Infected by 'Department of Justice' theftware

ctedholm · May 3, 2013

I have been infected by the 'Department of Justice' malware locking up my computer and demanding money to unlock it. Apparently this is a varient of similar infections purporting to be from the FBI, DHS etc. Cannot start in any Safe Mode. I have only a short time between bootup and the point where the virus takes over. I can get to Chameleon, but there is not enough time to check for updates before the virus takes over. Any suggestions?

MrCharlie · May 3, 2013

Welcome to the forum, what operating system do you have??

MrC

ctedholm · May 4, 2013

win xp sp3

MrCharlie · May 4, 2013

The best way to deal with this infection on XP is by creating an OTLPE disk, scan the system with it and post the log as outlined in the link below:

http://forums.malwar...ndpost&p=627789

Let me know....... MrC

ctedholm · May 4, 2013

OTL asks to "browse for folder." Which one?

ctedholm · May 4, 2013

Never mind....

ctedholm · May 4, 2013

OTL logfile created on: 5/4/2013 6:55:43 PM - Run

OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE

Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free

Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 298.09 Gb Total Space | 93.11 Gb Free Space | 31.23% Space Free | Partition Type: NTFS

Drive E: | 0.27 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Drive F: | 1.91 Gb Total Space | 1.66 Gb Free Space | 87.16% Space Free | Partition Type: FAT32

Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet006

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand] -- -- (AppMgmt)

SRV - [2013/04/22 09:48:38 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013/03/13 09:27:14 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013/03/12 15:58:50 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)

SRV - [2012/11/01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) [Auto] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)

SRV - [2012/10/31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) [Auto] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)

SRV - [2012/10/31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) [On_Demand] -- C:\Program Files\Spyware Doctor\TFEngine\TFService.exe -- (ThreatFire)

SRV - [2012/10/23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)

SRV - [2012/10/22 00:41:22 | 004,653,128 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto] -- C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe -- (CarboniteService)

SRV - [2012/08/03 17:22:18 | 000,352,248 | ---- | M] (Verizon) [Auto] -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe -- (IHA_MessageCenter)

SRV - [2012/07/03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)

SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)

SRV - [2011/12/09 15:39:52 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand] -- C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2006/11/13 14:02:08 | 000,076,544 | ---- | M] (ArcSoft, Inc.) [Auto] -- C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe -- (MgiSvr)

SRV - [2001/08/17 18:36:54 | 000,086,016 | ---- | M] (PCtel, Inc.) [Auto] -- C:\WINDOWS\system32\pctspk.exe -- (Pctspk)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)

DRV - File not found [Kernel | System] -- -- (PCIDump)

DRV - File not found [Kernel | System] -- -- (lbrtfdc)

DRV - File not found [Kernel | System] -- -- (i2omgmt)

DRV - File not found [Kernel | On_Demand] -- -- (cpuz135)

DRV - File not found [Kernel | System] -- -- (Changer)

DRV - File not found [Kernel | On_Demand] -- -- (.netbt)

DRV - [2013/05/03 18:19:09 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2013/05/03 18:16:01 | 000,035,144 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon)

DRV - [2013/02/01 09:45:44 | 000,046,624 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiBus.sys -- (SaiNtBus)

DRV - [2013/02/01 09:45:44 | 000,023,200 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiMini.sys -- (SaiMini)

DRV - [2012/11/01 15:35:20 | 000,068,272 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pctplsm.sys -- (pctplsm)

DRV - [2012/11/01 15:35:18 | 000,071,752 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pctplsg.sys -- (pctplsg)

DRV - [2012/11/01 15:35:14 | 000,202,280 | ---- | M] (PC Tools) [Kernel | System] -- C:\WINDOWS\system32\drivers\PCTSD.sys -- (PCTSD)

DRV - [2012/10/31 14:21:28 | 000,260,760 | ---- | M] (PC Tools) [Kernel | System] -- C:\WINDOWS\system32\drivers\pctgntdi.sys -- (pctgntdi)

DRV - [2012/10/31 09:19:50 | 000,577,176 | --S- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\TfSysMon.sys -- (TFSysMon)

DRV - [2012/10/31 09:19:48 | 000,055,008 | --S- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\TfFsMon.sys -- (TfFsMon)

DRV - [2012/10/31 09:19:48 | 000,036,456 | --S- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\TfNetMon.sys -- (TfNetMon)

DRV - [2012/10/23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PCTBD.sys -- (PCTBD)

DRV - [2012/10/22 16:38:28 | 000,368,616 | ---- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)

DRV - [2012/02/28 11:43:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot] -- C:\WINDOWS\system32\drivers\pctEFA.sys -- (pctEFA)

DRV - [2012/02/28 11:43:00 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\pctDS.sys -- (pctDS)

DRV - [2008/11/25 04:37:50 | 004,952,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008/08/18 06:54:24 | 000,145,952 | R--- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)

DRV - [2008/07/31 23:36:26 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)

DRV - [2008/07/31 23:36:20 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)

DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2007/12/17 05:14:06 | 000,012,400 | R--- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)

DRV - [2007/07/02 15:08:08 | 000,015,616 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ArcSoftVirtualCapture.sys -- (ARCSOFTVIRTUALCAPTURE)

DRV - [2007/05/01 16:37:40 | 000,132,232 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiH0464.sys -- (SaiH0464)

DRV - [2007/04/16 16:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)

DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)

DRV - [2005/03/03 13:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)

DRV - [2005/02/23 11:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)

DRV - [2004/12/03 06:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)

DRV - [2004/08/14 14:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)

DRV - [2004/08/03 18:31:20 | 000,036,224 | ---- | M] (ADMtek Incorporated.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\an983.sys -- (AN983)

DRV - [2003/06/23 12:15:14 | 000,554,304 | ---- | M] (Voyetra Turtle Beach) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tbcwdm.sys -- (tbcwdm)

