/2010 4:29 AM 92008]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/14/2012 8:44 AM 22344]S2 0062421329956074mcinstcleanup;McAfee Application Installer Cleanup (0062421329956074);c:\windows\TEMP\006242~1.EXE -cleanup -nolog --> c:\windows\TEMP\006242~1.EXE -cleanup -nolog [?]S2 MOBCleanup;MOBCleanup;"c:\docume~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe" --> c:\docume~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe [?]S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 12:39 PM 61952]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/5/2012 3:58 PM 257696]S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.EXE [2/10/2012 11:28 AM 240408]S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000]S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [1/6/2010 7:19 PM 57856]S3 usbvm328;HP Camera;c:\windows\system32\drivers\usbvm326.sys [2/14/2011 1:40 PM 219648]S3 vmfilter323;VC0326 filter service for Serome;c:\windows\system32\drivers\vmfilter323.sys [2/14/2011 1:40 PM 475264].--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc.Contents of the 'Scheduled Tasks' folder.2012-05-15 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 00:10].2012-03-16 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]..------- Supplementary Scan -------.uStart Page = hxxp://www.yahoo.com/uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%sIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105Trusted Zone: ahrn.com\wwwTrusted Zone: ahrn.com\www*Trusted Zone: chase.comTrusted Zone: internetTrusted Zone: mcafee.comTCP: DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0FF - ProfilePath - c:\documents and settings\Jeff\Application Data\Mozilla\Firefox\Profiles\wifw4z5k.default\FF - prefs.js: browser.search.selectedEngine - Secure SearchFF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=.- - - - ORPHANS REMOVED - - - -.HKLM-Run-hpqSRMon - (no file)...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2012-05-15 17:22Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????<?@? ????Q??????Y?@?????<?@.scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.netWindows 5.1.2600.CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.device: opened successfullyuser: error reading MBRkernel: MBR read successfullyuser != kernel MBR !!!.**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'winlogon.exe'(676)c:\windows\system32\ackpbsc.dllc:\windows\system32\aclog.dllc:\windows\system32\ACLIBEAY.dllc:\windows\system32\acevtsub.dllc:\windows\system32\asphat32.dllc:\windows\system32\acerrmes.dllc:\windows\system32\aspcom.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dllc:\program files\ActivIdentity\ActivClient\acunlock.dllc:\windows\system32\aipingui.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dllc:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll.- - - - - - - > 'explorer.exe'(4040)c:\windows\system32\WININET.dllc:\progra~1\mcafee\SITEAD~1\saHook.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dll.------------------------ Other Running Processes ------------------------.c:\windows\System32\SCardSvr.exec:\program files\ActivIdentity\ActivClient\acevents.exec:\windows\system32\msdtc.exec:\program files\Avira\AntiVir Desktop\avguard.exec:\windows\eHome\ehRecvr.exec:\windows\eHome\ehSched.exec:\program files\Avira\AntiVir Desktop\avshadow.exec:\program files\Java\jre6\bin\jqs.exec:\program files\Common Files\LightScribe\LSSrvc.exec:\program files\ActivIdentity\ActivClient\acevents.exec:\windows\system32\nvsvc32.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEc:\program files\Hewlett-Packard\Shared\hpqwmiex.exec:\windows\ehome\mcrdsvc.exec:\windows\system32\mqsvc.exec:\windows\system32\mqtgsvc.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\windows\system32\rundll32.exec:\windows\system32\dllhost.exec:\windows\system32\wbem\wmiapsrv.exec:\windows\eHome\ehmsas.exe.**************************************************************************.Completion time: 2012-05-15 17:30:18 - machine was rebootedComboFix-quarantined-files.txt 2012-05-16 01:30.Pre-Run: 24,360,603,648 bytes freePost-Run: 24,458,252,288 bytes free.WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsUnsupportedDebug="do not select this" /debugmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect.- - End Of File - - 44EF6B2B1F37FF8E7E8DB7076DA0964D Link to post Share on other sites More sharing options...
brightjoy2 Posted May 16, 2012 Author ID:551853 Share Posted May 16, 2012 This is after running the combofix, thanks7:37:53.0375 1776 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:1817:37:53.0968 1776 ============================================================17:37:53.0968 1776 Current date / time: 2012/05/15 17:37:53.096817:37:53.0968 1776 SystemInfo:17:37:53.0968 1776 17:37:53.0968 1776 OS Version: 5.1.2600 ServicePack: 3.017:37:53.0968 1776 Product type: Workstation17:37:53.0968 1776 ComputerName: STOLL17:37:53.0968 1776 UserName: Jeff17:37:53.0968 1776 Windows directory: C:\WINDOWS17:37:53.0968 1776 System windows directory: C:\WINDOWS17:37:53.0968 1776 Processor architecture: Intel x8617:37:53.0968 1776 Number of processors: 217:37:53.0968 1776 Page size: 0x100017:37:53.0968 1776 Boot type: Normal boot17:37:53.0968 1776 ============================================================17:37:55.0187 1776 Drive \Device\Harddisk0\DR0 - Size: 0x174A446000 (93.16 Gb), SectorSize: 0x200, Cylinders: 0x2F81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000005017:37:55.0187 1776 ============================================================17:37:55.0187 1776 \Device\Harddisk0\DR0:17:37:55.0187 1776 MBR partitions:17:37:55.0187 1776 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xA13099A17:37:55.0187 1776 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0xA13489A, BlocksNum 0x171A8E417:37:55.0187 1776 ============================================================17:37:55.0265 1776 C: <-> \Device\Harddisk0\DR0\Partition017:37:55.0296 1776 D: <-> \Device\Harddisk0\DR0\Partition117:37:55.0296 1776 ============================================================17:37:55.0296 1776 Initialize success17:37:55.0296 1776 ============================================================17:38:03.0796 3128 Deinitialize success Link to post Share on other sites More sharing options...
