Can't install & can't run

SteveT5195 · March 17, 2009

I have the installation file on my machine as well as the program installed on my machine but the installed program won't run and the installation won't run.

Help please!!!!

Here is my Highjack This log...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:43:00 AM, on 3/17/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe

C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Documents and Settings\Steve\Desktop\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.comcast.net/login?s=portal&am...3D1236860560388

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

R3 - URLSearchHook: (no name) - {ABE9C052-8DBA-36A6-CB42-D2DD0083434C} - NSYSCPLSTR.dll (file missing)

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O2 - BHO: {9636d4e2-f0ed-533b-1754-2ed9ba71116e} - {e61117ab-9de2-4571-b335-de0f2e4d6369} - (no file)

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn6\YTSingleInstance.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll

O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe\ReminderApp.exe

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"

O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\LOCALS~1.NTA\protect.dll,_IWMPEvents@16

O4 - HKUS\S-1-5-18\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')

O4 - Startup: ChkDisk.dll

O4 - Startup: ChkDisk.lnk = ?

O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)

O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)

O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O15 - Trusted Zone: *.passport.com

O16 - DPF: {028518E1-9FA8-44FC-92D7-5C54244B5F36} - http://activex.microsoft.com/objects/ocget.dll

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1237055561203

O16 - DPF: {8646A6AF-0AE4-4BF8-B716-DB1513803972} (SFImageUpload1_8.ImageUpload) - http://riteaid.storefront.com/images/globa...geUpload1_8.CAB

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Filter hijack: text/html - {933750af-5c45-45f5-be94-783239a5f0f6} - C:\WINDOWS\system32\mst122.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--

End of file - 10045 bytes

Fatdcuk · March 17, 2009

Hi please use the following wlakthrough to see if you have CLB driver present and take appropriate action if it is.

http://www.malwarebytes.org/forums/index.php?showtopic=12709

SteveT5195 · March 18, 2009

Hi please use the following wlakthrough to see if you have CLB driver present and take appropriate action if it is.
http://www.malwarebytes.org/forums/index.php?showtopic=12709

I am really trying to follow the instructions on the link. I can download "rootrepeal" but the program won't run. It can't find the "associated program."

What is the associated program to run this? It won't automatically find the program and asks me to designate a program.

I need help this is VERY frustrating.

SteveT5195 · March 18, 2009

Okay I've managed to run "rootrepeal"

However, after identifying the file to "wipe" and selecting the "wipe" option it's telling me "Could not find file on disk."

Here is the entire list (I've bolded the one I "think" I'm supposed to wipe).