DRV - [2003/06/23 12:15:10 | 000,149,632 | ---- | M] (Voyetra Turtle Beach) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tbcspud.sys -- (tbcspud)

DRV - [2001/08/17 09:28:16 | 000,397,502 | ---- | M] (PCtel, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vpctcom.sys -- (Vpctcom)

DRV - [2001/08/17 09:28:16 | 000,064,605 | ---- | M] (PCtel, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vvoice.sys -- (Vvoice)

DRV - [2001/08/17 09:28:14 | 000,604,253 | ---- | M] (PCTEL, INC.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\vmodem.sys -- (Vmodem)

DRV - [2001/08/17 09:28:14 | 000,112,574 | ---- | M] (PCTEL, INC.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ptserlp.sys -- (Ptserlp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Chandler_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/

IE - HKU\Chandler_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\Chandler_ON_C\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

IE - HKU\Chandler_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Chandler_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Chandler\Application Data\Move Networks\plugins\npqmp071503000010.dll (Move Networks)

FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\Spyware Doctor\BDT\Firefox\ [2013/04/01 13:41:01 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/22 09:48:40 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/03/12 16:21:08 | 000,000,000 | ---D | M]

[2013/04/29 15:13:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions

[2013/03/22 22:52:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2013/03/08 01:00:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2013/03/08 01:00:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}

File not found (No name found) --

[2013/04/22 09:48:40 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012/09/01 12:55:55 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2013/03/22 22:52:28 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml

[2013/02/19 20:06:09 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

Hosts file not found

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {377e5d4d-77e5-476a-8716-7e70a9272da0} - File not found

O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKU\Chandler_ON_C\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O4 - HKLM..\Run: [Alcmtr] C:\windows\ALCMTR.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [ASUS Update Checker] C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe ()

O4 - HKLM..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe (Carbonite, Inc.)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [DisplaySwitch] C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe (Hilgraeve, Inc.)

O4 - HKLM..\Run: [iSTray] C:\Program Files\Spyware Doctor\pctsGui.exe (PC Tools)

O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [PCTools FGuard] File not found

O4 - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek)

O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)

O4 - HKLM..\Run: [saiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek)

O4 - HKLM..\Run: [sES_FE] C:\Storm Eagle Studios\SES_Form.exe (Storm Eagle Studios)

O4 - HKLM..\Run: [setDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)

O4 - HKLM..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe (Voyetra Turtle Beach, Inc.)

O4 - HKU\Chandler_ON_C..\Run: [CardScan AutoSync] File not found

O4 - HKU\Chandler_ON_C..\Run: [GameShadow] C:\Program Files\GameShadow\GameShadow.exe (GameShadow Ltd)

O4 - HKU\Chandler_ON_C..\Run: [steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Button Manager.lnk = C:\Program Files\HP\Button Manager\BM.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Magic-i.lnk = C:\Program Files\ArcSoft\Magic-i 3\Magic-i.exe (ArcSoft, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

O4 - Startup: C:\Documents and Settings\Chandler\Start Menu\Programs\Startup\Dropbox.lnk = File not found

O4 - Startup: C:\Documents and Settings\Chandler\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Chandler_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)

O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)

O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab (Windows Live Safety Center Base Module)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1246109643615 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Reg Error: Value error.)

O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)

O16 - DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Java Plug-in 1.6.0_38)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab (Java Plug-in 1.6.0_38)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\mgrldr.dll) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/26 20:13:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2011/02/22 04:21:56 | 000,042,400 | R--- | M] (magicJack L.P.) - E:\autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2011/02/22 04:21:56 | 000,016,158 | R--- | M] () - E:\autorun.ico -- [ CDFS ]

O32 - AutoRun File - [2011/02/22 04:21:56 | 000,000,308 | R--- | M] () - E:\autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\autorun.exe

O33 - MountPoints2\D\Shell\phone\command - "" = D:\autorun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\SH4Autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: AppMgmt - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: Sharedaccess - File not found

NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/03 10:52:44 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys

[2013/05/03 10:13:03 | 000,118,272 | ---- | C] (Hilgraeve, Inc.) -- C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe

[2013/04/29 15:13:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla

[2013/04/29 15:13:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Mozilla

[2013/04/29 13:50:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\Local Settings\Application Data\LogMeIn Rescue Applet

[2013/04/26 08:44:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\Application Data\Malwarebytes

[2013/04/26 08:43:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013/04/26 08:43:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2013/04/26 08:43:41 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2013/04/26 08:43:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013/04/15 11:34:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chandler\My Documents\personality_profile

[9 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

[6 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/03 18:19:09 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys

[2013/05/03 18:18:34 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2013/05/03 18:18:30 | 000,000,312 | -HS- | M] () -- C:\windows\tasks\vfbxrjfrel.job

[2013/05/03 18:18:29 | 000,001,374 | ---- | M] () -- C:\windows\System32\wpa.dbl

[2013/05/03 18:18:25 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat

[2013/05/03 18:18:09 | 001,131,455 | ---- | M] () -- C:\windows\System32\drivers\Cat.DB

[2013/05/03 18:16:01 | 000,035,144 | ---- | M] () -- C:\windows\System32\drivers\mbamchameleon.sys

[2013/05/03 17:28:04 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2013/05/03 17:27:44 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2013/05/03 17:12:42 | 1610,612,736 | ---- | M] () -- C:\windows\MEMORY.DMP

[2013/05/03 14:33:44 | 000,001,023 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\magicJack.lnk

[2013/05/03 10:23:36 | 002,250,054 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1.bmp

[2013/05/03 10:23:22 | 000,350,795 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\1.jpg