Jintan Posted May 16, 2012 ID:552067 Share Posted May 16, 2012 Curious results so far, though hoping ComboFix catching and replacing a bogus .dll file will have changed something.Since I have the info at hand, take note of the following, to choose to uninstall later once we are clear of this rootkit nonsense:Vongo - Pre-installed by HP, now defunct.Netscape Browser (remove only) - Same - pre-installed, no longer in use.And these are resource wasters if you do not actually use them:Yahoo! Toolbar for Internet ExplorerYahoo! ToolbarBing Bar-------------Download MBRCheck.exe to your Desktop. Run the application.If no infection is found, it will produce a report on the desktop. Post that report in your next reply.If an infection is found, you will be presented with the following dialog:Enter 'Y' and hit ENTER for more options, or 'N' to exit: Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.------------Run Gmer again, and post that log please. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 17, 2012 Author ID:552133 Share Posted May 17, 2012 MBRCheck, version 1.2.3© 2010, ADCommand-line: Windows Version: Windows XP ProfessionalWindows Information: Service Pack 3 (build 2600)Logical Drives Mask: 0x0000001cKernel Drivers (total 140): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E5000 \WINDOWS\system32\hal.dll 0xF7987000 \WINDOWS\system32\KDCOM.DLL 0xF7897000 \WINDOWS\system32\BOOTVID.dll 0xF7358000 ACPI.sys 0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF7347000 pci.sys 0xF7487000 isapnp.sys 0xF7497000 ohci1394.sys 0xF74A7000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xF789B000 compbatt.sys 0xF789F000 \WINDOWS\system32\DRIVERS\BATTC.SYS 0xF7A4F000 pciide.sys 0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF798B000 intelide.sys 0xF798D000 viaide.sys 0xF798F000 aliide.sys 0xF7329000 pcmcia.sys 0xF74B7000 MountMgr.sys 0xF730A000 ftdisk.sys 0xF7991000 dmload.sys 0xF72E4000 dmio.sys 0xF78A3000 ACPIEC.sys 0xF7A50000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 0xF770F000 PartMgr.sys 0xF74C7000 VolSnap.sys 0xF72CC000 atapi.sys 0xF72B3000 nvata.sys 0xF74D7000 disk.sys 0xF74E7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF7293000 fltmgr.sys 0xF7281000 sr.sys 0xF7717000 PxHelp20.sys 0xF726A000 KSecDD.sys 0xF71DD000 Ntfs.sys 0xF71B0000 NDIS.sys 0xF74F7000 Serial.sys 0xF7196000 Mup.sys 0xF7697000 \SystemRoot\system32\DRIVERS\AmdK8.sys 0xF7152000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0xF714E000 \SystemRoot\system32\DRIVERS\cpqbttn.sys 0xF76A7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF780F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF6B50000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0xF6707000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xF66F3000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF6B3C000 \SystemRoot\system32\DRIVERS\nvsmu.sys 0xF7817000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xF66CF000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF781F000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF7537000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF76B7000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF76C7000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF66AC000 \SystemRoot\system32\DRIVERS\ks.sys 0xF6684000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xF6B34000 \SystemRoot\system32\DRIVERS\nvnetbus.sys 0xF6639000 \SystemRoot\system32\DRIVERS\NVNRM.SYS 0xF6602000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS 0xF76D7000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF7827000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF65D2000 \SystemRoot\system32\DRIVERS\SynTP.sys 0xF79CB000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF782F000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF7ABD000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF6B30000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF65BB000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF7507000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF7837000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF65AA000 \SystemRoot\system32\DRIVERS\psched.sys 0xF7517000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF783F000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF7847000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF6552000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF7527000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF79CD000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF64F4000 \SystemRoot\system32\DRIVERS\update.sys 0xF793F000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF794B000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xF7557000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF6B0C000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF6AFC000 \SystemRoot\system32\DRIVERS\NVENETFD.sys 0xF2E29000 \SystemRoot\system32\drivers\CHDAud.sys 0xF2E05000 \SystemRoot\system32\drivers\portcls.sys 0xF7677000 \SystemRoot\system32\drivers\drmk.sys 0xF2DD2000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys 0xF2CE0000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys 0xF2C2E000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys 0xF77A7000 \SystemRoot\System32\Drivers\Modem.SYS 0xF3AFE000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF7A4D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xEFA2D000 \SystemRoot\System32\Drivers\Null.SYS 0xF7993000 \SystemRoot\System32\Drivers\Beep.SYS 0xF11E2000 \SystemRoot\System32\drivers\vga.sys 0xF7995000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7997000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF11DA000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF11D2000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF3AFA000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xEC903000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xEC8AA000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xEC882000 \SystemRoot\system32\DRIVERS\netbt.sys 0xEC85C000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF2ED6000 \SystemRoot\System32\drivers\ws2ifsl.sys 0xF0D59000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xEC83A000 \SystemRoot\System32\drivers\afd.sys 0xF0D49000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF79A3000 \SystemRoot\system32\DRIVERS\eabfiltr.sys 0xF11CA000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0xEC80F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xEC79F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF0012000 \SystemRoot\System32\Drivers\Fips.SYS 0xEC778000 \SystemRoot\system32\DRIVERS\avipbb.sys 0xF7A2F000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys 0xEC754000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xEC73B000 \SystemRoot\System32\Drivers\dump_nvata.sys 0xF7A45000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF0026000 \SystemRoot\System32\drivers\Dxapi.sys 0xEF181000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7B74000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\nv4_disp.dll 0xBF3E0000 \SystemRoot\System32\ATMFD.DLL 0xBA5E9000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0xEB00E000 \??