ROOTREPEAL © AD, 2007-2008

==================================================

Scan Time: 2009/03/18 05:31

Program Version: Version 1.2.3.0

Windows Version: Windows XP SP2

==================================================

Drivers

-------------------

Name: 1394BUS.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\1394BUS.SYS

Address: 0xF754F000 Size: 53248 File Visible: -

Status: -

Name: ACPI.sys

Image Path: ACPI.sys

Address: 0xF74E0000 Size: 187776 File Visible: -

Status: -

Name: ACPI_HAL

Image Path: \Driver\ACPI_HAL

Address: 0x804D7000 Size: 2180352 File Visible: -

Status: -

Name: afd.sys

Image Path: C:\WINDOWS\System32\drivers\afd.sys

Address: 0xF4E8B000 Size: 138496 File Visible: -

Status: -

Name: agp440.sys

Image Path: agp440.sys

Address: 0xF759F000 Size: 42368 File Visible: -

Status: -

Name: ALIEHCI.sys

Image Path: C:\WINDOWS\System32\Drivers\ALIEHCI.sys

Address: 0xF642E000 Size: 111680 File Visible: -

Status: -

Name: AliRtHub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\AliRtHub.sys

Address: 0xF7C6B000 Size: 2944 File Visible: -

Status: -

Name: AmosNt.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\AmosNt.SYS

Address: 0xF64FA000 Size: 155648 File Visible: -

Status: -

Name: arp1394.sys

Image Path: C:\WINDOWS\System32\DRIVERS\arp1394.sys

Address: 0xF76EF000 Size: 60800 File Visible: -

Status: -

Name: atapi.sys

Image Path: atapi.sys

Address: 0xF7498000 Size: 95360 File Visible: -

Status: -

Name: ATMFD.DLL

Image Path: C:\WINDOWS\System32\ATMFD.DLL

Address: 0xBFFA0000 Size: 286720 File Visible: -

Status: -

Name: audstub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys

Address: 0xF7C58000 Size: 3072 File Visible: -

Status: -

Name: basic2.sys

Image Path: C:\WINDOWS\System32\DRIVERS\basic2.sys

Address: 0xF65A7000 Size: 69408 File Visible: -

Status: -

Name: Beep.SYS

Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS

Address: 0xF7A97000 Size: 4224 File Visible: -

Status: -

Name: BOOTVID.dll

Image Path: C:\WINDOWS\system32\BOOTVID.dll

Address: 0xF793F000 Size: 12288 File Visible: -

Status: -

Name: Cdfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS

Address: 0xF3649000 Size: 63744 File Visible: -

Status: -

Name: Cdr4_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS

Address: 0xF6B1E000 Size: 59168 File Visible: -

Status: -

Name: Cdralw2k.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS

Address: 0xF792F000 Size: 22144 File Visible: -

Status: -

Name: cdrom.sys

Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys

Address: 0xF6B0E000 Size: 49536 File Visible: -

Status: -

Name: cdudf_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\cdudf_xp.SYS

Address: 0xF4FAA000 Size: 236032 File Visible: -

Status: -

Name: CLASSPNP.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS

Address: 0xF758F000 Size: 53248 File Visible: -

Status: -

Name: ctlfacem.sys

Image Path: C:\WINDOWS\system32\drivers\ctlfacem.sys

Address: 0xF7A81000 Size: 6912 File Visible: -

Status: -

Name: ctljystk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ctljystk.sys

Address: 0xF7C44000 Size: 3712 File Visible: -

Status: -

Name: disk.sys

Image Path: disk.sys

Address: 0xF757F000 Size: 36352 File Visible: -

Status: -

Name: drmk.sys

Image Path: C:\WINDOWS\system32\drivers\drmk.sys

Address: 0xF777F000 Size: 61440 File Visible: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xF3264000 Size: 98304 File Visible: No

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF7ADD000 Size: 8192 File Visible: No