[2013/05/03 10:12:54 | 000,118,272 | ---- | M] (Hilgraeve, Inc.) -- C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe

[2013/05/02 09:36:11 | 000,000,441 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\xntimer.ini

[2013/05/02 08:21:38 | 000,002,479 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk

[2013/05/02 08:08:44 | 000,002,465 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk

[2013/05/01 18:26:03 | 000,000,284 | ---- | M] () -- C:\windows\tasks\AppleSoftwareUpdate.job

[2013/04/30 17:17:35 | 000,002,503 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Outlook.lnk

[2013/04/29 18:39:14 | 000,002,477 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk

[2013/04/26 08:43:44 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2013/04/26 08:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013/04/13 13:59:26 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup

[2013/04/12 12:49:46 | 000,716,659 | ---- | M] () -- C:\Documents and Settings\Chandler\Desktop\SDwA_history_20130412.htm

[2013/04/11 08:19:17 | 000,161,936 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2013/04/11 03:06:25 | 000,001,374 | ---- | M] () -- C:\windows\imsins.BAK

[2013/04/11 02:25:44 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

[2013/04/08 11:59:17 | 012,975,104 | ---- | M] () -- C:\Documents and Settings\Chandler\My Documents\Contacts.cdb

[9 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

[6 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/03 18:16:01 | 000,035,144 | ---- | C] () -- C:\windows\System32\drivers\mbamchameleon.sys

[2013/05/03 10:23:36 | 002,250,054 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.bmp

[2013/05/03 10:23:09 | 000,350,795 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.jpg

[2013/04/26 08:43:44 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2013/04/12 12:49:43 | 000,716,659 | ---- | C] () -- C:\Documents and Settings\Chandler\Desktop\SDwA_history_20130412.htm

[2013/02/28 21:03:42 | 000,086,760 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

[2012/10/14 12:32:52 | 000,000,852 | ---- | C] () -- C:\windows\MEDIAPAQ.INI

[2012/10/13 19:56:31 | 000,000,666 | ---- | C] () -- C:\windows\eReg.dat

[2012/08/13 10:57:00 | 000,012,927 | ---- | C] () -- C:\Program Files\readme.html

[2012/05/22 13:42:37 | 000,244,206 | ---- | C] () -- C:\Documents and Settings\Chandler\Application Data\fontlst2.opf

[2012/05/08 14:15:36 | 000,000,005 | ---- | C] () -- C:\Program Files\basis-link

[2012/03/13 14:27:02 | 000,000,385 | ---- | C] () -- C:\Documents and Settings\Chandler\Application Data\com.aflac.launchpad.desktop_state.xml

[2012/02/15 09:52:36 | 000,003,072 | ---- | C] () -- C:\windows\System32\iacenc.dll

[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\windows\System32\xlive.dll.cat

[2010/12/15 12:49:40 | 000,769,144 | ---- | C] () -- C:\windows\BDTSupport.dll

[2010/12/15 12:49:40 | 000,767,952 | ---- | C] () -- C:\windows\BDTSupport.dll0454.old

[2010/10/01 13:53:29 | 000,011,832 | ---- | C] () -- C:\windows\System32\drivers\AsInsHelp64.sys

[2010/10/01 13:53:29 | 000,010,216 | ---- | C] () -- C:\windows\System32\drivers\AsInsHelp32.sys

[2010/10/01 13:51:31 | 000,024,576 | R--- | C] () -- C:\windows\System32\AsIO.dll

[2010/10/01 13:51:31 | 000,012,400 | R--- | C] () -- C:\windows\System32\drivers\AsIO.sys

[2010/09/02 20:50:07 | 000,000,272 | ---- | C] () -- C:\windows\_delis32.ini

[2010/08/13 16:23:16 | 000,232,968 | ---- | C] () -- C:\windows\System32\nvdrsdb0.bin

[2010/08/13 16:23:06 | 000,232,968 | ---- | C] () -- C:\windows\System32\nvdrsdb1.bin

[2010/08/13 16:23:06 | 000,000,001 | ---- | C] () -- C:\windows\System32\nvdrssel.bin

[2010/08/13 15:56:52 | 000,000,000 | ---- | C] () -- C:\windows\nsreg.dat

[2010/07/21 11:01:45 | 000,000,256 | ---- | C] () -- C:\windows\System32\pool.bin

[2010/04/25 15:01:17 | 000,069,632 | R--- | C] () -- C:\windows\System32\xmltok.dll

[2010/04/25 15:01:17 | 000,036,864 | R--- | C] () -- C:\windows\System32\xmlparse.dll

[2010/03/31 13:58:23 | 000,000,165 | ---- | C] () -- C:\windows\QUICKEN.INI

[2010/01/11 14:24:07 | 000,060,304 | ---- | C] () -- C:\Documents and Settings\Chandler\g2mdlhlpx.exe

[2009/12/13 14:09:52 | 000,000,023 | ---- | C] () -- C:\windows\kodakpcd.Chandler.ini

[2009/12/03 14:16:37 | 000,763,832 | ---- | C] () -- C:\windows\BDTSupport.dll.old

[2009/10/26 09:56:33 | 000,176,235 | ---- | C] () -- C:\windows\System32\Primomonnt.dll

[2009/10/07 03:10:47 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\Chandler\Local Settings\Application Data\fusioncache.dat

[2009/10/04 20:26:57 | 000,000,000 | ---- | C] () -- C:\windows\PowerReg.dat

[2009/10/04 20:26:26 | 000,185,344 | ---- | C] () -- C:\windows\patchw32.dll

[2009/10/04 19:04:32 | 000,000,403 | ---- | C] () -- C:\windows\SIERRA.INI

[2009/10/03 19:05:26 | 000,004,984 | R--- | C] () -- C:\windows\System32\drivers\nvphy.bin