\C:\WINDOWS\system32\drivers\mbam.sys 0xEE9B6000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB9D6C000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB9D2F000 \SystemRoot\system32\drivers\wdmaud.sys 0xF00A3000 \SystemRoot\system32\drivers\sysaudio.sys 0xB9B29000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xB8F48000 \SystemRoot\System32\Drivers\HTTP.sys 0xB8E00000 \SystemRoot\system32\DRIVERS\srv.sys 0xB8DC8000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xB8C09000 \??\C:\WINDOWS\system32\drivers\mqac.sys 0xB8B0F000 \??\C:\WINDOWS\system32\drivers\RMCast.sys 0xB7A8A000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys 0xB741D000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dllProcesses (total 78): 0 System Idle Process 4 System 596 C:\WINDOWS\system32\smss.exe 644 csrss.exe 672 C:\WINDOWS\system32\winlogon.exe 716 C:\WINDOWS\system32\services.exe 728 C:\WINDOWS\system32\lsass.exe 916 C:\WINDOWS\system32\svchost.exe 964 svchost.exe 1060 C:\WINDOWS\system32\svchost.exe 1184 svchost.exe 1260 svchost.exe 1392 C:\WINDOWS\system32\spoolsv.exe 1476 acevents.exe 1484 scardsvr.exe 1504 C:\Program Files\Avira\AntiVir Desktop\sched.exe 1656 svchost.exe 1872 C:\WINDOWS\explorer.exe 2016 C:\WINDOWS\ehome\ehtray.exe 2044 C:\Program Files\Java\jre6\bin\jusched.exe 272 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 288 C:\Program Files\HP\QuickPlay\QPService.exe 328 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe 348 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe 360 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe 548 C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe 400 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 580 C:\Program Files\QuickTime\QTTask.exe 588 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 612 C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe 624 C:\Program Files\Skype\Phone\Skype.exe 1008 C:\Program Files\ActivIdentity\ActivClient\acevents.exe 1024 C:\WINDOWS\system32\ctfmon.exe 1428 C:\Program Files\ActivIdentity\ActivClient\acsagent.exe 1572 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 1396 C:\Program Files\Vongo\Tray.exe 1720 msdtc.exe 1192 C:\Program Files\ActivIdentity\ActivClient\accoca.exe 1972 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1980 C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe 2012 C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE 2080 C:\WINDOWS\ehome\ehrecvr.exe 2104 C:\WINDOWS\ehome\ehSched.exe 2152 C:\WINDOWS\system32\svchost.exe 2216 C:\Program Files\Java\jre6\bin\jqs.exe 2256 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2428 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 2828 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 2852 C:\PROGRA~1\McAfee\SITEAD~1\McSACore.exe 2928 C:\WINDOWS\system32\svchost.exe 2948 C:\WINDOWS\system32\nvsvc32.exe 2964 C:\WINDOWS\system32\svchost.exe 3096 svchost.exe 3288 C:\WINDOWS\system32\svchost.exe 3496 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 3792 C:\Program Files\Vongo\VongoService.exe 3840 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 2748 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 3452 mcrdsvc.exe 3716 C:\WINDOWS\system32\mqsvc.exe 416 C:\WINDOWS\system32\wuauclt.exe 3532 C:\WINDOWS\system32\mqtgsvc.exe 3556 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE 3832 C:\Program Files\Internet Explorer\iexplore.exe 3580 C:\WINDOWS\system32\rundll32.exe 2472 wmiprvse.exe 3592 C:\WINDOWS\system32\dllhost.exe 2940 C:\WINDOWS\system32\wbem\wmiapsrv.exe 404 alg.exe 2772 C:\WINDOWS\system32\svchost.exe 2320 C:\Program Files\Internet Explorer\iexplore.exe 1748 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe 512 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe 1688 C:\WINDOWS\ehome\ehmsas.exe 480 C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe 5400 C:\Program Files\Internet Explorer\iexplore.exe 3480 C:\WINDOWS\system32\wscntfy.exe 4420 C:\Documents and Settings\Jeff\Desktop\MBRCheck.exe\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000014`26913400 (FAT32)PhysicalDrive0 Model Number: ST9100824AS, Rev: 7.24 Size Device Name MBR Status -------------------------------------------- 93 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: F19F100B4DC860880BDC331CC9D56B1C13F605D5Found non-standard or infected MBR.Enter 'Y' and hit ENTER for more options, or 'N' to exit:Done! Link to post Share on other sites More sharing options...
brightjoy2 Posted May 17, 2012 Author ID:552144 Share Posted May 17, 2012 GMER 1.0.15.15641 - http://www.gmer.netRootkit scan 2012-05-16 22:48:46Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\0000007e rev.Running: qx4x3rwb.exe; Driver: C:\DOCUME~1\Jeff\LOCALS~1\Temp\pxtdypob.sys---- System - GMER 1.0.15 ----SSDT EE6B468C ZwCloseSSDT EE6B4646 ZwCreateKeySSDT EE6B4696 ZwCreateSectionSSDT EE6B463C ZwCreateThreadSSDT EE6B464B ZwDeleteKeySSDT EE6B4655 ZwDeleteValueKeySSDT EE6B4687 ZwDuplicateObjectSSDT EE6B465A ZwLoadKeySSDT EE6B4628 ZwOpenProcessSSDT EE6B462D ZwOpenThreadSSDT EE6B4664 ZwReplaceKeySSDT EE6B465F ZwRestoreKeySSDT EE6B469B ZwSetContextThreadSSDT EE6B4650 ZwSetValueKeySSDT EE6B4637 ZwTerminateProcess---- Kernel code sections - GMER 1.0.15 ----.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6105360, 0x225D9D, 0xE8000020]---- User code sections - GMER 1.0.15 ----.text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB14 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E53AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E52E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E534C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E51B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E5214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E5412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[1732] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E5276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AA5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD119 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB14 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254686 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E53AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E52E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E534C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E51B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E5214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E5412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E5276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDB70 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\internet explorer\iexplore.exe[3208] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E5717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)---- User IAT/EAT - GMER 1.0.15 ----IAT C:\Program Files\internet explorer\iexplore.exe[3208] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)---- Devices - GMER 1.0.15 ----AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)---- Disk sectors - GMER 1.0.15 ----Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior---- EOF - GMER 1.0.15 ---- Link to post Share on other sites More sharing options...
