Trojan.TDSS

brew · July 29, 2009

Making zero progress in removing Trojan.TDSS. Any help is much appreciated.

Please reference this thread - http://www.malwarebytes.org/forums/index.p...=19420&st=0

Maurice Naggar · July 31, 2009

Hello brew,

If you are not being helped elsewhere at any other forum, and you desire continued help here, do the following.

One of the things I'll ask for is that you only post to this thread, and

make no changes on your own, and not run any other tools or programs without checking here with me.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not brew and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

1. Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

2. Take out the trash (temporary files & temporary internet files)

Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every user-login account {User Profile}

=

Next, also do this:

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

=

Download The Avenger by Swandog46 from here.

Unzip/extract it to a folder on your desktop.
Double click on avenger.exe to run The Avenger.
Click OK.
Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.

Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.

Files to delete:C:\WINDOWS\system32\a99k.binC:\WINDOWS\system32\drivers\geyekrclkkmxow.sysc:\windows\system32\geyekrkcxxccqt.dllc:\windows\system32\drivers\msqpdxserv.sys c:\windows\system32\TDSSweat.datC:\WINDOWS\system32\drivers\TDSSmqlt.sys C:\windows\system32\drivers\tdssserv.sysC:\WINDOWS\system32\drivers\TDSSmact.sysC:\WINDOWS\system32\TDSSfpmp.dllC:\WINDOWS\system32\TDSSwpyd.dat C:\WINDOWS\system32\TDSStkdv.log  C:\WINDOWS\system32\TDSSotxb.dll C:\WINDOWS\system32\TDSScrrn.dll C:\WINDOWS\system32\TDSSbvqh.dll C:\WINDOWS\system32\TDSSjnmx.dllc:\windows\system32\TDSShrxr.dllc:\windows\system32\TDSSkkbi.logc:\windows\system32\TDSSlrvd.datc:\windows\system32\TDSSlxwp.dllc:\windows\system32\TDSSnmxh.logc:\windows\system32\TDSSoiqt.dllc:\windows\system32\TDSSrhyp.logc:\windows\system32\TDSSrtqp.dllc:\windows\system32\TDSSsihc.dllc:\windows\system32\TDSSxfum.dllc:\windows\system32\TDSSmtve.datc:\windows\system32\TDSSnirj.datC:\WINDOWS\SYSTEM32\TDSSixgp.dllC:\WINDOWS\SYSTEM32\TDSSproc.logC:\WINDOWS\SYSTEM32\TDSSwkod.logc:\windows\sysguard.exec:\windows\system32\sdra64.exe
Drivers to delete:geyekrclkkmxowgeyekrclkkmxow.sysgxvxcservovfsthxUACd.sysUACdgaopdxserv.sysgaopdxservgaopdxltdsstdssservTDSSserv.SYSService_TDSSSERV.SYSLegacy_TDSSSERV.SYSmsqpdxserv.sysmsqpdxserv
Folders to delete:C:\recyclerD:\recyclere:\recyclerf:\recyclerg:\recyclerh:\recycler

In the avenger window, click the Paste Script from Clipboard icon, button.
:!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
Click the Execute button.
You will be asked Are you sure you want to execute the current script?.
Click Yes.
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
Click Yes.
Your PC will now be rebooted.
Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

=

Next, Download SysProt Antirootkit from the link below:

>> here <<

It is at the bottom of the page under "Attachments".

Unzip it into a folder on your desktop.

Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select all items.
Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to.
Open the text file and copy/paste the log here.

=

Reply with copy of C:\Avenger.txt

and the Sysprot log

brew · July 31, 2009

Thank You so much for taking the time to help me out. It is very much appreciated!

Out of frustration, I did try to make some repairs on my own prior to your post. I have a drive attached with Vista on it. I booted to that drive and deleted the geyekrk....... files from the windows/system32 folder on the xp drive. There were 4-5 of them. I also deleted 1 geyekrk....... file from the windows/system32/drivers folder. MBAM no longer reports the Trojan.TDSS. It does however, see 2 new problems that it cannot get rid of. I have included the MBAM log also. I will not make any future repair attemps without your direction.

I have followed all of your outlined steps and have included the logs -

Avenger Log

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file "C:\WINDOWS\system32\a99k.bin" not found!

Deletion of file "C:\WINDOWS\system32\a99k.bin" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\drivers\geyekrclkkmxow.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\geyekrclkkmxow.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\geyekrkcxxccqt.dll" not found!

Deletion of file "c:\windows\system32\geyekrkcxxccqt.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\drivers\msqpdxserv.sys" not found!

Deletion of file "c:\windows\system32\drivers\msqpdxserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSweat.dat" not found!

Deletion of file "c:\windows\system32\TDSSweat.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\windows\system32\drivers\tdssserv.sys" not found!

Deletion of file "C:\windows\system32\drivers\tdssserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\drivers\TDSSmact.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\TDSSmact.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSfpmp.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSfpmp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSwpyd.dat" not found!

Deletion of file "C:\WINDOWS\system32\TDSSwpyd.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSStkdv.log" not found!

Deletion of file "C:\WINDOWS\system32\TDSStkdv.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSotxb.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSotxb.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSScrrn.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSScrrn.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSbvqh.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSbvqh.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\TDSSjnmx.dll" not found!

Deletion of file "C:\WINDOWS\system32\TDSSjnmx.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSShrxr.dll" not found!

Deletion of file "c:\windows\system32\TDSShrxr.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSkkbi.log" not found!

Deletion of file "c:\windows\system32\TDSSkkbi.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSlrvd.dat" not found!

Deletion of file "c:\windows\system32\TDSSlrvd.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSlxwp.dll" not found!

Deletion of file "c:\windows\system32\TDSSlxwp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSnmxh.log" not found!

Deletion of file "c:\windows\system32\TDSSnmxh.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSoiqt.dll" not found!

Deletion of file "c:\windows\system32\TDSSoiqt.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSrhyp.log" not found!

Deletion of file "c:\windows\system32\TDSSrhyp.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSrtqp.dll" not found!

Deletion of file "c:\windows\system32\TDSSrtqp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSsihc.dll" not found!

Deletion of file "c:\windows\system32\TDSSsihc.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSxfum.dll" not found!

Deletion of file "c:\windows\system32\TDSSxfum.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSmtve.dat" not found!

Deletion of file "c:\windows\system32\TDSSmtve.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\TDSSnirj.dat" not found!

Deletion of file "c:\windows\system32\TDSSnirj.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSproc.log" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSproc.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" not found!

Deletion of file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\sysguard.exe" not found!

Deletion of file "c:\windows\sysguard.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\sdra64.exe" not found!

Deletion of file "c:\windows\system32\sdra64.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\geyekrclkkmxow" not found!

Deletion of driver "geyekrclkkmxow" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\geyekrclkkmxow.sys" not found!

Deletion of driver "geyekrclkkmxow.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gxvxcserv" not found!

Deletion of driver "gxvxcserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\ovfsthx" not found!

Deletion of driver "ovfsthx" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\UACd.sys" not found!

Deletion of driver "UACd.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\UACd" not found!

Deletion of driver "UACd" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxserv.sys" not found!

Deletion of driver "gaopdxserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxserv" not found!

Deletion of driver "gaopdxserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\gaopdxl" not found!

Deletion of driver "gaopdxl" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdss" not found!

Deletion of driver "tdss" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdssserv" not found!

Deletion of driver "tdssserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\TDSSserv.SYS" not found!

Deletion of driver "TDSSserv.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Service_TDSSSERV.SYS" not found!

Deletion of driver "Service_TDSSSERV.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Legacy_TDSSSERV.SYS" not found!

Deletion of driver "Legacy_TDSSSERV.SYS" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv.sys" not found!

Deletion of driver "msqpdxserv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv" not found!

Deletion of driver "msqpdxserv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Folder "C:\recycler" deleted successfully.

Folder "D:\recycler" deleted successfully.

Error: could not open folder "e:\recycler"

Deletion of folder "e:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Folder "f:\recycler" deleted successfully.

Folder "g:\recycler" deleted successfully.