[2009/10/03 18:34:05 | 000,028,194 | ---- | C] () -- C:\windows\Ascd_log.ini

[2009/10/03 18:12:21 | 000,001,746 | ---- | C] () -- C:\windows\Language_trs.ini

[2009/10/03 18:11:27 | 000,005,810 | R--- | C] () -- C:\windows\System32\drivers\ASACPI.sys

[2009/10/03 18:11:04 | 000,023,629 | ---- | C] () -- C:\windows\Ascd_tmp.ini

[2009/10/03 18:11:03 | 000,010,296 | ---- | C] () -- C:\windows\System32\drivers\ASUSHWIO.SYS

[2009/09/15 21:33:26 | 000,018,790 | ---- | C] () -- C:\windows\System32\ddmon.dll

[2009/09/09 22:46:12 | 000,028,076 | -H-- | C] () -- C:\windows\System32\mlfcache.dat

[2009/07/30 21:58:42 | 000,000,314 | ---- | C] () -- C:\windows\primopdf.ini

[2009/07/23 16:36:17 | 000,000,056 | -H-- | C] () -- C:\windows\System32\ezsidmv.dat

[2009/07/12 15:16:11 | 000,093,696 | ---- | C] () -- C:\Documents and Settings\Chandler\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/06/27 19:32:44 | 000,043,520 | ---- | C] () -- C:\windows\System32\CmdLineExt03.dll

[2009/06/27 16:13:12 | 000,001,032 | ---- | C] () -- C:\windows\Brpfx04a.ini

[2009/06/27 16:13:12 | 000,000,154 | ---- | C] () -- C:\windows\brpcfx.ini

[2009/06/27 16:13:12 | 000,000,050 | ---- | C] () -- C:\windows\System32\bridf06a.dat

[2009/06/27 16:12:20 | 000,000,419 | ---- | C] () -- C:\windows\BRWMARK.INI

[2009/06/27 16:12:20 | 000,000,027 | ---- | C] () -- C:\windows\BRPP2KA.INI

[2009/06/27 16:10:58 | 000,106,496 | ---- | C] () -- C:\windows\System32\BrMuSNMP.dll

[2009/06/27 16:10:58 | 000,000,000 | ---- | C] () -- C:\windows\brdfxspd.dat

[2009/06/27 09:30:12 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI

[2009/06/26 20:27:45 | 000,000,664 | ---- | C] () -- C:\windows\System32\d3d9caps.dat

[2009/06/26 20:27:43 | 000,000,552 | ---- | C] () -- C:\windows\System32\d3d8caps.dat

[2009/06/26 20:16:20 | 000,002,048 | --S- | C] () -- C:\windows\bootstat.dat

[2009/06/26 20:09:42 | 000,022,720 | ---- | C] () -- C:\windows\System32\emptyregdb.dat

[2009/06/26 15:57:07 | 000,001,536 | ---- | C] () -- C:\windows\System32\TrueSoft.dat

[2009/06/26 15:57:03 | 000,000,456 | ---- | C] () -- C:\windows\System32\pthsp.dat

[2009/06/26 15:55:41 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI

[2009/06/26 15:52:39 | 000,161,936 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT

[2009/06/10 06:03:00 | 002,195,030 | ---- | C] () -- C:\windows\System32\nvdata.bin

[2007/05/01 16:37:40 | 001,970,176 | ---- | C] () -- C:\windows\System32\SaiC0464.Dll

[2007/05/01 16:37:40 | 000,008,704 | ---- | C] () -- C:\windows\System32\SaiC0464_0C.dll

[2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_10.dll

[2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_0A.dll

[2007/05/01 16:37:40 | 000,008,192 | ---- | C] () -- C:\windows\System32\SaiC0464_07.dll

[2007/05/01 16:37:40 | 000,007,680 | ---- | C] () -- C:\windows\System32\SaiC0464_09.dll

[2007/05/01 16:37:40 | 000,007,168 | ---- | C] () -- C:\windows\System32\SaiC0464_0402.dll

[2007/05/01 16:37:40 | 000,005,632 | ---- | C] () -- C:\windows\System32\SaiC0464_11.dll

[2004/08/04 08:00:00 | 013,107,200 | ---- | C] () -- C:\windows\System32\oembios.bin

[2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat

[2004/08/04 08:00:00 | 000,481,662 | ---- | C] () -- C:\windows\System32\perfh009.dat

[2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\windows\System32\perfi009.dat

[2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\windows\System32\dssec.dat

[2004/08/04 08:00:00 | 000,079,736 | ---- | C] () -- C:\windows\System32\perfc009.dat

[2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\windows\System32\mib.bin

[2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\windows\System32\perfd009.dat

[2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\windows\System32\secupd.dat

[2004/08/04 08:00:00 | 000,004,461 | ---- | C] () -- C:\windows\System32\oembios.dat

[2004/08/04 08:00:00 | 000,001,804 | ---- | C] () -- C:\windows\System32\dcache.bin

[2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\windows\System32\noise.dat

[2000/04/12 12:24:10 | 000,338,944 | ---- | C] () -- C:\windows\System32\LFFPX7.DLL

[1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- C:\windows\System32\MSRTEDIT.DLL

[1997/09/30 11:30:02 | 000,122,880 | ---- | C] () -- C:\windows\System32\LFKODAK.DLL

========== LOP Check ==========

[2012/05/22 13:37:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\CardScan

[2011/08/29 11:38:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.Aflac.STD-ppt-app.59F69CBCBA7543A463CE554A7CC7279B8744C226.1

[2010/05/04 21:49:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.example.main.52A93B964BBEB0902CC01E05810570B8BA16AEC8.1

[2009/06/27 11:48:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2012/01/03 17:20:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.aflac.launchpad.desktop