Jintan Posted May 17, 2012 ID:552447 Share Posted May 17, 2012 Shows the infected MBR in both scan logs, and Gmer sure showing some pretty suspect other activity. Wonder why what is there seems to be slipping past TDSSKiller's checks.We could replace the MBR with a Windows 7 default copy, but there is always a concern that will then have you lose access to any factory reinstall partition - press some key sequence during a reboot, and access a location that will then just return the system to factory state. Do you know if you system has that? If the malware has altered the MBR, then that access is already lost, and returning a default MBR would then serve to cripple the malware.Run ComboFix again please, and post that log. Perhaps it repairing that .dll will open new doors for it.Also locate the following hilighted file(s), zip a copy of it, and send it to jintan AT malwarecrypt.com as an attachment. Please place "Submitted Files - brightjoy2/mb/mbr" as the email Subject.C:\Documents and Settings\Jeff\Desktop\MBR.dat Link to post Share on other sites More sharing options...
Jintan Posted May 18, 2012 ID:552501 Share Posted May 18, 2012 I received the MBR copy, thanks. Looks like we're being snookered here - the mbr.dat file was just filled with empty spaces. Suggests maybe some watcher driver being loaded to block and distract things. Go ahead and run ComboFix again, but also do the following after that:Open Gmer again. Once it has completed it's opening scan, this time just right click in the white space in the display and select Options - Only non MS files. Then click Scan and allow Gmer to run a different scan. Once that completes click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 18, 2012 Author ID:552505 Share Posted May 18, 2012 ComboFix 12-05-17.08 - Jeff 05/17/2012 19:35:25.2.2 - x86 NETWORKMicrosoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2015.1729 [GMT -8:00]Running from: c:\documents and settings\Jeff\Desktop\ComboFix.exeAV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\documents and settings\Jeff\Desktop\Data_Recovery.lnk..((((((((((((((((((((((((( Files Created from 2012-04-18 to 2012-05-18 )))))))))))))))))))))))))))))))..2012-05-17 05:20 . 2012-05-17 05:20 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\documents and settings\Jeff\Application Data\Malwarebytes2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-05-14 16:44 . 2012-05-14 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2012-05-14 16:44 . 2012-04-04 23:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys2012-04-30 17:33 . 2012-05-11 00:18 -------- d-----w- c:\program files\Microsoft Silverlight2012-04-23 17:24 . 2012-04-23 17:24 -------- d-----w- c:\program files\PureEdge1...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-05-05 00:10 . 2012-04-05 23:58 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-05-05 00:10 . 2012-04-05 23:58 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe2012-04-11 13:14 . 2006-03-16 04:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe2012-04-11 13:12 . 2006-03-16 04:00 1862272 ----a-w- c:\windows\system32\win32k.sys2012-04-11 12:35 . 2006-03-16 04:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe2012-03-01 11:01 . 2006-03-16 04:00 916992 ----a-w- c:\windows\system32\wininet.dll2012-03-01 11:01 . 2006-03-16 04:00 43520 ----a-w- c:\windows\system32\licmgr10.dll2012-03-01 11:01 . 2006-03-16 04:00 1469440 ------w- c:\windows\system32\inetcpl.cpl2012-02-29 14:10 . 2006-03-16 04:00 177664 ----a-w- c:\windows\system32\wintrust.dll2012-02-29 14:10 . 2006-03-16 04:00 148480 ----a-w- c:\windows\system32\imagehlp.dll2012-02-29 12:17 . 2006-03-16 04:00 385024 ----a-w- c:\windows\system32\html.iec2001-06-20 21:19 . 2001-06-19 21:34 40960 ----a-w- c:\program files\ACMonitor_X83.exe2012-01-29 15:55 . 2012-02-08 03:15 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]2012-02-10 19:28 1307928 ----a-w- c:\program files\Microsoft\BingBar\7.1.361.0\BingExt.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-12-10 247144]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-27 15026056]"Device Detection"="c:\program files\FUJIFILM\MyFinePix Studio\dd.exe" [2011-06-07 404664].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-11 149280]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]"nwiz"="nwiz.exe" [2006-08-18 1617920]"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 61952]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-12 102400]"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]"Reminder"="c:\windows\CREATOR\Remind_XP.exe" [2006-02-09 643072]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408].c:\documents and settings\Default User\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\Administrator\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\Jeff\Start Menu\Programs\Startup\Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728].c:\documents and settings\All Users\Start Menu\Programs\Startup\ActivClient Agent.lnk - c:\program files\ActivIdentity\ActivClient\acsagent.exe [2007-5-15 130864]HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]2007-05-15 20:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]2007-05-15 20:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\WINDOWS\\system32\\mqsvc.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"="c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"="c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"="c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="c:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"="c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"="c:\\Program Files\\BearShare\\BearShare.exe"="c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=.S2 0062421329956074mcinstcleanup;McAfee Application Installer Cleanup (0062421329956074);c:\windows\TEMP\006242~1.EXE -cleanup -nolog --> c:\windows\TEMP\006242~1.EXE -cleanup -nolog [?]S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 12:08 PM 182576]S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/20/2010 8:13 PM 136360]S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE [2/10/2012 11:28 AM 193816]S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/14/2012 8:44 AM 654408]S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [12/3/2009 1:37 PM 95200]S2 MOBCleanup;MOBCleanup;"c:\docume~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe" --> c:\docume~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe [?]S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [12/10/2010 4:29 AM 92008]S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 12:39 PM 61952]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/5/2012 3:58 PM 257696]S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.EXE [2/10/2012 11:28 AM 240408]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/14/2012 8:44 AM 22344]S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000]S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [1/6/2010 7:19 PM 57856]S3 usbvm328;HP Camera;c:\windows\system32\drivers\usbvm326.sys [2/14/2011 1:40 PM 219648]S3 vmfilter323;VC0326 filter service for Serome;c:\windows\system32\drivers\vmfilter323.sys [2/14/2011 1:40 PM 475264].--- Other Services/Drivers In Memory ---.*NewlyCreated* - MDMXSDK.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc.Contents of the 'Scheduled Tasks' folder.2012-05-18 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 00:10].2012-05-17 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]..------- Supplementary Scan -------.uStart Page = hxxp://www.yahoo.com/uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%sIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105Trusted Zone: ahrn.com\wwwTrusted Zone: ahrn.com\www*Trusted Zone: chase.comTrusted Zone: internetTrusted Zone: mcafee.comTCP: DhcpNameServer = 209.165.131.12 209.165.131.13 0.0.0.0FF - ProfilePath - c:\documents and settings\Jeff\Application Data\Mozilla\Firefox\Profiles\wifw4z5k.default\FF - prefs.js: browser.search.selectedEngine - Secure SearchFF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=..**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2012-05-17 19:43Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ....HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????<?@? ????Q??????Y?@?????<?@.scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'winlogon.exe'(584)c:\windows\system32\ackpbsc.dllc:\windows\system32\aclog.dllc:\windows\system32\ACLIBEAY.dllc:\windows\system32\acevtsub.dllc:\windows\system32\asphat32.dllc:\windows\system32\acerrmes.dllc:\windows\system32\aspcom.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dllc:\program files\ActivIdentity\ActivClient\acunlock.dllc:\windows\system32\aipingui.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dllc:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dllc:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll.Completion time: 2012-05-17 19:45:08ComboFix-quarantined-files.txt 2012-05-18 03:45ComboFix2.txt 2012-05-16 01:30.Pre-Run: 24,524,951,552 bytes freePost-Run: 24,508,145,664 bytes free.- - End Of File - - 1221430E0B002328A8FCAAFDC9C18421 Link to post Share on other sites More sharing options...