Status: -

Name: Dxapi.sys

Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys

Address: 0xF4E67000 Size: 12288 File Visible: -

Status: -

Name: dxg.sys

Image Path: C:\WINDOWS\System32\drivers\dxg.sys

Address: 0xBF9C3000 Size: 73728 File Visible: -

Status: -

Name: dxgthk.sys

Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys

Address: 0xF7C4F000 Size: 4096 File Visible: -

Status: -

Name: emu10k1m.sys

Image Path: C:\WINDOWS\system32\drivers\emu10k1m.sys

Address: 0xF64B4000 Size: 283904 File Visible: -

Status: -

Name: fallback.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fallback.sys

Address: 0xB9E44000 Size: 289888 File Visible: -

Status: -

Name: faxnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\faxnt.sys

Address: 0xB9048000 Size: 199712 File Visible: -

Status: -

Name: fdc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys

Address: 0xF7917000 Size: 27392 File Visible: -

Status: -

Name: Fips.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS

Address: 0xF76DF000 Size: 34944 File Visible: -

Status: -

Name: flpydisk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys

Address: 0xF7817000 Size: 20480 File Visible: -

Status: -

Name: fltmgr.sys

Image Path: fltmgr.sys

Address: 0xF7478000 Size: 128896 File Visible: -

Status: -

Name: Fs_Rec.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

Address: 0xF7A95000 Size: 7936 File Visible: -

Status: -

Name: fsksnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fsksnt.sys

Address: 0xB9E27000 Size: 115776 File Visible: -

Status: -

Name: ftdisk.sys

Image Path: ftdisk.sys

Address: 0xF74B0000 Size: 125056 File Visible: -

Status: -

Name: gameenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys

Address: 0xF7253000 Size: 10624 File Visible: -

Status: -

Name: GEARAspiWDM.sys

Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys

Address: 0xF7243000 Size: 9472 File Visible: -

Status: -

Name: hal.dll

Image Path: C:\WINDOWS\system32\hal.dll

Address: 0x806EC000 Size: 131968 File Visible: -

Status: -

Name: HIDCLASS.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS

Address: 0xF76FF000 Size: 36864 File Visible: -

Status: -

Name: HIDPARSE.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS

Address: 0xF786F000 Size: 28672 File Visible: -

Status: -

Name: hidusb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\hidusb.sys

Address: 0xF7A17000 Size: 9600 File Visible: -

Status: -

Name: HPZid412.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HPZid412.sys

Address: 0xF773F000 Size: 50848 File Visible: -

Status: -

Name: HPZipr12.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HPZipr12.sys

Address: 0xF7A27000 Size: 16224 File Visible: -

Status: -

Name: HPZius12.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HPZius12.sys

Address: 0xF7897000 Size: 21472 File Visible: -

Status: -

Name: HSF_CNXT.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys

Address: 0xF6520000 Size: 551168 File Visible: -

Status: -

Name: HTTP.sys

Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys

Address: 0xB6395000 Size: 262784 File Visible: -

Status: -

Name: i8042prt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys

Address: 0xF779F000 Size: 52736 File Visible: -

Status: -

Name: ikhfile.sys

Image Path: C:\WINDOWS\system32\drivers\ikhfile.sys

Address: 0xF784F000 Size: 30592 File Visible: -

Status: -

Name: ikhlayer.sys

Image Path: C:\WINDOWS\System32\drivers\ikhlayer.sys

Address: 0xF76CF000 Size: 51072 File Visible: -

Status: -

Name: Imapi.SYS

Image Path: C:\WINDOWS\System32\Drivers\Imapi.SYS

Address: 0xF6AEE000 Size: 41856 File Visible: -

Status: -

Name: intelide.sys

Image Path: intelide.sys

Address: 0xF7A33000 Size: 5504 File Visible: -

Status: -

Name: intelppm.sys

Image Path: C:\WINDOWS\System32\DRIVERS\intelppm.sys

Address: 0xF774F000 Size: 36096 File Visible: -

Status: -