Error: could not open folder "h:\recycler"

Deletion of folder "h:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

Sysprot Log

SysProt AntiRootkit v1.0.1.0

by swatkat

********************************************************************************

**********

********************************************************************************

**********

Process:

Name: [system Idle Process]

PID: 0

Hidden: No

Window Visible: No

Name: System

PID: 4

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\smss.exe

PID: 956

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\csrss.exe

PID: 1508

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\winlogon.exe

PID: 1696

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\services.exe

PID: 1900

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\lsass.exe

PID: 1912

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\nvsvc32.exe

PID: 284

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 532

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 612

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 776

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 932

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 1156

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 1280

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\spoolsv.exe

PID: 1528

Hidden: No

Window Visible: No

Name: C:\Program Files\Creative\Shared Files\CTAudSvc.exe

PID: 1596

Hidden: No

Window Visible: No

Name: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

PID: 652

Hidden: No

Window Visible: No

Name: C:\Program Files\Bonjour\mDNSResponder.exe

PID: 716

Hidden: No

Window Visible: No

Name: C:\PROGRA~1\COMMON~1\stardock\SDMCP.exe

PID: 2032

Hidden: No

Window Visible: No

Name: C:\WINDOWS\explorer.exe

PID: 684

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\notepad.exe

PID: 1128

Hidden: No

Window Visible: Yes

Name: C:\WINDOWS\system32\nvraidservice.exe

PID: 1928

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\Ctxfihlp.exe

PID: 316

Hidden: No

Window Visible: No

Name: C:\Program Files\Zune\ZuneLauncher.exe

PID: 332

Hidden: No

Window Visible: No

Name: C:\Program Files\iTunes\iTunesHelper.exe

PID: 460

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\CTxfispi.exe

PID: 484

Hidden: No

Window Visible: No

Name: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

PID: 2012

Hidden: No

Window Visible: No

Name: C:\Program Files\Internet Download Manager\IDMan.exe

PID: 924

Hidden: No

Window Visible: No

Name: C:\Program Files\R-Wipe&Clean\rwiped.exe

PID: 1056

Hidden: No

Window Visible: No

Name: C:\Program Files\Microsoft ActiveSync\wcescomm.exe

PID: 1096

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\ctfmon.exe

PID: 1104

Hidden: No

Window Visible: No

Name: C:\PROGRA~1\MICROS~1\rapimgr.exe

PID: 1568

Hidden: No

Window Visible: No

Name: C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

PID: 372

Hidden: No

Window Visible: No

Name: C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PID: 1668

Hidden: No

Window Visible: No

Name: C:\Autodesk Network License Manager\lmgrd.exe

PID: 1724

Hidden: No

Window Visible: No

Name: C:\Program Files\Java\jre6\bin\jqs.exe

PID: 1804

Hidden: No

Window Visible: No

Name: C:\Autodesk Network License Manager\adskflex.exe

PID: 2052

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\PnkBstrA.exe

PID: 2396

Hidden: No

Window Visible: No

Name: C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

PID: 2464

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\svchost.exe

PID: 2480

Hidden: No

Window Visible: No

Name: C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

PID: 2492

Hidden: No

Window Visible: No

Name: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PID: 2772

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\TUProgSt.exe

PID: 2792

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\ZuneBusEnum.exe

PID: 2908

Hidden: No

Window Visible: No

Name: C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PID: 3056

Hidden: No

Window Visible: No

Name: C:\Program Files\iPod\bin\iPodService.exe

PID: 1572

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\wbem\wmiprvse.exe

PID: 700

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\alg.exe

PID: 2672

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\wbem\unsecapp.exe

PID: 2744

Hidden: No

Window Visible: No

Name: C:\Program Files\Internet Download Manager\IEMonitor.exe

PID: 3472

Hidden: No

Window Visible: No

Name: C:\WINDOWS\system32\wuauclt.exe

PID: 3780

Hidden: No

Window Visible: No

Name: C:\Program Files\Internet Explorer\iexplore.exe

PID: 1716

Hidden: No

Window Visible: No

Name: C:\Program Files\Internet Explorer\iexplore.exe

PID: 2324

Hidden: No

Window Visible: No

Name: C:\Documents and Settings\me\Desktop\SysProt\SysProt.exe

PID: 2392

Hidden: No

Window Visible: Yes

********************************************************************************

**********

********************************************************************************

**********

Kernel Modules:

Module Name: \??\C:\Documents and Settings\me\Desktop\SysProt\SysProtDrv.sys

Service Name: SysProtDrv.sys

Module Base: B4512000

Module End: B451D000

Hidden: No

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Service Name: ---

Module Base: 804D7000

Module End: 8070D280

Hidden: No

Module Name: \WINDOWS\system32\hal.dll

Service Name: ---

Module Base: 8070E000

Module End: 8072E380

Hidden: No

Module Name: \WINDOWS\system32\KDCOM.DLL

Service Name: ---

Module Base: F7987000

Module End: F7989000

Hidden: No

Module Name: \WINDOWS\system32\BOOTVID.dll

Service Name: ---

Module Base: F7897000

Module End: F789A000

Hidden: No

Module Name: mghavho.sys

Service Name: ---

Module Base: F7487000

Module End: F7496000

Hidden: Yes

Module Name: C:\WINDOWS\system32\drivers\ACPI.sys

Service Name: ACPI

Module Base: F7438000

Module End: F7466000

Hidden: No

Module Name: \WINDOWS\system32\DRIVERS\WMILIB.SYS

Service Name: ---

Module Base: F7989000

Module End: F798B000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\pci.sys

Service Name: PCI

Module Base: F7427000

Module End: F7438000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\isapnp.sys

Service Name: isapnp

Module Base: F7497000

Module End: F74A0000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ohci1394.sys

Service Name: ohci1394

Module Base: F74A7000

Module End: F74B6000

Hidden: No

Module Name: \WINDOWS\system32\DRIVERS\1394BUS.SYS

Service Name: ---

Module Base: F74B7000

Module End: F74C4000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\pciide.sys

Service Name: PCIIde

Module Base: F7A4F000

Module End: F7A50000

Hidden: No

Module Name: \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

Service Name: ---

Module Base: F7707000

Module End: F770E000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\MountMgr.sys

Service Name: MountMgr

Module Base: F74C7000

Module End: F74D2000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ftdisk.sys

Service Name: Disk

Module Base: F7408000

Module End: F7427000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\dmload.sys

Service Name: dmload

Module Base: F798B000

Module End: F798D000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\dmio.sys

Service Name: dmio

Module Base: F73E2000

Module End: F7408000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\nvraid.sys

Service Name: nvraid

Module Base: F73CD000

Module End: F73E2000

Hidden: No

Module Name: \WINDOWS\system32\drivers\CLASSPNP.SYS

Service Name: ---

Module Base: F74D7000

Module End: F74E4000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\PartMgr.sys

Service Name: PartMgr

Module Base: F770F000

Module End: F7714000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\VolSnap.sys

Service Name: VolSnap

Module Base: F74E7000

Module End: F74F4000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\atapi.sys

Service Name: atapi

Module Base: F73B5000

Module End: F73CD000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\nvatabus.sys

Service Name: nvatabus

Module Base: F739C000

Module End: F73B5000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\SI3132.sys

Service Name: SI3132

Module Base: F738B000

Module End: F739C000

Hidden: No

Module Name: \WINDOWS\system32\DRIVERS\SCSIPORT.SYS

Service Name: ScsiPort

Module Base: F7373000

Module End: F738B000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\disk.sys

Service Name: ---

Module Base: F74F7000

Module End: F7500000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\fltmgr.sys

Service Name: FltMgr

Module Base: F733A000

Module End: F735A000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\sr.sys

Service Name: sr

Module Base: F7328000

Module End: F733A000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\PxHelp20.sys

Service Name: PxHelp20

Module Base: F7717000

Module End: F771C000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\SiWinAcc.sys

Service Name: SiFilter

Module Base: F789B000

Module End: F789E000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\KSecDD.sys

Service Name: KSecDD

Module Base: F72FB000

Module End: F7312000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\WudfPf.sys

Service Name: WudfPf

Module Base: F72E8000

Module End: F72FB000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\Ntfs.sys

Service Name: Ntfs

Module Base: F725B000

Module End: F72E8000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\NDIS.sys

Service Name: NDIS

Module Base: F722E000

Module End: F725B000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\Mup.sys

Service Name: Mup

Module Base: F7213000

Module End: F722E000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ABIT-IO.sys

Service Name: ABIT-IO

Module Base: F7727000

Module End: F772D000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\processr.sys

Service Name: Processor

Module Base: F7567000

Module End: F7570000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

Service Name: nv

Module Base: F6A14000

Module End: F71CB000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS

Service Name: ---

Module Base: F6A00000

Module End: F6A14000

Hidden: No

Module Name: C:\WINDOWS\System32\drivers\pivot.sys

Service Name: pivot

Module Base: F7577000

Module End: F7581000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\usbohci.sys

Service Name: usbohci

Module Base: F77CF000

Module End: F77D4000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS

Service Name: ---

Module Base: F69DD000

Module End: F6A00000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\usbehci.sys

Service Name: usbehci

Module Base: F77FF000

Module End: F7806000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\imapi.sys

Service Name: Imapi

Module Base: F7587000

Module End: F7592000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\cdrom.sys

Service Name: Cdrom

Module Base: F7597000

Module End: F75A7000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\redbook.sys