brightjoy2 Posted May 18, 2012 Author ID:552508 Share Posted May 18, 2012 The GMER 1.0.15.15641 - http://www.gmer.netRootkit scan 2012-05-17 19:52:22Windows 5.1.2600 Service Pack 3Running: qx4x3rwb.exe; Driver: C:\DOCUME~1\Jeff\LOCALS~1\Temp\pxtdypod.sys---- Modules - GMER 1.0.15 ----Module viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) F798D000-F798F000 (8192 bytes)Module aliide.sys (ALi mini IDE Driver/Acer Laboratories Inc.) F798F000-F7991000 (8192 bytes)Module nvata.sys (NVIDIA® nForce IDE Performance Driver/NVIDIA Corporation) F7393000-F73AC000 (102400 bytes)Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F7717000-F771C000 (20480 bytes)Module \SystemRoot\system32\DRIVERS\cpqbttn.sys (HP Tablet PC Key Button HID Driver/Hewlett-Packard Development Company, L.P.) F7923000-F7926000 (12288 bytes)Module \SystemRoot\system32\DRIVERS\nvsmu.sys (NVIDIA® nForce SMU Microcontroller Driver/NVIDIA Corporation) F7933000-F7936000 (12288 bytes)Module \SystemRoot\system32\DRIVERS\HDAudBus.sys (High Definition Audio Bus Driver v1.0a/Windows ® Server 2003 DDK provider) F71BF000-F71E7000 (163840 bytes)Module \SystemRoot\system32\DRIVERS\nvnetbus.sys (NVIDIA Networking Bus Driver./NVIDIA Corporation) F795B000-F795F000 (16384 bytes)Module \SystemRoot\system32\DRIVERS\NVNRM.SYS (NVIDIA Network Resource Manager./NVIDIA Corporation) F7174000-F71BF000 (307200 bytes)Module \SystemRoot\system32\DRIVERS\NVSNPU.SYS (NVIDIA Networking Soft-NPU Driver./NVIDIA Corporation) F713D000-F7174000 (225280 bytes)Module \SystemRoot\system32\DRIVERS\SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) F710D000-F713D000 (196608 bytes)Module \SystemRoot\system32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F777F000-F7784000 (20480 bytes)Module \SystemRoot\system32\DRIVERS\NVENETFD.sys (NVIDIA Networking Function Driver./NVIDIA Corporation) F75C7000-F75D0000 (36864 bytes)Module \SystemRoot\System32\ATMFD.DLL (Windows NT OpenType/Type 1 Font Driver/Adobe Systems Incorporated) BF012000-BF059000 (290816 bytes)Module \??\C:\DOCUME~1\Jeff\LOCALS~1\Temp\catchme.sys F780F000-F7817000 (32768 bytes)Module \??\C:\DOCUME~1\Jeff\LOCALS~1\Temp\pxtdypod.sys (GMER) F6498000-F64B1000 (102400 bytes)---- Processes - GMER 1.0.15 ----Process C:\WINDOWS\explorer.exe (Windows Explorer/Microsoft Corporation) 248Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Library C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (PDF Shell Extension/Adobe Systems, Inc.) 0x10000000Process C:\WINDOWS\system32\csrss.exe (Client Server Runtime Process/Microsoft Corporation) 560Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation) 584Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Library C:\WINDOWS\system32\ackpbsc.dll (ackpbsc/ActivIdentity) 0x10000000Library C:\WINDOWS\system32\aclog.dll (ActivIdentity Log API/ActivIdentity) 0x00FA0000Library C:\WINDOWS\system32\ACLIBEAY.dll (OpenSSL Shared Library/ActivIdentity) 0x01090000Library C:\WINDOWS\system32\acevtsub.dll (ActivIdentity Event Subscriber DLL/ActivIdentity) 0x01180000Library C:\WINDOWS\system32\asphat32.dll (asphat32/ActivIdentity) 0x011B0000Library C:\WINDOWS\system32\acerrmes.dll (acerrmes DLL/ActivIdentity) 0x01210000Library C:\WINDOWS\system32\aspcom.dll (ASPCOM API/ActivIdentity) 0x01230000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll (acerrmes DLL/ActivIdentity) 0x01270000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll (asphat32/ActivIdentity) 0x013D0000Library C:\Program Files\ActivIdentity\ActivClient\acunlock.dll (acunlock DLL/ActivIdentity) 0x01C80000Library C:\WINDOWS\system32\aipingui.dll (Common Application GUI resources/ActivIdentity) 0x01CE0000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll (Common Application GUI resources/ActivIdentity) 0x01D30000Library C:\Program Files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll (acCobAPI resources DLL/ActivIdentity) 0x01DB0000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll (acunlock DLL/ActivIdentity) 0x01E10000Process C:\WINDOWS\system32\services.exe (Services and Controller app/Microsoft Corporation) 628Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\lsass.exe (LSA Shell (Export Version)/Microsoft Corporation) 640Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 800Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 872Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1040Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1052Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\Program Files\internet explorer\iexplore.exe (Internet Explorer/Microsoft Corporation) 1092Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\ctfmon.exe (CTF Loader/Microsoft Corporation) 1132Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1168Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\Program Files\ActivIdentity\ActivClient\acevents.exe (ActivIdentity Event Service/ActivIdentity) 1252Library C:\Program Files\ActivIdentity\ActivClient\acevents.exe (ActivIdentity Event Service/ActivIdentity) 0x00400000Library C:\WINDOWS\system32\aclog.dll (ActivIdentity Log API/ActivIdentity) 0x10000000Library C:\WINDOWS\system32\asphat32.dll (asphat32/ActivIdentity) 0x00350000Library C:\WINDOWS\system32\ackpbsc.dll (ackpbsc/ActivIdentity) 0x003C0000Library C:\WINDOWS\system32\ACLIBEAY.dll (OpenSSL Shared Library/ActivIdentity) 0x00420000Library C:\WINDOWS\system32\acerrmes.dll (acerrmes DLL/ActivIdentity) 0x004D0000Library C:\WINDOWS\system32\acevtsub.dll (ActivIdentity Event Subscriber DLL/ActivIdentity) 0x004F0000Library C:\WINDOWS\system32\aspcom.dll (ASPCOM API/ActivIdentity) 0x00520000Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll (acerrmes DLL/ActivIdentity) 0x008C0000Library C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll (asphat32/ActivIdentity) 0x00920000Process C:\Documents and Settings\Jeff\Desktop\qx4x3rwb.exe 1268Library C:\Documents and Settings\Jeff\Desktop\qx4x3rwb.exe 0x00400000Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Process C:\Program Files\internet explorer\iexplore.exe (Internet Explorer/Microsoft Corporation) 1816Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000Library C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx (Adobe Flash Player 11.2 r202/Adobe Systems, Inc.) 0x10000000---- Services - GMER 1.0.15 ----Service C:\WINDOWS\TEMP\006242~1.EXE [AUTO] 0062421329956074mcinstcleanupService C:\WINDOWS\System32\Drivers\5U870CAP.sys (Ricoh USB Camera driver/Ricoh) [MANUAL] 5U870CAP_VID_1262&PID_25FDService C:\Program Files\ActivIdentity\ActivClient\accoca.exe (ActivIdentity Cache Server/ActivIdentity) [AUTO] accocaService C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Add Filter For Usb/Hewlett-Packard Development Company, L.P.) [MANUAL] AddFiltrService C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 11.2 r202/Adobe Systems Incorporated) [MANUAL] AdobeFlashPlayerUpdateSvcService C:\WINDOWS\system32\DRIVERS\aliide.sys (ALi mini IDE Driver/Acer Laboratories Inc.) [bOOT] AliIdeService C:\WINDOWS\system32\DRIVERS\amdagp.sys (AMD Win2000 AGP Filter/Advanced Micro Devices, Inc.) [DISABLED] amdagpService C:\WINDOWS\system32\DRIVERS\AmdK8.sys (AMD Processor Driver/Advanced Micro Devices) [sYSTEM] AmdK8Service C:\Program Files\Avira\AntiVir Desktop\sched.exe (Antivirus Scheduler/Avira GmbH) [AUTO] AntiVirSchedulerServiceService C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Antivirus On-Access Service/Avira GmbH) [AUTO] AntiVirServiceService C:\WINDOWS\system32\DRIVERS\asc.sys (AdvanSys SCSI Controller Driver/Advanced System Products, Inc.) [DISABLED] ascService C:\WINDOWS\system32\DRIVERS\asc3550.sys (AdvanSys Ultra-Wide PCI SCSI Driver/Advanced System Products, Inc.) [DISABLED] asc3550Service C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira AntiVir Support for Minifilter/Avira GmbH) [sYSTEM] avgioService C:\WINDOWS\system32\DRIVERS\avgntflt.sys (Avira Minifilter Driver/Avira GmbH) [AUTO] avgntfltService C:\WINDOWS\system32\DRIVERS\avipbb.sys (Avira Driver for Security Enhancement/Avira GmbH) [sYSTEM] avipbbService C:\WINDOWS\system32\DRIVERS\bcmwl5.sys (Broadcom 802.11 Network Adapter wireless driver/Broadcom Corporation) [MANUAL] BCM43XXService C:\WINDOWS\System32\Drivers\btwusb.sys (Driver for Bluetooth USB Devices/Broadcom Corporation.) [MANUAL] BTWUSBService C:\DOCUME~1\Jeff\LOCALS~1\Temp\catchme.sys [MANUAL] catchmeService C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD PCI IDE Bus Driver/CMD Technology, Inc.) [DISABLED] CmdIdeService C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Disk Array Controller Driver/Mylex Corporation) [DISABLED] dac2w2kService C:\WINDOWS\system32\DRIVERS\eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.) [sYSTEM] eabfiltrService C:\WINDOWS\system32\DRIVERS\eabusb.sys (QLB USB Keyboard filter driver/Hewlett-Packard Development Company, L.P.) [MANUAL] eabusbService C:\WINDOWS\system32\DRIVERS\cpqbttn.sys (HP Tablet PC Key Button HID Driver/Hewlett-Packard Development Company, L.P.) [MANUAL] HBtnKeyService C:\WINDOWS\system32\drivers\CHDAud.sys (High Definition Audio Function Driver/Conexant Systems Inc.) [MANUAL] HdAudAddServiceService C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (High Definition Audio Bus Driver v1.0a/Windows ® Server 2003 DDK provider) [MANUAL] HDAudBusService C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (hpqwmiex Module/Hewlett-Packard Development Company, L.P.) [AUTO] hpqwmiexService C:\WINDOWS\system32\DRIVERS\HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) [MANUAL] HPZid412Service C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) [MANUAL] HPZipr12Service C:\WINDOWS\system32\DRIVERS\HPZius12.sys (1284.4<->Usb Datalink Driver (Windows 2000)/HP) [MANUAL] HPZius12Service C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys (HSF_HWAZL WDM driver/Conexant Systems, Inc.) [MANUAL] HSFHWAZLService C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys (HSF_DP driver/Conexant Systems, Inc.) [MANUAL] HSF_DPVService C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Matrix Storage Manager driver/Intel Corporation) [DISABLED] iaStorService C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (IDriverT Module/Macrovision Corporation) [MANUAL] IDriverTService C:\Program Files\Java\jre6\bin\jqs.exe (Java Quick Starter