[2009/12/08 16:44:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\com.cbs.himym.desktop.E9E67C1457924EABBA27327D1BAF79E9B78ADD40.1

[2009/09/15 21:38:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\deskPDF

[2009/10/19 15:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\DMS

[2012/07/27 21:18:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Downloaded Installations

[2013/05/03 18:17:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Dropbox

[2010/02/07 11:40:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Facebook

[2012/05/11 15:07:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Firefly Studios

[2012/08/02 18:33:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Garmin

[2011/12/09 21:35:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\GetRightToGo

[2012/09/30 19:15:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hemera

[2012/06/25 21:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\HexWar Launcher

[2013/01/26 23:07:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hoyle

[2011/01/22 09:34:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Hoyle FaceCreator

[2010/07/28 23:59:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ieSpell

[2013/03/22 22:54:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ilividtoolbargaw

[2010/09/02 20:50:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\InterTrust

[2009/06/27 19:10:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Leadertech

[2013/05/03 15:11:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\mjusbsp

[2009/06/27 10:53:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\OfficeUpdate12

[2010/07/21 13:19:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\OpenOffice.org

[2012/10/25 15:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\PC-FAX TX

[2011/06/02 12:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\PrimoPDF

[2011/05/17 17:58:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\Research In Motion

[2012/11/17 17:06:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\TechWizard

[2012/12/13 09:24:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\TestApp

[2011/05/27 19:42:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\The Creative Assembly

[2009/10/04 20:26:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\ubi.com

[2011/11/04 11:45:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chandler\Application Data\webex

[2012/10/27 17:13:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1

[2010/05/03 15:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications

[2009/10/02 17:42:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Carbonite

[2013/03/22 22:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Datamngr

[2011/01/22 09:20:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Encore

[2012/05/11 15:05:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Firefly Studios

[2012/07/08 16:21:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\magicJack

[2011/02/27 16:58:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Saitek

[2013/02/27 19:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartTechnology

[2013/05/03 18:21:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/04/01 15:57:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2009/09/09 22:17:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2013/05/03 18:18:30 | 000,000,312 | -HS- | M] () -- C:\windows\Tasks\vfbxrjfrel.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2009/06/26 20:13:15 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2009/06/26 20:13:15 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt

[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt

[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt

[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini

[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini

[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll

[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll

[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll

[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll

[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll

[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll

[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll

[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll

[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll

[2009/06/26 20:13:15 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2011/12/20 23:18:42 | 000,002,152 | ---- | M] () -- C:\log.txt

[2009/06/26 20:13:15 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2009/06/26 21:36:44 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2013/05/03 18:18:17 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys

[2013/04/19 12:46:44 | 000,109,068 | ---- | M] () -- C:\Spec.log

[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp

[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab

[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI

[1 C:\*.tmp files -> C:\*.tmp -> ]

< MD5 for: EXPLORER.EXE >

[2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe

[2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

[2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SERVICES.EXE >

[2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe

[2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe

[2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe

[2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\$NtServicePackUninstall$\services.exe

[2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe

[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe

[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe

[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe

[2004/08/04 08:00:00 | 000,108,032 | ---- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtUninstallKB956572_0$\services.exe

< MD5 for: USERINIT.EXE >

[2004/08/04 08:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

[2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >

[2004/08/04 08:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 142 bytes -> C:\windows\system32:,

MrCharlie · May 4, 2013

OK, basically what we want to do is copy the text that's in BOLD into the Custom Scans/Fixes box of OTLPE;

Here's how to do that:

Copy the text in BOLD into notepad and save it:

:OTL

O4 - HKLM..\Run: [DisplaySwitch] C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe (Hilgraeve, Inc.)

[2013/05/03 10:13:03 | 000,118,272 | ---- | C] (Hilgraeve, Inc.) -- C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe

[2013/05/03 18:18:30 | 000,000,312 | -HS- | M] () -- C:\windows\tasks\vfbxrjfrel.job

[2013/05/03 10:23:36 | 002,250,054 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.bmp

[2013/05/03 10:23:09 | 000,350,795 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\1.jpg

Copy it to your flash drive

Boot the computer up using the OTLPE disk

Run OTLPE

Plug in the flash drive

Drag the notepad text to the desktop

Open it up and copy and paste the text into Custom Scans/Fixes

Then click the Run Fix button at the top

Copy and paste the log back here.

See if the computer boots up normally now.......MrC

ctedholm · May 5, 2013

I had a hard time getting REATOGO to recognize my flash drive; now for some reason it has stopped recognizing my USB mouse, so I am unable to do anything. Any ideas?

MrCharlie · May 5, 2013

Are they USB?? MrC

ctedholm · May 5, 2013

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DisplaySwitch deleted successfully.

C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe moved successfully.

File C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe not found.

C:\windows\tasks\vfbxrjfrel.job moved successfully.

C:\Documents and Settings\All Users\Application Data\1.bmp moved successfully.

C:\Documents and Settings\All Users\Application Data\1.jpg moved successfully.

OTLPE by OldTimer - Version 3.1.48.0 log created on 05052013_192008

Seems to have worked. Running full scan now.

MrCharlie · May 5, 2013

OK, let me know....MrC

ctedholm · May 5, 2013

Ran full scan, found three Trojans. I don't know if they are related to the previous problem.

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2013.05.05.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Chandler :: DADSDESKTOP [administrator]

5/5/2013 9:32:44 AM

mbam-log-2013-05-05 (09-32-44).txt

Scan type: Full scan (C:\|)

Scan options disabled: P2P

Objects scanned: 547117

Time elapsed: 3 hour(s), 6 minute(s), 39 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 2

HKCR\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32| (Trojan.0Access) -> Bad: (C:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643\n.) Good: (fastprox.dll) -> Quarantined and repaired successfully.