Service Name: redbook

Module Base: F75A7000

Module End: F75B6000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ks.sys

Service Name: ---

Module Base: F69BA000

Module End: F69DD000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

Service Name: GEARAspiWDM

Module Base: F75B7000

Module End: F75C1000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ctaud2k.sys

Service Name: ctaud2k

Module Base: F693A000

Module End: F69BA000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\portcls.sys

Service Name: ---

Module Base: F6916000

Module End: F693A000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\drmk.sys

Service Name: ---

Module Base: F75C7000

Module End: F75D6000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ctoss2k.sys

Service Name: ossrv

Module Base: F68E2000

Module End: F6916000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ctprxy2k.sys

Service Name: ctprxy2k

Module Base: F7877000

Module End: F787F000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\nic1394.sys

Service Name: NIC1394

Module Base: F75D7000

Module End: F75E7000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

Service Name: nvnetbus

Module Base: F75E7000

Module End: F75F0000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\NVNRM.SYS

Service Name: ---

Module Base: F67DD000

Module End: F68E2000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\NVSNPU.SYS

Service Name: ---

Module Base: F678A000

Module End: F67DD000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ASACPI.sys

Service Name: MTsensor

Module Base: F7999000

Module End: F799B000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\audstub.sys

Service Name: audstub

Module Base: F7B99000

Module End: F7B9A000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys

Service Name: Rasl2tp

Module Base: F75F7000

Module End: F7604000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ndistapi.sys

Service Name: NdisTapi

Module Base: F7967000

Module End: F796A000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ndiswan.sys

Service Name: NdisWan

Module Base: F66D3000

Module End: F66EA000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\raspppoe.sys

Service Name: RasPppoe

Module Base: F7607000

Module End: F7612000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\raspptp.sys

Service Name: PptpMiniport

Module Base: F7617000

Module End: F7623000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\TDI.SYS

Service Name: ---

Module Base: F77BF000

Module End: F77C4000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\psched.sys

Service Name: PSched

Module Base: F66C2000

Module End: F66D3000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\msgpc.sys

Service Name: Gpc

Module Base: F7627000

Module End: F7630000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ptilink.sys

Service Name: Ptilink

Module Base: F77EF000

Module End: F77F4000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\raspti.sys

Service Name: Raspti

Module Base: F7807000

Module End: F780C000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\PdiPorts.sys

Service Name: PdiPorts

Module Base: F797F000

Module End: F7982000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\rdpdr.sys

Service Name: rdpdr

Module Base: F6669000

Module End: F669A000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\termdd.sys

Service Name: TermDD

Module Base: F7637000

Module End: F7641000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\kbdclass.sys

Service Name: Kbdclass

Module Base: F785F000

Module End: F7865000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\mouclass.sys

Service Name: Mouclass

Module Base: F786F000

Module End: F7875000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\SaiNtBus.sys

Service Name: SaiNtBus

Module Base: F7887000

Module End: F788E000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\swenum.sys

Service Name: swenum

Module Base: F79A3000

Module End: F79A5000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\update.sys

Service Name: Update

Module Base: F6635000

Module End: F6669000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\mssmbios.sys

Service Name: mssmbios

Module Base: F71DF000

Module End: F71E3000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\a347bus.sys

Service Name: a347bus

Module Base: F71D7000

Module End: F71DA000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\zumbus.sys

Service Name: zumbus

Module Base: F7647000

Module End: F7651000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS

Service Name: ---

Module Base: F7657000

Module End: F7664000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\wdf01000.sys

Service Name: Wdf01000

Module Base: F65B9000

Module End: F6635000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\windrvr6.sys

Service Name: WinDriver6

Module Base: F658D000

Module End: F65B9000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\NDProxy.SYS

Service Name: NDProxy

Module Base: F7667000

Module End: F7671000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\SaiMini.sys

Service Name: SaiMini

Module Base: F795F000

Module End: F7963000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS

Service Name: ---

Module Base: F7677000

Module End: F7680000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS

Service Name: ---

Module Base: F780F000

Module End: F7816000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\mouhid.sys

Service Name: mouhid

Module Base: F66BE000

Module End: F66C1000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\kbdhid.sys

Service Name: kbdhid

Module Base: F66B6000

Module End: F66BA000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\usbhub.sys

Service Name: usbhub

Module Base: F7687000

Module End: F7696000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\USBD.SYS

Service Name: ---

Module Base: F79B3000

Module End: F79B5000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

Service Name: NVENETFD

Module Base: F76A7000

Module End: F76B4000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ha20x2k.sys

Service Name: ha20x2k

Module Base: EDFA3000

Module End: EE0C5000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\emupia2k.sys

Service Name: emupia

Module Base: EDF74000

Module End: EDFA3000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ctsfm2k.sys

Service Name: ctsfm2k

Module Base: EDF4B000

Module End: EDF74000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\ctac32k.sys

Service Name: ctac32k

Module Base: EDEAF000

Module End: EDF4B000

Hidden: No

Module Name: C:\WINDOWS\system32\CTHWIUT.DLL

Service Name: CTHWIUT.DLL

Module Base: EDE9A000

Module End: EDEAF000

Hidden: No

Module Name: C:\WINDOWS\system32\CT20XUT.DLL

Service Name: CT20XUT.DLL

Module Base: EDE6E000

Module End: EDE9A000

Hidden: No

Module Name: C:\WINDOWS\system32\CTEXFIFX.DLL

Service Name: CTEXFIFX.DLL

Module Base: EDD27000

Module End: EDE6E000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS

Service Name: Cdr4_xp

Module Base: F76D7000

Module End: F76E2000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS

Service Name: Cdralw2k

Module Base: F77E7000

Module End: F77EE000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\pwd_2k.SYS

Service Name: pwd_2k

Module Base: EDD0A000

Module End: EDD27000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

Service Name: Fs_Rec

Module Base: F79CF000

Module End: F79D1000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Null.SYS

Service Name: Null

Module Base: F7B37000

Module End: F7B38000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Beep.SYS

Service Name: Beep

Module Base: F79D3000

Module End: F79D5000

Hidden: No

Module Name: C:\WINDOWS\System32\drivers\vga.sys

Service Name: VgaSave

Module Base: F784F000

Module End: F7855000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\mnmdd.SYS

Service Name: mnmdd

Module Base: F79D7000

Module End: F79D9000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

Service Name: RDPCDD

Module Base: F79DB000

Module End: F79DD000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\cdudf_xp.SYS

Service Name: cdudf_xp

Module Base: EDCA4000

Module End: EDCEA000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\DVDVRRdr_xp.SYS

Service Name: DVDVRRdr_xp

Module Base: EDC6F000

Module End: EDC92000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Msfs.SYS

Service Name: Msfs

Module Base: F778F000

Module End: F7794000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Npfs.SYS

Service Name: Npfs

Module Base: F779F000

Module End: F77A7000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\UDFReadr.SYS

Service Name: UDFReadr

Module Base: EDC04000

Module End: EDC35000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\rasacd.sys

Service Name: RasAcd

Module Base: F66B2000

Module End: F66B5000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ipsec.sys

Service Name: IPSec

Module Base: EDBDF000

Module End: EDBF2000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\tcpip.sys

Service Name: Tcpip

Module Base: EDB87000

Module End: EDBDF000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\netbt.sys

Service Name: NetBT

Module Base: EDB5F000

Module End: EDB87000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\ipnat.sys

Service Name: IpNat

Module Base: EDB3E000

Module End: EDB5F000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\wanarp.sys

Service Name: Wanarp

Module Base: F76F7000

Module End: F7700000

Hidden: No

Module Name: C:\WINDOWS\System32\drivers\ws2ifsl.sys

Service Name: WS2IFSL

Module Base: F669A000

Module End: F669D000

Hidden: No

Module Name: C:\WINDOWS\System32\drivers\afd.sys

Service Name: AFD

Module Base: EDAF4000

Module End: EDB16000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\arp1394.sys

Service Name: Arp1394

Module Base: F7547000

Module End: F7556000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\netbios.sys

Service Name: NetBIOS

Module Base: F7557000

Module End: F7560000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\rdbss.sys

Service Name: Rdbss

Module Base: EDAC9000

Module End: EDAF4000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\PQIMount.SYS

Service Name: PQIMount

Module Base: F7507000

Module End: F7510000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

Service Name: MRxSmb

Module Base: EDA0A000

Module End: EDA79000

Hidden: No

Module Name: \??\C:\Program Files\UltraISO\drivers\ISODrive.sys

Service Name: ISODrive

Module Base: ED9F3000

Module End: EDA0A000

Hidden: No

Module Name: \??\C:\WINDOWS\system32\drivers\ikhlayer.sys

Service Name: ikhlayer

Module Base: F677A000

Module End: F6787000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Fips.SYS

Service Name: Fips

Module Base: F676A000

Module End: F6773000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\AsIO.sys