Service/Sun Microsystems, Inc.) [AUTO] JavaQuickStarterServiceService C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) [AUTO] LightScribeServiceService C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Anti-Malware/Malwarebytes Corporation) [MANUAL] MBAMProtectorService C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Anti-Malware/Malwarebytes Corporation) [AUTO] MBAMServiceService c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe (SiteAdvisor/McAfee, Inc.) [AUTO] McAfee SiteAdvisor ServiceService C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys (Diagnostic Interface x86 Driver/Conexant) [AUTO] mdmxsdkService C:\DOCUME~1\Jeff\LOCALS~1\Temp\MOBCleanup.exe [AUTO] MOBCleanupService C:\WINDOWS\system32\DRIVERS\mraid35x.sys (MegaRAID RAID Controller Driver for Windows Whistler 32/American Megatrends Inc.) [DISABLED] mraid35xService MSDTC Bridge 3.0.0.0Service C:\WINDOWS\system32\mqtgsvc.exe (Windows NT MSMQ Trigger Service/Microsoft Corporation) [AUTO] MSMQTriggersService C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Compatible Windows 2000 Miniport Driver, Version 86.19 /NVIDIA Corporation) [MANUAL] nvService C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA® nForce IDE Performance Driver/NVIDIA Corporation) [bOOT] nvataService C:\WINDOWS\system32\DRIVERS\NVENETFD.sys (NVIDIA Networking Function Driver./NVIDIA Corporation) [MANUAL] NVENETFDService C:\WINDOWS\system32\DRIVERS\nvnetbus.sys (NVIDIA Networking Bus Driver./NVIDIA Corporation) [MANUAL] nvnetbusService C:\WINDOWS\system32\DRIVERS\nvsmu.sys (NVIDIA® nForce SMU Microcontroller Driver/NVIDIA Corporation) [MANUAL] nvsmuService C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Driver Helper Service, Version 86.19/NVIDIA Corporation) [AUTO] NVSvcService C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] PtilinkService C:\WINDOWS\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [bOOT] PxHelp20Service C:\WINDOWS\system32\DRIVERS\ql1080.sys (Miniport Driver for QLogic ISP PCI Adapters/QLogic Corporation) [DISABLED] ql1080Service C:\WINDOWS\system32\DRIVERS\ql12160.sys (Miniport Driver for QLogic ISP PCI Adapters/QLogic Corporation) [DISABLED] ql12160Service C:\WINDOWS\system32\DRIVERS\ql1280.sys (Miniport Driver for QLogic ISP PCI Adapters/QLogic Corporation) [DISABLED] ql1280Service C:\WINDOWS\system32\DRIVERS\rimmptsk.sys (RICOH MMC Driver/REDC) [MANUAL] rimmptskService C:\WINDOWS\system32\DRIVERS\rimsptsk.sys (RICOH MS Driver/REDC) [MANUAL] rimsptskService C:\WINDOWS\system32\DRIVERS\rixdptsk.sys (RICOH XD SM Driver/REDC) [MANUAL] rismxdpService C:\WINDOWS\system32\DRIVERS\RTL8139.SYS (Realtek RTL8139 NDIS 5.0 Driver/Realtek Semiconductor Corporation) [MANUAL] rtl8139Service C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys (PC-SC CCID Driver for SCR3xx USB Smart Card Reader/SCM Microsystems Inc.) [MANUAL] SCR3XX2KService C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] SecdrvService ServiceModelEndpoint 3.0.0.0Service ServiceModelOperation 3.0.0.0Service ServiceModelService 3.0.0.0Service C:\WINDOWS\system32\DRIVERS\sisagp.sys (SiS NT AGP Filter/Silicon Integrated Systems Corporation) [DISABLED] sisagpService SMSvcHost 3.0.0.0Service C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec AIC-6x60 series SCSI miniport/Adaptec, Inc.) [DISABLED] SparrowService C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (AVIRA SnapShot Driver/Avira GmbH) [sYSTEM] ssmdrvService C:\WINDOWS\system32\DRIVERS\StreamIP.sys (Microsoft IP Test Driver/Microsoft Corporation) [MANUAL] streamipService C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc. SCSI Miniport Driver/Symbios Logic Inc.) [DISABLED] symc810Service C:\WINDOWS\system32\DRIVERS\symc8xx.sys (Symbios 8XX SCSI Miniport Driver/LSI Logic) [DISABLED] symc8xxService C:\WINDOWS\system32\DRIVERS\sym_hi.sys (Symbios Hi-Perf SCSI Miniport Driver/LSI Logic) [DISABLED] sym_hiService C:\WINDOWS\system32\DRIVERS\sym_u3.sys (Symbios Ultra3 SCSI Miniport Driver/LSI Logic) [DISABLED] sym_u3Service C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) [MANUAL] SynTPService C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (Windows Service for TomTom HOME/TomTom) [AUTO] TomTomHOMEServiceService system32\DRIVERS\UIUSYS.SYS [MANUAL] UIUSysService C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Ultra66 Miniport Driver/Promise Technology, Inc.) [DISABLED] ultraService C:\WINDOWS\System32\Drivers\usbvm326.sys (Vc0326 Video Driver For Serome/Vimicro Corporation) [MANUAL] usbvm328Service C:\WINDOWS\system32\DRIVERS\viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) [bOOT] ViaIdeService C:\WINDOWS\system32\drivers\vmfilter323.sys (VC326, Serome, 640* 480, all format/Vimicro Corporation) [MANUAL] vmfilter323Service C:\Program Files\Vongo\VongoService.exe (Vongo Download Manager/Starz Entertainment Group LLC) [AUTO] Vongo ServiceService C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys (HSF_CNXT driver/Conexant Systems, Inc.) [MANUAL] winachsfService Windows Workflow Foundation 3.0.0.0---- EOF - GMER 1.0.15 ----new GMER scan log Link to post Share on other sites More sharing options...