HKCR\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InProcServer32| (Trojan.0Access) -> Bad: (C:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643\n.) Good: (shell32.dll) -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\_OTL\MovedFiles\05052013_192008\C_Documents and Settings\All Users\Application Data\DisplaySwitch.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

(end)

MrCharlie · May 5, 2013

Yes they are related, we better run a couple of more scans...first:

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

ctedholm · May 5, 2013

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Chandler [Admin rights]

Mode : Scan -- Date : 05/05/2013 18:57:00

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[RUN][sUSP PATH] HKLM\[...]\Run : DisplaySwitch ("C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe") [x] -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] $NtUninstallKB16146$ : C:\windows\$NtUninstallKB16146$ --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[41] : NtCreateKey @ 0x8062423A -> HOOKED (TfSysMon.sys @ 0xB7C96AC0)

SSDT[63] : NtDeleteKey @ 0x806246D6 -> HOOKED (TfSysMon.sys @ 0xB7C96D30)

SSDT[65] : NtDeleteValueKey @ 0x806248A6 -> HOOKED (TfSysMon.sys @ 0xB7C96DF0)

SSDT[119] : NtOpenKey @ 0x80625618 -> HOOKED (TfSysMon.sys @ 0xB7C96960)

SSDT[247] : NtSetValueKey @ 0x806227AC -> HOOKED (TfSysMon.sys @ 0xB7C96FF0)

SSDT[257] : NtTerminateProcess @ 0x805D22D8 -> HOOKED (TfSysMon.sys @ 0xB7C98DC0)

IRP[iRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync02.sys @ 0xB8338D60)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] e4d9088a73b6ca864ec406730b65ec8d

[bSP] e8d3345e88d1f34c7f01f4793eb9302e : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05052013_02d1857.txt >>

RKreport[1]_S_05052013_02d1857.txt

MrCharlie · May 5, 2013

OK, there's evidence of a backdoor trojan (ZeroAccess) being on the system.

Keep an eye on all your sensitive accounts and change all you passwords when we are done.

------------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKLM\[...]\Run : DisplaySwitch ("C:\Documents and Settings\All Users\Application Data\DisplaySwitch.exe") [x] -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Files tab and put a check next to these and uncheck the rest. (if found)

[ZeroAccess][FOLDER] $NtUninstallKB16146$ : C:\windows\$NtUninstallKB16146$ --> FOUND

Now click Delete on the right hand column under Options

-------------

Next...........

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

ctedholm · May 5, 2013

RK is either very fragile or something is messing with it. As soon as I try to uncheck the non-bad object found under Registry (or do much of anything else) it becomes unresponsive and does not allow the deletion of the SUSP PATH.

MrCharlie · May 5, 2013

OK, don't worry about it, just continue on and run MBAR......MrC

ctedholm · May 6, 2013

RK finds two registry objects. If I just hit Delete after Scan with both Registry objects checked, nothing happens, although RK does not become unresponsive.

ctedholm · May 6, 2013

My mistake, it does become unresponsive after a period of time.

MrCharlie · May 6, 2013

OK, don't worry about it, just continue on and run MBAR......MrC

ctedholm · May 6, 2013

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

www.malwarebytes.org

Database version: v2013.05.06.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Chandler :: DADSDESKTOP [administrator]

5/6/2013 8:04:12 AM

mbar-log-2013-05-06 (08-04-12).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 30668

Time elapsed: 43 minute(s), 44 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.

Registry Values Detected: 1

HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD|CDBurn (Hijack.Trojan.Siredef.C) -> Data: {fbeb8a05-beee-4442-804e-409d6c4515e9} -> Delete on reboot.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 6

c:\windows\$ntuninstallkb16146$\2154086262 (Backdoor.0Access) -> Delete on reboot.

c:\windows\$ntuninstallkb16146$\2154086262\l (Backdoor.0Access) -> Delete on reboot.

c:\windows\$ntuninstallkb16146$\2154086262\u (Backdoor.0Access) -> Delete on reboot.

c:\windows\$ntuninstallkb16146$\2348843808 (Backdoor.0Access) -> Delete on reboot.

c:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643 (Trojan.Siredef.C) -> Delete on reboot.

c:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643 (Trojan.Siredef.C) -> Delete on reboot.

Files Detected: 0

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

www.malwarebytes.org

Database version: v2013.05.06.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Chandler :: DADSDESKTOP [administrator]

5/6/2013 9:16:05 AM

mbar-log-2013-05-06 (09-16-05).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 30616

Time elapsed: 48 minute(s), 59 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_38

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 2.712000 GHz

Memory total: 3220402176, free: 2164887552

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_38

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 2.712000 GHz

Memory total: 3220402176, free: 2185445376

------------ Kernel report ------------

05/06/2013 07:19:56

------------ Loaded modules -----------

\windows\system32\ntkrnlpa.exe

\windows\system32\hal.dll

\windows\system32\KDCOM.DLL

\windows\system32\BOOTVID.dll

fltmgr.sys

ACPI.sys

\windows\system32\DRIVERS\WMILIB.SYS

pci.sys

isapnp.sys

pciide.sys

\windows\system32\DRIVERS\PCIIDEX.SYS

viaide.sys

MountMgr.sys

ftdisk.sys

PartMgr.sys

sfsync02.sys

VolSnap.sys

atapi.sys

nvgts.sys

\windows\system32\DRIVERS\SCSIPORT.SYS

disk.sys

\windows\system32\DRIVERS\CLASSPNP.SYS

sr.sys

PCTCore.sys

pctDS.sys

pctEFA.sys

TfFsMon.sys

TfSysMon.sys

KSecDD.sys

Ntfs.sys

NDIS.sys

vvoice.sys

vpctcom.sys

vmodem.sys

viaagp.sys

sfhlp02.sys

sfdrv01.sys

Mup.sys

\SystemRoot\system32\DRIVERS\AmdPPM.sys

\SystemRoot\system32\DRIVERS\ASACPI.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\DRIVERS\usbohci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\imapi.sys