Service Name: AsIO

Module Base: F79E3000

Module End: F79E5000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\usbccgp.sys

Service Name: usbccgp

Module Base: F783F000

Module End: F7847000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\LHidUsbK.Sys

Service Name: LHidUsbK

Module Base: F673A000

Module End: F6743000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

Service Name: USBSTOR

Module Base: F77A7000

Module End: F77AE000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\hidusb.sys

Service Name: HidUsb

Module Base: EDAA5000

Module End: EDAA8000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\LHidKE.Sys

Service Name: LHidKe

Module Base: F77B7000

Module End: F77BE000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\LMouKE.Sys

Service Name: LMouKE

Module Base: ED9BA000

Module End: ED9CB000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\Cdfs.SYS

Service Name: Cdfs

Module Base: F672A000

Module End: F673A000

Hidden: No

Module Name: \SystemRoot\System32\Drivers\dump_nvraid.sys

Service Name: ---

Module Base: ED9A5000

Module End: ED9BA000

Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_CLASSPNP.SYS

Service Name: ---

Module Base: F671A000

Module End: F6727000

Hidden: Yes

Module Name: C:\WINDOWS\System32\drivers\Dxapi.sys

Service Name: ---

Module Base: EDA81000

Module End: EDA84000

Hidden: No

Module Name: C:\WINDOWS\System32\watchdog.sys

Service Name: ---

Module Base: F777F000

Module End: F7784000

Hidden: No

Module Name: C:\WINDOWS\System32\drivers\dxgthk.sys

Service Name: ---

Module Base: F7B2E000

Module End: F7B2F000

Hidden: No

Module Name: \??\C:\WINDOWS\system32\Drivers\GDFSHK.SYS

Service Name: GdFsHook

Module Base: F774F000

Module End: F7756000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\RadProbe.sys

Service Name: RadProbe

Module Base: F77C7000

Module End: F77CC000

Hidden: No

Module Name: \??\C:\WINDOWS\system32\Drivers\GDTDI.SYS

Service Name: GdTdi

Module Base: B8690000

Module End: B869D000

Hidden: No

Module Name: C:\WINDOWS\system32\DRIVERS\LANPkt.sys

Service Name: LANPkt

Module Base: F79ED000

Module End: F79EF000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\ndisuio.sys

Service Name: Ndisuio

Module Base: B85DC000

Module End: B85E0000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\mrxdav.sys

Service Name: MRxDAV

Module Base: B8374000

Module End: B83A0000

Hidden: No

Module Name: \??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys

Service Name: BCMNTIO

Module Base: F7ADE000

Module End: F7ADF000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\wdmaud.sys

Service Name: wdmaud

Module Base: B826F000

Module End: B8284000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\sysaudio.sys

Service Name: sysaudio

Module Base: B83C0000

Module End: B83CF000

Hidden: No

Module Name: \??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys

Service Name: MAPMEM

Module Base: F7ADC000

Module End: F7ADD000

Hidden: No

Module Name: C:\WINDOWS\System32\DRIVERS\srv.sys

Service Name: Srv

Module Base: B4BCA000

Module End: B4C1C000

Hidden: No

Module Name: \??\C:\WINDOWS\system32\drivers\PfModNT.sys

Service Name: PfDetNT

Module Base: B4B8B000

Module End: B4BA2000

Hidden: No

Module Name: \??\C:\WINDOWS\system32\drivers\symlcbrd.sys

Service Name: symlcbrd

Module Base: F7777000

Module End: F777D000

Hidden: No

Module Name: C:\WINDOWS\System32\Drivers\HTTP.sys

Service Name: HTTP

Module Base: B47B2000

Module End: B47F3000

Hidden: No

Module Name: C:\WINDOWS\system32\drivers\kmixer.sys

Service Name: kmixer

Module Base: B425C000

Module End: B4287000

Hidden: No

********************************************************************************

**********

********************************************************************************

**********

No SSDT Hooks found

********************************************************************************

**********

********************************************************************************

**********

Kernel Hooks:

Hooked Function: PsTerminateSystemThread

At Address: 8057BF6D

Jump To: 8057A427

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitForKeyedEvent

At Address: 806487CF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReleaseKeyedEvent

At Address: 80648534

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenKeyedEvent

At Address: 80581E8F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateKeyedEvent

At Address: 805C7D14

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwYieldExecution

At Address: 804FB131

Jump To: 804DC052

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWriteVirtualMemory

At Address: 8057E5E7

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWriteRequestData

At Address: 80588EBD

Jump To: 80588B06

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWriteFileGather

At Address: 805D62F5

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWriteFile

At Address: 805780DC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitLowEventPair

At Address: 8064772A

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitHighEventPair

At Address: 80647794

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitForSingleObject

At Address: 80565311

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitForMultipleObjects

At Address: 80565878

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwWaitForDebugEvent

At Address: 806587E2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwVdmControl

At Address: 805B3927

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnmapViewOfSection

At Address: 80572EBE

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnlockVirtualMemory

At Address: 806257DC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnlockFile

At Address: 8058A317

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnloadKeyEx

At Address: 8064C22F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnloadKey

At Address: 8064C032

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwUnloadDriver

At Address: 8061845E

Jump To: 80530A6E

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTranslateFilePath

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTraceEvent

At Address: 80544D9F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTestAlert

At Address: 8057B32D

Jump To: 804E6199

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTerminateThread

At Address: 8057A921

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTerminateProcess

At Address: 80582C6F

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwTerminateJobObject

At Address: 8062E679

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSystemDebugControl

At Address: 806480C0

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSuspendThread

At Address: 805DF825

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSuspendProcess

At Address: 8062DD46

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwStopProfile

At Address: 80647F85

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwStartProfile

At Address: 80647DA7

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSignalAndWaitForSingleObject

At Address: 80515F2B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwShutdownSystem

At Address: 80645584

Jump To: 80665527

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetVolumeInformationFile

At Address: 806160AA

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetValueKey

At Address: 80574C24

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetUuidSeed

At Address: 805A70BD

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetTimerResolution

At Address: 805DFBAF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetTimer

At Address: 804E57A2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetThreadExecutionState

At Address: 805DF529

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetSystemTime

At Address: 80645E12

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetSystemPowerState

At Address: 80665531

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetSystemInformation

At Address: 8059EEE0

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetSystemEnvironmentValue

At Address: 8064719B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetSecurityObject

At Address: 8059A1BE

Jump To: 8059A16F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetQuotaInformationFile

At Address: 80615B72

Jump To: 80617E60

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetLowWaitHighEventPair

At Address: 806477FD

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetLowEventPair

At Address: 806478E0

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetLdtEntries

At Address: 8062CE5D

Jump To: 8062CBB3

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetIoCompletion

At Address: 80577D0B

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetIntervalProfile

At Address: 80647B42

Jump To: 8054890F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationToken

At Address: 805A466E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationThread

At Address: 80575740

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationProcess

At Address: 8056BD0F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationObject

At Address: 80586E01

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationKey

At Address: 8064C462

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationJobObject

At Address: 805A72C4

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationFile

At Address: 80577E36

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetInformationDebugObject

At Address: 80658A94

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetHighWaitLowEventPair

At Address: 8064786F

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetHighEventPair

At Address: 8064794A

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetEventBoostPriority

At Address: 80575B78

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetEvent

At Address: 8056849F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetEaFile

At Address: 80615818

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetDefaultUILanguage

At Address: 805AA7BF

Jump To: 8057F1D5

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetDefaultLocale

At Address: 805AA838

Jump To: 8057F7B6

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetDefaultHardErrorPort

At Address: 805D15BF

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetDebugFilterState

At Address: 8065AC57

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetContextThread

At Address: 8062C16D

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetBootOptions

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSetBootEntryOrder

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSecureConnectPort

At Address: 805859D4

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSaveMergedKeys

At Address: 8064BF8A

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSaveKeyEx

At Address: 8064BEB8

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwSaveKey

At Address: 8064BE22

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwResumeThread

At Address: 8057B83F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwResumeProcess

At Address: 8062DDA1

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRestoreKey

At Address: 8064BD7B

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwResetWriteWatch

At Address: 8053AF32

Jump To: 8053B148

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwResetEvent

At Address: 8059AD39

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRequestWakeupLatency

At Address: 8062A36A

Jump To: 805878E1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRequestWaitReplyPort

At Address: 80576EC1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRequestPort

At Address: 805DC8F1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRequestDeviceWakeup

At Address: 8062A56C

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReplyWaitReplyPort

At Address: 806218D9

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReplyWaitReceivePortEx

At Address: 8056996E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReplyWaitReceivePort

At Address: 80569E62

Jump To: 80569967

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReplyPort

At Address: 8057D4F8

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReplaceKey

At Address: 8064D25A

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRenameKey

At Address: 8064CD44

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRemoveProcessDebug

At Address: 8065911B

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRemoveIoCompletion

At Address: 80566079

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReleaseSemaphore

At Address: 8058919D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReleaseMutant

At Address: 80565610

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRegisterThreadTerminatePort

At Address: 8057B93E

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReadVirtualMemory

At Address: 8057E495

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReadRequestData

At Address: 80588CD0

Jump To: 80588B06

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReadFileScatter

At Address: 805D66BF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwReadFile

At Address: 8057122F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRaiseHardError

At Address: 806464CA

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwRaiseException

At Address: 804E2066

Jump To: 80506365

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueueApcThread

At Address: 80586F5A

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryVolumeInformationFile

At Address: 80570F92

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryVirtualMemory

At Address: 8056C2FA

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryValueKey

At Address: 8056B0C2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryTimerResolution

At Address: 80584578

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryTimer

At Address: 8059330D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySystemTime

At Address: 80592ACF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySystemInformation

At Address: 8057C4B4

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySystemEnvironmentValue

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySymbolicLinkObject

At Address: 8057EC37

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySemaphore

At Address: 8064678E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySecurityObject

At Address: 805DA9F2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQuerySection

At Address: 8057DCE9

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryQuotaInformationFile

At Address: 80615B8E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryPerformanceCounter

At Address: 805665B8

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryOpenSubKeys

At Address: 8064CB05

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryObject

At Address: 8057FC66

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryMutant

At Address: 80647999

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryMultipleValueKey

At Address: 8064C8FF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryKey

At Address: 8056EB78

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryIoCompletion

At Address: 80614F0B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryIntervalProfile

At Address: 80648012

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInstallUILanguage

At Address: 80586EDC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationToken

At Address: 8056C76D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationThread

At Address: 80566281

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationProcess

At Address: 8056BC3E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationPort

At Address: 806217FA

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationJobObject

At Address: 8058150D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationFile

At Address: 80572411

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryInformationAtom

At Address: 805D3637

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryFullAttributesFile

At Address: 8057D035

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryEvent

At Address: 8057EF77

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryEaFile

At Address: 806152CB

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryDirectoryObject

At Address: 80584D36

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryDirectoryFile

At Address: 805744E1

Jump To: 80574211

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryDefaultUILanguage

At Address: 8057F32A

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryDefaultLocale

At Address: 80565D31

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryDebugFilterState

At Address: 804F8E5E

Jump To: 80528235

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryBootOptions

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryBootEntryOrder

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwQueryAttributesFile

At Address: 805715CD

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPulseEvent

At Address: 8059ECBB

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwProtectVirtualMemory

At Address: 8057404C

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPrivilegedServiceAuditAlarm

At Address: 805A6F11

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPrivilegeObjectAuditAlarm

At Address: 805D85E2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPrivilegeCheck

At Address: 805DAB57

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPowerInformation

At Address: 80598520

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwPlugPlayControl

At Address: 805D9051

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenTimer

At Address: 80647466

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenThreadTokenEx

At Address: 8056BA0B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenThreadToken

At Address: 8056BAA9

Jump To: 8056BA04

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenThread

At Address: 8058897E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenSymbolicLinkObject

At Address: 8057EDC6

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenSemaphore

At Address: 805D78B5

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenSection

At Address: 805776A2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenProcessTokenEx

At Address: 8056C1F9

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenProcessToken

At Address: 8056C009

Jump To: 8056C1F2

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenProcess

At Address: 80573CA0

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenObjectAuditAlarm

At Address: 805DCB3B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenMutant

At Address: 8057A03D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenKey

At Address: 80567B05

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenJobObject

At Address: 8062E4DE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenIoCompletion

At Address: 80614E4A

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenFile

At Address: 80570D05

Jump To: 80570BF3

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenEventPair

At Address: 80647630

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenEvent

At Address: 80586CCC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwOpenDirectoryObject

At Address: 8057EEFA

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwNotifyChangeMultipleKeys

At Address: 8058C211

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwNotifyChangeKey

At Address: 8058C168

Jump To: 8058C20A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwNotifyChangeDirectoryFile

At Address: 8058CE31

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwModifyBootEntry

At Address: 80647466

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwMapViewOfSection

At Address: 80573303

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwMapUserPhysicalPagesScatter

At Address: 806248E3

Jump To: 804D959C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwMapUserPhysicalPages

At Address: 8062440F

Jump To: 804D959C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwMakeTemporaryObject

At Address: 8059D9C6

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwMakePermanentObject

At Address: 8059D7D2

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLockVirtualMemory

At Address: 805AC13E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLockRegistryKey

At Address: 805D0866

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLockProductActivationKeys

At Address: 805ACCD1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLockFile

At Address: 8058A1B7

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLoadKey2

At Address: 805AAB45

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLoadKey

At Address: 805AACFD

Jump To: 805AAB3E

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwLoadDriver

At Address: 805A08F3

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwListenPort

At Address: 805A6DDD

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwIsSystemResumeAutomatic

At Address: 8062A5D6

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwIsProcessInJob

At Address: 8062E15F

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwInitiatePowerAction

At Address: 8062A3A2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwInitializeRegistry

At Address: 8059F828

Jump To: 804DCDEC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwImpersonateThread

At Address: 8057E7FE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwImpersonateClientOfPort

At Address: 80588511

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwImpersonateAnonymousToken

At Address: 805963FA

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwGetWriteWatch

At Address: 8053AA89

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwGetPlugPlayEvent

At Address: 8059C085

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwGetDevicePowerState

At Address: 8062A5D6

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwGetContextThread

At Address: 805DF7DD

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFsControlFile

At Address: 80579AC5

Jump To: 8057986A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFreeVirtualMemory

At Address: 805686D1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFreeUserPhysicalPages

At Address: 806252D8

Jump To: 804D959C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFlushVirtualMemory

At Address: 80599A21

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFlushKey

At Address: 805DA2D7

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFlushInstructionCache

At Address: 80577981

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFlushBuffersFile

At Address: 8058C3FF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFindAtom

At Address: 805DC5D9

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwFilterToken

At Address: 805ACAFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwExtendSection

At Address: 80623D27

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwEnumerateValueKey

At Address: 8057EB2F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwEnumerateKey

At Address: 8056EE6F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwEnumerateBootEntries

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDuplicateToken

At Address: 8057D7FF

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDuplicateObject

At Address: 80573ABD

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDisplayString

At Address: 805BAED0

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeviceIoControlFile

At Address: 8057BFA0

Jump To: 8057986A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteValueKey

At Address: 8058EA01

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteObjectAuditAlarm

At Address: 80638708

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteKey

At Address: 80590F7F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteFile

At Address: 805D3C86

Jump To: 804E87B9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteBootEntry

At Address: 80647466

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDeleteAtom

At Address: 80589361

Jump To: 80577300

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDelayExecution

At Address: 805655A5

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDebugContinue

At Address: 8065917A

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwDebugActiveProcess

At Address: 80659045

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateWaitablePort

At Address: 8059ED72

Jump To: 805961A9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateToken

At Address: 805A4AD9

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateTimer

At Address: 8059A850

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateThread

At Address: 8057B1CC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateSymbolicLinkObject

At Address: 8059D4E2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateSemaphore

At Address: 805747D6

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateSection

At Address: 80564422

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateProfile

At Address: 80647B60

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateProcessEx

At Address: 80580421

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateProcess

At Address: 805AD351

Jump To: 8058041A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreatePort

At Address: 805963BF

Jump To: 805961A9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreatePagingFile

At Address: 805B77C2

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateNamedPipeFile

At Address: 8057F060

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateMutant

At Address: 80579F8F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateMailslotFile

At Address: 805D5229

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateKey

At Address: 8056E76B

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateJobSet

At Address: 8062E286

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateJobObject

At Address: 805A716D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateIoCompletion

At Address: 80592BEE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateFile

At Address: 80570D73

Jump To: 80570BF3

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateEventPair

At Address: 8064753F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateEvent

At Address: 8056AC6F

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateDirectoryObject

At Address: 8059E7D1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCreateDebugObject

At Address: 80657EA4

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwContinue

At Address: 804E200E

Jump To: 804E5FA6

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwConnectPort

At Address: 805894CC

Jump To: 805859CA

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCompressKey

At Address: 8064D167

Jump To: 80573C2C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCompleteConnectPort

At Address: 80586A83

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCompareTokens

At Address: 80588F0D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCompactKeys

At Address: 8064CEDC

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCloseObjectAuditAlarm

At Address: 80592433

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwClose

At Address: 80566B61

Jump To: 80566AC1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwClearEvent

At Address: 80568473

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCancelTimer

At Address: 804FA00E

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCancelIoFile

At Address: 805C5AA3

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwCancelDeviceWakeupRequest

At Address: 80647466

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAssignProcessToJobObject

At Address: 8059E456

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAreMappedFilesTheSame

At Address: 805D532F

Jump To: 804E72CF

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAllocateVirtualMemory

At Address: 80567DA7

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAllocateUuids

At Address: 805D8773

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAllocateUserPhysicalPages

At Address: 80624F04

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAllocateLocallyUniqueId

At Address: 8058A6D1

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAlertThread

At Address: 80579BE1

Jump To: 80563D68

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAlertResumeThread

At Address: 8062DDDB

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAdjustPrivilegesToken

At Address: 80591FC5

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAdjustGroupsToken

At Address: 80635C9A

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAddBootEntry

At Address: 80646EFE

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAddAtom

At Address: 805755A5

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckByTypeResultListAndAuditAlarmByHandle

At Address: 806386E2

Jump To: 805926A1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckByTypeResultListAndAuditAlarm

At Address: 80638697

Jump To: 805926A1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckByTypeResultList

At Address: 806364F8

Jump To: 8056FADD

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckByTypeAndAuditAlarm

At Address: 80592A6D

Jump To: 805926A1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckByType

At Address: 805870A8

Jump To: 8056FADD

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheckAndAuditAlarm

At Address: 80589487

Jump To: 805926A1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ZwAccessCheck

At Address: 8056FE10

Jump To: 8056FADD

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetThreadWin32Thread

At Address: 8057ABC8

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetThreadHardErrorsAreDisabled

At Address: 80508EF5

Jump To: 805081E8

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetProcessWindowStation

At Address: 80580F13

Jump To: 804D9050

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetProcessSecurityPort

At Address: 8059AA1F

Jump To: 806079E7

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetProcessPriorityByClass

At Address: 80568EA0

Jump To: 804E7F31

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetLoadImageNotifyRoutine

At Address: 8062BDEA

Jump To: 806437BC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetLegoNotifyRoutine

At Address: 805B63DE

Jump To: 805D8391

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetCreateThreadNotifyRoutine

At Address: 8062BCC8

Jump To: 806437BC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetCreateProcessNotifyRoutine

At Address: 8062BBF9

Jump To: 806438CC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsSetContextThread

At Address: 8062BF99

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsRevertToSelf

At Address: 8062BB37

Jump To: 8058764E

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsRestoreImpersonation

At Address: 8058841E

Jump To: 8057598F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsRemoveLoadImageNotifyRoutine

At Address: 8062BE5E

Jump To: 806438CC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsRemoveCreateThreadNotifyRoutine

At Address: 8062BD37

Jump To: 806438CC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsReferencePrimaryToken

At Address: 80563250

Jump To: 805631EC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsLookupThreadByThreadId

At Address: 8057734E

Jump To: 80565BDB

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsLookupProcessThreadByCid

At Address: 80576D9F

Jump To: 80565BDB

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsLookupProcessByProcessId

At Address: 80573E3B

Jump To: 80565BDB

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsIsThreadTerminating

At Address: 804E6EEE

Jump To: 805277F7

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsIsSystemThread

At Address: 80506DEA

Jump To: 804E4167

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsImpersonateClient

At Address: 805759CD

Jump To: 8056323B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetThreadSessionId

At Address: 80577322

Jump To: 804E739F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetThreadId

At Address: 804E5A47

Jump To: 804D8F05

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetThreadFreezeCount

At Address: 8051558B

Jump To: 804F3434

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessSessionId

At Address: 80503271

Jump To: 804E739F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessSecurityPort

At Address: 805DBB16

Jump To: 8054A807

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessImageFileName

At Address: 80505A1C

Jump To: 804F90BC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessExitTime

At Address: 8059AD04

Jump To: 8058B58C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessDebugPort

At Address: 804F74B9

Jump To: 804EC598

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetProcessCreateTimeQuadPart

At Address: 804FE857

Jump To: 804EE170

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetCurrentThread

At Address: 804E4A3A

Jump To: 804DBD32

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetCurrentProcessSessionId

At Address: 804E73D7

Jump To: 804E739F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetCurrentProcess

At Address: 804E466A

Jump To: 804E3661

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsGetContextThread

At Address: 805DF668

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsDereferencePrimaryToken

At Address: 80580DC4

Jump To: 804D9050

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsDereferenceImpersonationToken

At Address: 8062BAB9

Jump To: 804D9050

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsCreateSystemThread

At Address: 8057BDD3

Jump To: 8057AC92

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsCreateSystemProcess

At Address: 8062BF62

Jump To: 80580817

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsChargePoolQuota

At Address: 804FB851

Jump To: 804E6D0D

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: PsAssignImpersonationToken

At Address: 8057584D

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObSetSecurityObjectByPointer

At Address: 8059A2B3

Jump To: 804D9023

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObSetSecurityDescriptorInfo

At Address: 805D7C4A

Jump To: 80564F3F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObSetHandleAttributes

At Address: 8057AA9A

Jump To: 8057AAF9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObReleaseObjectSecurity

At Address: 80564EC2

Jump To: 80564F9A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObReferenceSecurityDescriptor

At Address: 8059AD04

Jump To: 8058B58C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObReferenceObjectByName

At Address: 80585FF4

Jump To: 8056343E

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObReferenceObjectByHandle

At Address: 80563DA3

Jump To: 80563D00

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObQueryObjectAuditingByHandle

At Address: 8058DB75

Jump To: 80565BDB

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObQueryNameString

At Address: 8057FD98

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObOpenObjectByPointer

At Address: 8056BB98

Jump To: 804E9889

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObOpenObjectByName

At Address: 805671E4

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObMakeTemporaryObject

At Address: 8059D956

Jump To: 804E35D4

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObLogSecurityDescriptor

At Address: 80576536

Jump To: 80576665

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObGetObjectSecurity

At Address: 80564DC1

Jump To: 80564F3F

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObFindHandleForObject

At Address: 805D7AD0

Jump To: 80573BCD

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObDereferenceObject

At Address: 8053C35F

Jump To: 804D9050

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObCreateObject

At Address: 805646EB

Jump To: 804E20D2

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObCloseHandle

At Address: 8056A065

Jump To: 80566AC1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObCheckObjectAccess

At Address: 80564E01

Jump To: 80564D96

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObCheckCreateObjectAccess

At Address: 8058A750

Jump To: 80564D96

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ObAssignSecurity

At Address: 805766B4

Jump To: 805761E9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeTerminateThread

At Address: 804F9DB7

Jump To: 804E40AE

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeSetEvent

At Address: 804E39C9

Jump To: 804DB77C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeResetEvent

At Address: 804E68FB

Jump To: 804DB77C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeInitializeTimerEx

At Address: 804FA3DD

Jump To: 804FA39D

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeInitializeTimer

At Address: 804FA3DD

Jump To: 804FA39D

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeInitializeSemaphore

At Address: 804EA55A

Jump To: 804E5D23

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeInitializeEvent

At Address: 804E87AA

Jump To: 804E6341

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeInitializeDeviceQueue

At Address: 80512709

Jump To: 804DA5C4

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeDetachProcess

At Address: 804EB8F0

Jump To: 804EB869

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeAttachProcess

At Address: 804EB97F

Jump To: 804EB7DA

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeAreApcsDisabled

At Address: 80516489

Jump To: 804EBF2D

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KeAcquireInterruptSpinLock

At Address: 80532082

Jump To: 804DA5D4

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KdEnableDebugger

At Address: 80531A85

Jump To: 80531B42

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: KdDisableDebugger

At Address: 80531A0C

Jump To: 80531B42

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoQueryVolumeInformation

At Address: 805B77AA

Jump To: 8057F949

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoQueryFileInformation

At Address: 8057FA78

Jump To: 8057F949

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoQueryFileDosDeviceName

At Address: 80614CE4

Jump To: 8057FA86

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoQueryDeviceDescription

At Address: 805AD8EA

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoOpenDeviceRegistryKey

At Address: 805A7773

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoOpenDeviceInterfaceRegistryKey

At Address: 805B4799

Jump To: 804E35D4

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoIsSystemThread

At Address: 80506DEA

Jump To: 804E4167

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetDiskDeviceObject

At Address: 8052DA07

Jump To: 804E6429

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetDeviceObjectPointer

At Address: 80593117

Jump To: 804DCFCC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetDeviceInterfaces

At Address: 805AD21C

Jump To: 805D93E7

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetDeviceInterfaceAlias

At Address: 8061881F

Jump To: 805D9A7C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetCurrentProcess

At Address: 804E466A

Jump To: 804E3661

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetConfigurationInformation

At Address: 805A5DD0

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoGetAttachedDeviceReference

At Address: 805068DB

Jump To: 804E8445

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoFreeMdl

At Address: 804ED80A

Jump To: 804E20F2

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoFreeIrp

At Address: 804E859A

Jump To: 804E243B

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoEnumerateDeviceObjectList

At Address: 8051061C

Jump To: 804D9023

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoDetachDevice

At Address: 8052D2AE

Jump To: 8066A01E

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoDeleteSymbolicLink

At Address: 805C1AF8

Jump To: 804DD0A8

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoDeleteDriver

At Address: 80580DC4

Jump To: 804D9050

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoDeleteDevice

At Address: 80508374

Jump To: 8059D924

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateSynchronizationEvent

At Address: 805C5D82

Jump To: 804DC978

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateSymbolicLink

At Address: 805A5FFA

Jump To: 804DCACC

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateStreamFileObjectEx

At Address: 8052D155

Jump To: 804F050A

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateStreamFileObject

At Address: 80614D56

Jump To: 8052D133

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateFileSpecifyDeviceObjectHint

At Address: 80579790

Jump To: 805709A9

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoCreateFile

At Address: 80570BF3

Jump To: F71D75F7

Module Name: C:\WINDOWS\system32\DRIVERS\a347bus.sys

Hooked Function: IoCancelIrp

At Address: 80504EDC

Jump To: 804E6429

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoAttachDeviceByPointer

At Address: 8052DE4F

Jump To: 8050B6F2

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExFreeToPagedLookasideList

At Address: 804E9819

Jump To: 804E20F2

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExFreePool

At Address: 8054B0B4

Jump To: 8054A807

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExEnumHandleTable

At Address: 805D7A76

Jump To: 80563CC1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExAllocatePoolWithTagPriority

At Address: 804EA841

Jump To: 804EA7A1

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExAllocatePoolWithQuotaTag

At Address: 804E6BDF

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExAllocatePoolWithQuota

At Address: 80545CE3

Jump To: 804E6B9C

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: ExAllocatePool

At Address: 8050B2FE

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: Kei386EoiHelper

At Address: 804DF090

Jump To: 804E52DD

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoReadPartitionTable

At Address: 805B9921

Jump To: 8054A944

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: IoAssignDriveLetters

At Address: 805BC024

Jump To: 805A5DB0

Module Name: \WINDOWS\system32\TUKERNEL.EXE

Hooked Function: Sysenter

At Address: ---

Jump To: 804DE6F0

Module Name: \WINDOWS\system32\TUKERNEL.EXE

********************************************************************************

**********

********************************************************************************

**********

No IRP Hooks found

********************************************************************************

**********

********************************************************************************

**********

Ports:

Local Address: BS.HSD1.WA.COMCAST.NET.:NETBIOS-SSN

Remote Address: 0.0.0.0:0

Type: TCP

Process: System

State: LISTENING

Local Address: BS:27015

Remote Address: LOCALHOST:1026

Type: TCP

Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

State: ESTABLISHED

Local Address: BS:27015

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

State: LISTENING

Local Address: BS:7438

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Microsoft ActiveSync\wcescomm.exe

State: LISTENING

Local Address: BS:5679

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Microsoft ActiveSync\wcescomm.exe

State: LISTENING

Local Address: BS:5354

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: LISTENING

Local Address: BS:5152

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Program Files\Java\jre6\bin\jqs.exe

State: LISTENING

Local Address: BS:1043

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\WINDOWS\system32\alg.exe

State: LISTENING

Local Address: BS:1026

Remote Address: LOCALHOST:27015

Type: TCP

Process: C:\Program Files\iTunes\iTunesHelper.exe

State: ESTABLISHED

Local Address: BS:27000

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Autodesk Network License Manager\lmgrd.exe

State: LISTENING

Local Address: BS:2080

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\Autodesk Network License Manager\adskflex.exe

State: LISTENING

Local Address: BS:990

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\PROGRA~1\MICROS~1\rapimgr.exe

State: LISTENING

Local Address: BS:MICROSOFT-DS

Remote Address: 0.0.0.0:0

Type: TCP

Process: System

State: LISTENING

Local Address: BS:EPMAP

Remote Address: 0.0.0.0:0

Type: TCP

Process: C:\WINDOWS\system32\svchost.exe

State: LISTENING

Local Address: BS.HSD1.WA.COMCAST.NET.:5353

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: BS.HSD1.WA.COMCAST.NET.:1900

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\svchost.exe

State: NA

Local Address: BS.HSD1.WA.COMCAST.NET.:138

Remote Address: NA

Type: UDP

Process: System

State: NA

Local Address: BS.HSD1.WA.COMCAST.NET.:NETBIOS-NS

Remote Address: NA

Type: UDP

Process: System

State: NA

Local Address: BS.HSD1.WA.COMCAST.NET.:123

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\svchost.exe

State: NA

Local Address: BS:44301

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\PnkBstrA.exe

State: NA

Local Address: BS:1900

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\svchost.exe

State: NA

Local Address: BS:1049

Remote Address: NA

Type: UDP

Process: C:\Program Files\Internet Explorer\iexplore.exe

State: NA

Local Address: BS:123

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\svchost.exe

State: NA

Local Address: BS:54388

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: BS:4500

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\lsass.exe

State: NA

Local Address: BS:1900

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\ZuneBusEnum.exe

State: NA

Local Address: BS:1037

Remote Address: NA

Type: UDP

Process: C:\Autodesk Network License Manager\adskflex.exe

State: NA

Local Address: BS:1025

Remote Address: NA

Type: UDP

Process: C:\Program Files\Bonjour\mDNSResponder.exe

State: NA

Local Address: BS:500

Remote Address: NA

Type: UDP

Process: C:\WINDOWS\system32\lsass.exe

State: NA

Local Address: BS:MICROSOFT-DS

Remote Address: NA

Type: UDP

Process: System

State: NA

********************************************************************************

**********

********************************************************************************

**********

Hidden files/folders:

Object: C:\Documents and Settings\me\My Documents\Downloads\Programs\vmware\VMWare v6.0.2 plus extras

Status: Access denied

Object: C:\Documents and Settings\me\My Documents\Downloads\Programs\vmware

Status: Access denied

MBAM Log

Malwarebytes' Anti-Malware 1.39

Database version: 2534

Windows 5.1.2600 Service Pack 2

7/30/2009 8:33:23 PM

mbam-log-2009-07-30 (20-33-19).txt

Scan type: Quick Scan

Objects scanned: 98753

Time elapsed: 6 minute(s), 20 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\mrxdavv.sys (Rootkit.Agent.H) -> No action taken.

c:\documents and settings\me\Desktop\avenger.exe (Trojan.Agnet) -> No action taken.

C:\WINDOWS\system32\kwave.sys (Trojan.Agent) -> No action taken.

Maurice Naggar · July 31, 2009

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not brew and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

=

We're going to remove only 2 of the drivers tagged by MBAM. (Avenger is not a bogey & is indeed ok.)

Double click on avenger.exe to run The Avenger.
Click OK.
Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.

Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.

Files to delete:C:\WINDOWS\system32\drivers\mrxdavv.sysC:\WINDOWS\system32\kwave.sys
Drivers to delete:mrxdavvkwave
Folders to delete:I:\recyclerJ:\recyclerK:\recyclerL:\recyclerM:\recyclern:\recycler

In the avenger window, click the Paste Script from Clipboard icon, button.
:!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
Click the Execute button.
You will be asked Are you sure you want to execute the current script?.
Click Yes.
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
Click Yes.
Your PC will now be rebooted.
Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

=

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1

Link 2

Link 3

* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop

If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:

then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

-------------------------------------------------------

A caution - Do not run Combofix more than once.

Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.

If this occurs, please reboot to restore the desktop.

Even when ComboFix appears to be doing nothing, look at your Drive light.

If it is flashing, Combofix is still at work.

=

RE-Enable your AntiVirus and AntiSpyware applications.

=

Download Random's System Information Tool (RSIT) by random/random from here and save it to your desktop.

Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Reply with copy of C:\Avenger.txt

C:\Combofix.txt

Log.txt

Info.txt

and advise, How is your system now ?

brew · August 3, 2009

I appologize for the delay in responding. I was away for a couple days.

Ran the steps as directed. ComboFix would not run under Combo-Fix so had to rename to ComboFix1. Below are all logs as requested.

MBAM is still seeing mrxdavv.sys and Kwave.sys. Mbam log also follows.

Avenger Log

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file "C:\WINDOWS\system32\drivers\mrxdavv.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\mrxdavv.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\kwave.sys" not found!

Deletion of file "C:\WINDOWS\system32\kwave.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\mrxdavv" not found!

Deletion of driver "mrxdavv" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\kwave" not found!

Deletion of driver "kwave" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Folder "I:\recycler" deleted successfully.