Jintan Posted May 18, 2012 ID:552731 Share Posted May 18, 2012 Some remnant services we need to remove, but just no ID elsewise. Is that a free version of AntiVir, that you can uninstall to help clear up what Gmer shows? I am not familiar with it's current product enough to spot what part of the scan chatter belongs to it, or even if it now protects the MBR in some way. If so, do the following, then uninstall AntiVir, reboot and run a regular Gmer scan again.If you haven't yet, go ahead and uninstall Vongo, which is no longer an active program.Go to Start - Run, type cmd (and OK). Copy/paste each of the following at the prompt, Enter after each:sc delete 0062421329956074mcinstcleanupsc delete MOBCleanupType exit and press Enter to close the command window. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 19, 2012 Author ID:552779 Share Posted May 19, 2012 15.15641 - http://www.gmer.netRootkit scan 2012-05-18 17:58:36Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\0000007b ST9100824AS rev.7.24Running: zizmd605.exe; Driver: C:\DOCUME~1\Jeff\LOCALS~1\Temp\pxtdypob.sys---- Devices - GMER 1.0.15 ----AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)Device \FileSystem\Cdfs \Cdfs F6639400---- EOF - GMER 1.0.15 ---- Link to post Share on other sites More sharing options...
Jintan Posted May 19, 2012 ID:552782 Share Posted May 19, 2012 We have been hunting an AntiVir chimera? I will have to install a copy and verify all that myself. Please do not reinstall any other security software until we complete our tasks here.Go here and download Mischel's MBR Backup to your desktop, then click MBRBackup.exe to start the utility.Click Save MBR, and save that file to location you can easily return to later. Then close MBR Backup.Zip a copy and email that saved to me as an attachment please.The file is always prenamed MBR_year_month_day.bin. MBR_2011_05_27.bin for example.--------------Open and update Malwarebytes. * If an update is found, it will download and install the latest version. * Once the program has loaded, select "Perform quick scan", then click Scan. * The scan may take some time to finish,so please be patient. * When the scan is complete, click OK, then Show Results to view the results. * Make sure that everything is checked, and click Remove Selected. * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. * The log is automatically saved by Malwarebytes and can be viewed by clicking the Logs tab in Malwarebytes. * Copy and Paste the entire report in your next reply. If it calls for a reboot to complete the repairs do that as well then.---------------Disable your antivirus program and click here and download the esetsmartinstaller_enu.exe Eset installer. Then click that file to run the scanner.If you accept the Terms of Use, check the box and click Start. It will take a couple minutes for the scanner to get ready. When the Computer scan settings display shows, check the following boxes:Remove found threatsScan unwanted applicationsNext to "Current scan targets: Operating memory, Local drives", click the "Change" word. Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CD-Rom drives).Then click the Advanced option, the place a check next to the following (if it is not already checked):Enable Anti-Stealth technologyClick Start. This scan may take a while, so please be patient.If infection is found, at the end of the scan click "List of found threats".In that display, at the bottom, select the option to save the results as a text file, and save that to your desktop. Post that back here please.Post that log and the Malwarebytes log please. Link to post Share on other sites More sharing options...
brightjoy2 Posted May 20, 2012 Author ID:553025 Share Posted May 20, 2012 2012/05/19 19:27:28 -0800 STOLL MESSAGE Starting protection2012/05/19 19:27:36 -0800 STOLL MESSAGE Protection started successfully2012/05/19 19:27:39 -0800 STOLL MESSAGE Executing scheduled update: Daily2012/05/19 19:27:39 -0800 STOLL MESSAGE Starting IP protection2012/05/19 19:27:56 -0800 STOLL MESSAGE Scheduled update executed successfully: database updated from version v2012.05.18.08 to version v2012.05.20.012012/05/19 19:29:16 -0800 STOLL Jeff MESSAGE IP Protection started successfully2012/05/19 19:29:16 -0800 STOLL Jeff MESSAGE Starting database refresh2012/05/19 19:29:16 -0800 STOLL Jeff MESSAGE Stopping IP protection2012/05/19 19:29:17 -0800 STOLL Jeff MESSAGE IP Protection stopped2012/05/19 19:29:27 -0800 STOLL Jeff MESSAGE Database refreshed successfully2012/05/19 19:29:27 -0800 STOLL Jeff MESSAGE Starting IP protection2012/05/19 19:29:37 -0800 STOLL Jeff MESSAGE IP Protection started successfully2012/05/19 20:29:32 -0800 STOLL Jeff MESSAGE Executing scheduled update: Daily2012/05/19 20:29:34 -0800 STOLL Jeff MESSAGE Database already up-to-dateThe Eset scan came out clean with no threats, there wasn't a log that I can copy like a list of threats. And the Malware report is also clean. Link to post Share on other sites More sharing options...
Jintan Posted May 21, 2012 ID:553175 Share Posted May 21, 2012 System looks clean, and also looks like what we were seeking as hidden malware was actually AntiVir activities. How is everything running now please? Link to post Share on other sites More sharing options...
brightjoy2 Posted May 21, 2012 Author ID:553213 Share Posted May 21, 2012 It seems like it is all good to go. Got to reset a anti-virus program back though, should I go back to the Avira Anti-virus?. Do I do anything about those hidden files that I had to uncover, or just leave them as it is? I suppose the rest of those text files can go too? I really need to clean it up, having too much junk stored in there instead of my external hard disk. Thanks alot for all the efforts and time taken. I really appreciate that you took all the time and patience. Thanks Link to post Share on other sites More sharing options...
Recommended Posts