\SystemRoot\system32\drivers\Afc.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\DRIVERS\redbook.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\nvnetbus.sys

\SystemRoot\system32\DRIVERS\NVNRM.SYS

\SystemRoot\system32\DRIVERS\nv4_mini.sys

\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

\SystemRoot\system32\DRIVERS\ArcSoftVirtualCapture.sys

\SystemRoot\system32\DRIVERS\STREAM.SYS

\SystemRoot\system32\DRIVERS\serscan.sys

\SystemRoot\system32\DRIVERS\audstub.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\psched.sys

\SystemRoot\system32\DRIVERS\msgpc.sys

\SystemRoot\system32\DRIVERS\ptilink.sys

\SystemRoot\system32\DRIVERS\raspti.sys

\SystemRoot\system32\drivers\SaiBus.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\update.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\DRIVERS\SaiMini.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\NVENETFD.sys

\SystemRoot\system32\drivers\RtkHDAud.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\System32\Drivers\Fs_Rec.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\Drivers\mnmdd.SYS

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\rasacd.sys

\SystemRoot\system32\DRIVERS\ipsec.sys

\SystemRoot\system32\DRIVERS\tcpip.sys

\??\C:\WINDOWS\system32\drivers\pctgntdi.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\netbt.sys

\SystemRoot\System32\drivers\ws2ifsl.sys

\SystemRoot\System32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\System32\Drivers\PCTSD.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\System32\Drivers\Fips.SYS

\SystemRoot\system32\drivers\AsIO.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\usbprint.sys

\SystemRoot\system32\DRIVERS\BrScnUsb.sys

\SystemRoot\System32\Drivers\BrUsbSer.sys

\SystemRoot\System32\Drivers\BrSerIf.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\System32\Drivers\Cdfs.SYS

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_WMILIB.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\watchdog.sys

\SystemRoot\System32\drivers\dxg.sys

\SystemRoot\System32\drivers\dxgthk.sys

\SystemRoot\System32\nv4_disp.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\drivers\wdmaud.sys

\SystemRoot\system32\drivers\sysaudio.sys

\SystemRoot\system32\DRIVERS\mrxdav.sys

\SystemRoot\system32\DRIVERS\srv.sys

\??\C:\WINDOWS\system32\drivers\pctplsg.sys

\??\C:\WINDOWS\system32\drivers\pctplsm.sys

\SystemRoot\System32\Drivers\HTTP.sys

\SystemRoot\System32\Drivers\PCTBD.sys

\??\C:\windows\system32\drivers\TfNetMon.sys

\SystemRoot\system32\drivers\kmixer.sys

\??\C:\windows\system32\drivers\mbamchameleon.sys

\??\C:\windows\system32\drivers\mbamswissarmy.sys

\WINDOWS\system32\ntdll.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR2

Upper Device Object: 0xffffffff89ce6030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000081\

Lower Device Object: 0xffffffff8a77b7e0

Lower Device Driver Name: \Driver\usbstor\

Driver name found: usbstor

Initialization returned 0x0

Load Function returned 0x0

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8b66a030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\

Lower Device Object: 0xffffffff8b645d98

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

Initialization returned 0x0

Load Function returned 0x0

Downloaded database version: v2013.05.06.04

Downloaded database version: v2013.05.01.01

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8b66a030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8b624830, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff8b66a030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8b6d52d8, DeviceName: Unknown, DriverName: \Driver\PCTCore\

DevicePointer: 0xffffffff8b629f18, DeviceName: \Device\0000006e\, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff8b645d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xffffffffe1238aa0, 0xffffffff8b66a030, 0xffffffff87b27ab8

Lower DeviceData: 0xffffffffe6751818, 0xffffffff8b645d98, 0xffffffff87f06c98

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 2AD21C

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 625137282

Partition file system is NTFS

Partition is bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xffffffff89ce6030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8a2ca748, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff89ce6030, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8a055790, DeviceName: Unknown, DriverName: \Driver\PCTCore\

DevicePointer: 0xffffffff8a77b7e0, DeviceName: \Device\00000081\, DriverName: \Driver\usbstor\

------------ End ----------

Done!

Performing system, memory and registry scan...

Read File: File "c:\WINDOWS\$NtUninstallKB950762_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB950974$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB951066_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB951376-v2$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB951978$\updatebr.inf" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB952287_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB952954$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB954600_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB955069_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB956802_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB956803$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB956844_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB957097_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB958644_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB958687_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB960225$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB960803_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB961501_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB967715_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB968537_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB971557$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB971633_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB971657$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB973354_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB973507_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB973815_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB973869_0$\update.ver" is compressed (flags = 1)

Read File: File "c:\WINDOWS\$NtUninstallKB946648$\update.ver" is compressed (flags = 1)

Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLSERVICEOBJECTDELAYLOAD|CDBurn --> [Hijack.Trojan.Siredef.C]

Infected: c:\windows\$ntuninstallkb16146$\2154086262 --> [backdoor.0Access]

Infected: c:\windows\$ntuninstallkb16146$\2154086262\l --> [backdoor.0Access]

Infected: c:\windows\$ntuninstallkb16146$\2154086262\u --> [backdoor.0Access]

Infected: c:\windows\$ntuninstallkb16146$\2348843808 --> [backdoor.0Access]

Infected: c:\RECYCLER\S-1-5-18\$e8564fd87fd24d195cad3d6620221643 --> [Trojan.Siredef.C]

Infected: c:\RECYCLER\S-1-5-21-1409082233-920026266-1060284298-1004\$e8564fd87fd24d195cad3d6620221643 --> [Trojan.Siredef.C]

Done!