Name: ipnat.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys

Address: 0xF4E42000 Size: 134912 File Visible: -

Status: -

Name: ipsec.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys

Address: 0xF4F2D000 Size: 74752 File Visible: -

Status: -

Name: isapnp.sys

Image Path: isapnp.sys

Address: 0xF752F000 Size: 35840 File Visible: -

Status: -

Name: k56nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\k56nt.sys

Address: 0xB9D9F000 Size: 391744 File Visible: -

Status: -

Name: kbdclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys

Address: 0xF791F000 Size: 24576 File Visible: -

Status: -

Name: KDCOM.DLL

Image Path: C:\WINDOWS\system32\KDCOM.DLL

Address: 0xF7A2F000 Size: 8192 File Visible: -

Status: -

Name: kmixer.sys

Image Path: C:\WINDOWS\system32\drivers\kmixer.sys

Address: 0xACB51000 Size: 172416 File Visible: -

Status: -

Name: ks.sys

Image Path: C:\WINDOWS\system32\drivers\ks.sys

Address: 0xF646D000 Size: 143360 File Visible: -

Status: -

Name: KSecDD.sys

Image Path: KSecDD.sys

Address: 0xF744F000 Size: 92032 File Visible: -

Status: -

Name: L8042pr2.Sys

Image Path: C:\WINDOWS\System32\DRIVERS\L8042pr2.Sys

Address: 0xF75CF000 Size: 46976 File Visible: -

Status: -

Name: LMouFlt2.Sys

Image Path: C:\WINDOWS\System32\DRIVERS\LMouFlt2.Sys

Address: 0xF6B3E000 Size: 63328 File Visible: -

Status: -

Name: mmc_2K.SYS

Image Path: C:\WINDOWS\System32\Drivers\mmc_2K.SYS

Address: 0xF77EF000 Size: 21696 File Visible: -

Status: -

Name: mnmdd.SYS

Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS

Address: 0xF7A99000 Size: 4224 File Visible: -

Status: -

Name: Modem.SYS

Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS

Address: 0xF7907000 Size: 30080 File Visible: -

Status: -

Name: MODEMCSA.sys

Image Path: C:\WINDOWS\system32\drivers\MODEMCSA.sys

Address: 0xF79BF000 Size: 16128 File Visible: -

Status: -

Name: mouclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys

Address: 0xF7927000 Size: 23040 File Visible: -

Status: -

Name: MountMgr.sys

Image Path: MountMgr.sys

Address: 0xF755F000 Size: 42240 File Visible: -

Status: -

Name: mrxdav.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys

Address: 0xB9F53000 Size: 179584 File Visible: -

Status: -

Name: mrxsmb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

Address: 0xF4DA8000 Size: 453120 File Visible: -

Status: -

Name: Msfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS

Address: 0xF782F000 Size: 19072 File Visible: -

Status: -

Name: msgpc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys

Address: 0xF6AAE000 Size: 35072 File Visible: -

Status: -

Name: mssmbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys

Address: 0xF69B8000 Size: 15488 File Visible: -

Status: -

Name: Mup.sys

Image Path: Mup.sys

Address: 0xF737A000 Size: 107904 File Visible: -

Status: -

Name: NDIS.sys

Image Path: NDIS.sys

Address: 0xF7395000 Size: 182912 File Visible: -

Status: -

Name: ndistapi.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys

Address: 0xF69C0000 Size: 9600 File Visible: -

Status: -

Name: ndisuio.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndisuio.sys

Address: 0xBAC1A000 Size: 12928 File Visible: -

Status: -

Name: ndiswan.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys

Address: 0xF63EA000 Size: 91776 File Visible: -

Status: -

Name: NDProxy.SYS

Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS

Address: 0xF75FF000 Size: 38016 File Visible: -

Status: -

Name: netbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys

Address: 0xF766F000 Size: 34560 File Visible: -

Status: -

Name: netbt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys

Address: 0xF4EAD000 Size: 162816 File Visible: -

Status: -

Name: nic1394.sys

Image Path: C:\WINDOWS\System32\DRIVERS\nic1394.sys

Address: 0xF75BF000 Size: 61824 File Visible: -

Status: -