Scan finished

Creating System Restore point...

Scheduling clean up...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Executing an action fixdamage.exe...

Success!

Removal successful. No system shutdown is required.

=======================================

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_38

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 2.712000 GHz

Memory total: 3220402176, free: 2351595520

------------ Kernel report ------------

05/06/2013 08:25:48

------------ Loaded modules -----------

\windows\system32\ntkrnlpa.exe

\windows\system32\hal.dll

\windows\system32\KDCOM.DLL

\windows\system32\BOOTVID.dll

fltmgr.sys

ACPI.sys

\windows\system32\DRIVERS\WMILIB.SYS

pci.sys

isapnp.sys

pciide.sys

\windows\system32\DRIVERS\PCIIDEX.SYS

viaide.sys

MountMgr.sys

ftdisk.sys

PartMgr.sys

sfsync02.sys

VolSnap.sys

atapi.sys

nvgts.sys

\windows\system32\DRIVERS\SCSIPORT.SYS

disk.sys

\windows\system32\DRIVERS\CLASSPNP.SYS

sr.sys

PCTCore.sys

pctDS.sys

pctEFA.sys

TfFsMon.sys

TfSysMon.sys

KSecDD.sys

Ntfs.sys

NDIS.sys

vvoice.sys

vpctcom.sys

vmodem.sys

viaagp.sys

sfhlp02.sys

sfdrv01.sys

Mup.sys

\SystemRoot\system32\DRIVERS\AmdPPM.sys

\SystemRoot\system32\DRIVERS\ASACPI.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\DRIVERS\usbohci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\imapi.sys

\SystemRoot\system32\drivers\Afc.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\DRIVERS\redbook.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\nvnetbus.sys

\SystemRoot\system32\DRIVERS\NVNRM.SYS

\SystemRoot\system32\DRIVERS\nv4_mini.sys

\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

\SystemRoot\system32\DRIVERS\ArcSoftVirtualCapture.sys

\SystemRoot\system32\DRIVERS\STREAM.SYS

\SystemRoot\system32\DRIVERS\serscan.sys

\SystemRoot\system32\DRIVERS\audstub.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\psched.sys

\SystemRoot\system32\DRIVERS\msgpc.sys

\SystemRoot\system32\DRIVERS\ptilink.sys

\SystemRoot\system32\DRIVERS\raspti.sys

\SystemRoot\system32\drivers\SaiBus.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\update.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\DRIVERS\SaiMini.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\NVENETFD.sys

\SystemRoot\system32\drivers\RtkHDAud.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\System32\Drivers\Fs_Rec.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\Drivers\mnmdd.SYS

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\rasacd.sys

\SystemRoot\system32\DRIVERS\ipsec.sys

\SystemRoot\system32\DRIVERS\tcpip.sys

\SystemRoot\system32\DRIVERS\ipnat.sys

\??\C:\WINDOWS\system32\drivers\pctgntdi.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\netbt.sys

\SystemRoot\System32\drivers\ws2ifsl.sys

\SystemRoot\System32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\System32\Drivers\PCTSD.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\System32\Drivers\Fips.SYS

\SystemRoot\system32\drivers\AsIO.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\usbprint.sys

\SystemRoot\system32\DRIVERS\BrScnUsb.sys

\SystemRoot\System32\Drivers\BrUsbSer.sys

\SystemRoot\System32\Drivers\BrSerIf.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\System32\Drivers\Cdfs.SYS

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_WMILIB.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\watchdog.sys

\SystemRoot\System32\drivers\dxg.sys

\SystemRoot\System32\drivers\dxgthk.sys

\SystemRoot\System32\nv4_disp.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\drivers\wdmaud.sys

\SystemRoot\system32\drivers\sysaudio.sys

\SystemRoot\system32\DRIVERS\mrxdav.sys

\SystemRoot\system32\DRIVERS\srv.sys

\??\C:\WINDOWS\system32\drivers\pctplsg.sys

\??\C:\WINDOWS\system32\drivers\pctplsm.sys

\SystemRoot\System32\Drivers\HTTP.sys

\SystemRoot\System32\Drivers\PCTBD.sys

\??\C:\windows\system32\drivers\TfNetMon.sys

\SystemRoot\system32\drivers\kmixer.sys

\??\C:\windows\system32\drivers\mbamchameleon.sys

\??\C:\windows\system32\drivers\mbamswissarmy.sys

\WINDOWS\system32\ntdll.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR2

Upper Device Object: 0xffffffff89cc6668

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000081\

Lower Device Object: 0xffffffff8b2fbea0

Lower Device Driver Name: \Driver\usbstor\

Driver name found: usbstor

Initialization returned 0x0

Load Function returned 0x0

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8b617030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\

Lower Device Object: 0xffffffff8b668d98

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

Initialization returned 0x0

Load Function returned 0x0

Downloaded database version: v2013.05.06.05

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8b617030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8b617b70, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff8b617030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8b694d38, DeviceName: Unknown, DriverName: \Driver\PCTCore\

DevicePointer: 0xffffffff8b6191c0, DeviceName: \Device\0000006e\, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff8b668d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xffffffffe128c250, 0xffffffff8b617030, 0xffffffff88afcab8

Lower DeviceData: 0xffffffffe172df00, 0xffffffff8b668d98, 0xffffffff88b09a40

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 2AD21C

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 625137282

Partition file system is NTFS

Partition is bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xffffffff89cc6668, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff89f9e7d0, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff89cc6668, DeviceName: \Device\Harddisk1\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8a05b790, DeviceName: Unknown, DriverName: \Driver\PCTCore\

DevicePointer: 0xffffffff8b2fbea0, DeviceName: \Device\00000081\, DriverName: \Driver\usbstor\