Name: Npfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS

Address: 0xF7837000 Size: 30848 File Visible: -

Status: -

Name: Ntfs.sys

Image Path: Ntfs.sys

Address: 0xF73C2000 Size: 574464 File Visible: -

Status: -

Name: ntoskrnl.exe

Image Path: C:\WINDOWS\system32\ntoskrnl.exe

Address: 0x804D7000 Size: 2180352 File Visible: -

Status: -

Name: Null.SYS

Image Path: C:\WINDOWS\System32\Drivers\Null.SYS

Address: 0xF7C6D000 Size: 2944 File Visible: -

Status: -

Name: nv4_disp.dll

Image Path: C:\WINDOWS\System32\nv4_disp.dll

Address: 0xBF9D5000 Size: 4530176 File Visible: -

Status: -

Name: nv4_mini.sys

Image Path: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

Address: 0xF65CC000 Size: 3994624 File Visible: -

Status: -

Name: ohci1394.sys

Image Path: ohci1394.sys

Address: 0xF753F000 Size: 61056 File Visible: -

Status: -

Name: OMCI.SYS

Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS

Address: 0xF7A0B000 Size: 12864 File Visible: -

Status: -

Name: parport.sys

Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys

Address: 0xF641A000 Size: 80128 File Visible: -

Status: -

Name: PartMgr.sys

Image Path: PartMgr.sys

Address: 0xF77B7000 Size: 18688 File Visible: -

Status: -

Name: ParVdm.SYS

Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS

Address: 0xF7AA7000 Size: 6784 File Visible: -

Status: -

Name: pci.sys

Image Path: pci.sys

Address: 0xF74CF000 Size: 68224 File Visible: -

Status: -

Name: pciide.sys

Image Path: pciide.sys

Address: 0xF7AF7000 Size: 3328 File Visible: -

Status: -

Name: PCIIDEX.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS

Address: 0xF77AF000 Size: 28672 File Visible: -

Status: -

Name: pfc.sys

Image Path: C:\WINDOWS\system32\drivers\pfc.sys

Address: 0xF724B000 Size: 10368 File Visible: -

Status: -

Name: PnpManager

Image Path: \Driver\PnpManager

Address: 0x804D7000 Size: 2180352 File Visible: -

Status: -

Name: portcls.sys

Image Path: C:\WINDOWS\system32\drivers\portcls.sys

Address: 0xF6490000 Size: 147456 File Visible: -

Status: -

Name: psched.sys

Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys

Address: 0xF63D9000 Size: 69120 File Visible: -

Status: -

Name: ptilink.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys

Address: 0xF77DF000 Size: 17792 File Visible: -

Status: -

Name: pwd_2k.SYS

Image Path: C:\WINDOWS\System32\Drivers\pwd_2k.SYS

Address: 0xF6401000 Size: 101024 File Visible: -

Status: -

Name: PxHelp20.sys

Image Path: PxHelp20.sys

Address: 0xF77BF000 Size: 19936 File Visible: -

Status: -

Name: rasacd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys

Address: 0xF79E7000 Size: 8832 File Visible: -

Status: -

Name: rasl2tp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys

Address: 0xF6ADE000 Size: 51328 File Visible: -

Status: -

Name: raspppoe.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys

Address: 0xF6ACE000 Size: 41472 File Visible: -

Status: -

Name: raspptp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys

Address: 0xF6ABE000 Size: 48384 File Visible: -

Status: -

Name: raspti.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys

Address: 0xF77E7000 Size: 16512 File Visible: -

Status: -

Name: RAW

Image Path: \FileSystem\RAW

Address: 0x804D7000 Size: 2180352 File Visible: -

Status: -

Name: rdbss.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys

Address: 0xF4E17000 Size: 174592 File Visible: -

Status: -

Name: RDPCDD.sys

Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

Address: 0xF7A9B000 Size: 4224 File Visible: -

Status: -

Name: redbook.sys

Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys

Address: 0xF6AFE000 Size: 57472 File Visible: -

Status: -

Name: rksample.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rksample.sys

Address: 0xF776F000 Size: 59392 File Visible: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xAE60F000 Size: 45056 File Visible: No

Status: -

Name: RTL8139.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\RTL8139.SYS

Address: 0xF78FF000 Size: 20992 File Visible: -

Status: -

Name: sdcplh.sys

Image Path: C:\WINDOWS\System32\drivers\sdcplh.sys

Address: 0xF76AF000 Size: 40576 File Visible: -

Status: -

Name: secdrv.sys

Image Path: C:\WINDOWS\System32\DRIVERS\secdrv.sys

Address: 0xBA00F000 Size: 40960 File Visible: -

Status: -

Name: serenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys

Address: 0xF724F000 Size: 15488 File Visible: -

Status: -

Name: serial.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys

Address: 0xF6B2E000 Size: 64896 File Visible: -

Status: -

Name: sfmanm.sys

Image Path: C:\WINDOWS\system32\drivers\sfmanm.sys

Address: 0xF778F000 Size: 36480 File Visible: -

Status: -

Name: SOAR.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\SOAR.SYS

Address: 0xF775F000 Size: 45056 File Visible: -

Status: -

Name: spkpnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\spkpnt.sys

Address: 0xB9036000 Size: 73248 File Visible: -

Status: -

Name: sr.sys

Image Path: sr.sys

Address: 0xF7466000 Size: 73472 File Visible: -

Status: -

Name: srv.sys

Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys

Address: 0xB9D4D000 Size: 332928 File Visible: -

Status: -

Name: SSHDRV65.sys

Image Path: C:\WINDOWS\System32\drivers\SSHDRV65.sys

Address: 0xF5004000 Size: 139264 File Visible: -

Status: -

Name: swenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys

Address: 0xF7A8B000 Size: 4352 File Visible: -

Status: -

Name: sysaudio.sys

Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys

Address: 0xF4D88000 Size: 60800 File Visible: -

Status: -

Name: tcpip.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys

Address: 0xF4ED5000 Size: 360064 File Visible: -

Status: -

Name: TDI.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS

Address: 0xF77D7000 Size: 20480 File Visible: -

Status: -

Name: termdd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys

Address: 0xF75DF000 Size: 40704 File Visible: -

Status: -

Name: tm_cfw.sys

Image Path: C:\WINDOWS\System32\Drivers\tm_cfw.sys

Address: 0xB8F1D000 Size: 821728 File Visible: -

Status: -

Name: Tmpreflt.sys

Image Path: C:\WINDOWS\system32\drivers\Tmpreflt.sys

Address: 0xF772F000 Size: 53248 File Visible: -

Status: -

Name: tmtdi.sys

Image Path: C:\WINDOWS\System32\Drivers\tmtdi.sys

Address: 0xF768F000 Size: 35456 File Visible: -

Status: -

Name: TmXPFlt.sys

Image Path: C:\WINDOWS\system32\drivers\TmXPFlt.sys

Address: 0xBAC22000 Size: 274432 File Visible: -

Status: -

Name: tonesnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tonesnt.sys

Address: 0xB90B1000 Size: 50688 File Visible: -

Status: -

Name: UACcoihaiqd.sys

Image Path: C:\WINDOWS\system32\drivers\UACcoihaiqd.sys

Address: 0xF4F85000 Size: 77824 File Visible: -

Status: Hidden from Windows API!

Name: UdfReadr_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS

Address: 0xF4F52000 Size: 206336 File Visible: -

Status: -

Name: update.sys

Image Path: C:\WINDOWS\System32\DRIVERS\update.sys

Address: 0xF636F000 Size: 364160 File Visible: -

Status: -

Name: usbccgp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbccgp.sys

Address: 0xF7877000 Size: 31616 File Visible: -

Status: -

Name: USBD.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS

Address: 0xF7A8D000 Size: 8192 File Visible: -

Status: -

Name: usbhub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys

Address: 0xF75EF000 Size: 57600 File Visible: -

Status: -

Name: usbohci.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbohci.sys

Address: 0xF790F000 Size: 17024 File Visible: -

Status: -

Name: USBPORT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS

Address: 0xF644A000 Size: 143360 File Visible: -

Status: -

Name: usbprint.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbprint.sys

Address: 0xF788F000 Size: 25856 File Visible: -

Status: -

Name: usbscan.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbscan.sys

Address: 0xF7A23000 Size: 15104 File Visible: -

Status: -

Name: USBSTOR.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS

Address: 0xF789F000 Size: 26496 File Visible: -

Status: -

Name: usbuhci.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbuhci.sys

Address: 0xF7937000 Size: 20480 File Visible: -

Status: -

Name: v124nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\v124nt.sys

Address: 0xB8E7D000 Size: 490336 File Visible: -

Status: -

Name: vga.sys

Image Path: C:\WINDOWS\System32\drivers\vga.sys

Address: 0xF7827000 Size: 20992 File Visible: -

Status: -

Name: VIDEOPRT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS

Address: 0xF65B8000 Size: 81920 File Visible: -

Status: -

Name: VolSnap.sys

Image Path: VolSnap.sys

Address: 0xF756F000 Size: 52352 File Visible: -

Status: -

Name: Vsapint.sys

Image Path: C:\WINDOWS\system32\drivers\Vsapint.sys

Address: 0xBAC65000 Size: 1188640 File Visible: -

Status: -

Name: wanarp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys

Address: 0xF769F000 Size: 34560 File Visible: -

Status: -

Name: watchdog.sys

Image Path: C:\WINDOWS\System32\watchdog.sys

Address: 0xF3720000 Size: 20480 File Visible: -

Status: -

Name: wdmaud.sys

Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys

Address: 0xBA255000 Size: 82944 File Visible: -

Status: -

Name: Win32k

Image Path: \Driver\Win32k

Address: 0xBF800000 Size: 1847296 File Visible: -

Status: -

Name: win32k.sys

Image Path: C:\WINDOWS\System32\win32k.sys

Address: 0xBF800000 Size: 1847296 File Visible: -

Status: -

Name: WMILIB.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS

Address: 0xF7A31000 Size: 8192 File Visible: -

Status: -

Name: WMIxWDM

Image Path: \Driver\WMIxWDM

Address: 0x804D7000 Size: 2180352 File Visible: -

Status: -

Name: ws2ifsl.sys

Image Path: C:\WINDOWS\System32\drivers\ws2ifsl.sys

Address: 0xF79EF000 Size: 12032 File Visible: -

Status: -

Should I use the "Force Delete" Option? Or what?

SteveT5195 · March 18, 2009

Here is my listing when I use the "file" scan option...

ROOTREPEAL © AD, 2007-2008

==================================================

Scan Time: 2009/03/18 05:35

Program Version: Version 1.2.3.0

Windows Version: Windows XP SP2

==================================================

Hidden/Locked Files

-------------------

Path: C:\DELL.SDR