Error: could not open folder "J:\recycler"

Deletion of folder "J:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Folder "K:\recycler" deleted successfully.

Error: could not open folder "L:\recycler"

Deletion of folder "L:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "M:\recycler"

Deletion of folder "M:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "n:\recycler"

Deletion of folder "n:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

ComboFix Log

ComboFix 09-08-03.02 - me 08/03/2009 12:06.14.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1447 [GMT -7:00]

Running from: c:\documents and settings\me\Desktop\ComboFix1.exe

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\me\Favorites\America's Army .url

c:\windows\system32\drivers\mrxdavv.sys

c:\windows\system32\kwave.sys

.

((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))

.

2009-07-31 14:50 . 2009-07-31 14:50 -------- d-----w- C:\rsit

2009-07-31 02:48 . 2009-07-31 02:48 -------- d-----w- c:\program files\ERUNT

2009-07-30 21:35 . 2009-07-30 21:35 153104 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2009-07-30 21:30 . 2009-07-30 21:30 -------- d-s---w- C:\Combo-Fix

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\Si3114r5.sys

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\SENTINEL.SYS

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\AsInsHelp32.sys

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\ALCXWDM.SYS

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\a347scsi.sys

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\system32\drivers\a347bus.sys

2009-07-25 10:35 . 2009-07-25 10:35 8416 ----a-w- c:\windows\BS_DEF.sys

2009-07-24 14:09 . 2009-07-24 14:09 -------- d-----w- C:\rootrepeal

2009-07-21 14:51 . 2009-07-21 14:51 -------- d-----w- c:\windows\Sun

2009-07-16 13:59 . 2009-07-16 13:59 -------- d-----w- c:\program files\ESET

2009-07-16 13:28 . 2009-07-16 13:28 -------- d-----w- c:\program files\Java

2009-07-16 12:51 . 2009-07-16 12:51 -------- d-----w- c:\program files\CCleaner

2009-07-16 01:32 . 2009-07-16 01:32 -------- d-----w- c:\program files\Trend Micro

2009-07-16 00:03 . 2009-07-16 00:23 -------- d-----w- C:\123Qoobox

2009-07-15 22:26 . 2009-07-15 22:26 -------- d-----w- c:\program files\Sophos

2009-07-15 21:42 . 2009-07-15 21:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-03 20:36 . 2009-01-13 17:13 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 20:36 . 2009-01-13 17:13 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-03 19:13 . 2007-03-03 01:08 -------- d-----w- c:\documents and settings\me\Application Data\DMCache

2009-08-03 19:00 . 2007-02-21 05:24 -------- d-----w- c:\documents and settings\me\Application Data\R-Wipe&Clean

2009-08-03 18:54 . 2009-01-13 17:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-03 18:53 . 2009-01-21 23:28 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-07-25 10:35 . 2008-05-08 05:01 -------- d-----w- c:\program files\UltraLeecher

2009-07-24 01:56 . 2007-03-09 03:02 -------- d-----w- c:\program files\MagicISO

2009-07-16 23:42 . 2007-01-24 06:56 -------- d-----w- c:\program files\CoffeeCup Software

2009-07-16 20:19 . 2005-10-21 17:09 -------- d-----w- c:\program files\MasterSplitter

2009-07-16 13:28 . 2009-05-28 15:06 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-07-16 00:31 . 2005-06-10 11:42 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-07-12 15:22 . 2009-02-22 00:26 -------- d-----w- c:\documents and settings\me\Application Data\Vidalia

2009-07-12 15:22 . 2009-02-22 00:38 -------- d-----w- c:\documents and settings\me\Application Data\tor

2009-06-25 00:19 . 2009-06-25 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2009-06-25 00:17 . 2009-06-25 00:17 -------- d-----w- c:\program files\AGEIA Technologies

2009-06-25 00:17 . 2005-06-10 12:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-06-20 21:50 . 2008-10-15 16:15 889360 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-06-19 18:58 . 2009-06-09 13:48 -------- d-----w- c:\documents and settings\me\Application Data\nHancer

2009-06-17 02:02 . 2007-03-31 04:43 138016 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-06-17 02:02 . 2007-03-31 04:43 189392 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-06-16 19:54 . 2009-06-16 19:54 -------- d-----w- c:\program files\PopCap Games

2009-06-12 14:42 . 2009-06-12 14:39 -------- d-----w- c:\program files\nLite

2009-06-10 22:53 . 2009-06-06 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\AA3DeployClient

2009-06-10 22:35 . 2005-09-03 18:16 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2009-06-10 16:46 . 2007-04-10 04:13 -------- d-----w- c:\documents and settings\me\Application Data\IDM

2009-06-10 15:28 . 2009-06-10 15:28 3510272 ----a-w- c:\windows\system32\nvgames.dll

2009-06-10 15:28 . 2009-06-10 15:28 4022272 ----a-w- c:\windows\system32\nvdisps.dll

2009-06-10 15:28 . 2009-06-10 15:28 86016 ----a-w- c:\windows\system32\nvmctray.dll

2009-06-10 15:28 . 2009-06-10 15:28 168004 ----a-w- c:\windows\system32\nvsvc32.exe

2009-06-10 15:28 . 2009-06-10 15:28 143360 ----a-w- c:\windows\system32\nvcolor.exe

2009-06-10 15:28 . 2009-06-10 15:28 13758464 ----a-w- c:\windows\system32\nvcpl.dll

2009-06-10 15:28 . 2009-06-10 15:28 229376 ----a-w- c:\windows\system32\nvmccs.dll

2009-06-10 13:57 . 2009-06-10 13:57 -------- d-----w- c:\documents and settings\me\Application Data\IGN_DLM

2009-06-10 13:39 . 2005-06-10 12:01 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-06-10 13:38 . 2005-06-10 12:07 -------- d-----w- c:\program files\Symantec

2009-06-10 13:28 . 2009-01-29 00:25 -------- d-----w- c:\program files\Jigsaw Puzzle Platinum Edition

2009-06-10 13:03 . 2009-06-10 13:03 9998336 ----a-w- c:\windows\system32\nvoglnt.dll

2009-06-10 13:03 . 2009-06-10 13:03 815104 ----a-w- c:\windows\system32\nvapi.dll

2009-06-10 13:03 . 2009-06-10 13:03 8087712 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-06-10 13:03 . 2009-06-10 13:03 671744 ----a-w- c:\windows\system32\nvcuvid.dll

2009-06-10 13:03 . 2009-06-10 13:03 5908608 ----a-w- c:\windows\system32\nv4_disp.dll

2009-06-10 13:03 . 2009-06-10 13:03 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-06-10 13:03 . 2009-06-10 13:03 1580550 ----a-w- c:\windows\system32\nvdata.bin

2009-06-10 13:03 . 2009-06-10 13:03 151552 ----a-w- c:\windows\system32\nvcodins.dll

2009-06-10 13:03 . 2009-06-10 13:03 151552 ----a-w- c:\windows\system32\nvcod.dll

2009-06-10 13:03 . 2009-06-10 13:03 1310720 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-06-10 13:03 . 2006-12-31 04:30 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-06-09 13:49 . 2006-12-31 04:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA

2009-06-09 13:49 . 2009-06-09 13:47 -------- d-----w- c:\documents and settings\All Users\Application Data\nHancer

2009-06-09 13:34 . 2009-06-09 13:34 -------- d-----w- c:\program files\SystemRequirementsLab

2009-06-09 03:54 . 2005-09-28 00:06 -------- d-----w- c:\program files\TuneUp Utilities 2006

2009-06-09 03:53 . 2006-09-19 13:35 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-06-09 03:53 . 2006-09-19 13:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-06-09 03:46 . 2006-04-20 13:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-06-09 03:46 . 2006-04-20 13:32 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2009-06-09 03:44 . 2009-06-09 03:44 -------- d--h--w- c:\program files\Zero G Registry

2009-06-09 03:42 . 2007-10-06 16:57 -------- d-----w- c:\program files\IrfanView

2009-06-09 03:42 . 2005-06-10 12:01 -------- d-----w- c:\program files\Hewlett-Packard

2009-06-09 03:42 . 2006-09-15 06:03 -------- d-----w- c:\program files\IGN

2009-06-09 03:28 . 2005-06-10 12:01 -------- d-----w- c:\program files\Fraps

2009-06-09 03:27 . 2008-09-09 21:44 -------- d-----w- c:\program files\Exodus

2009-06-09 03:27 . 2005-08-12 06:52 -------- d-----w- c:\documents and settings\me\Application Data\Exodus

2009-06-09 03:26 . 2007-03-30 02:30 -------- d-----w- c:\program files\DAZ

2009-06-09 03:23 . 2005-06-10 11:59 -------- d-----w- c:\program files\ASUS

2009-06-09 03:22 . 2005-06-10 12:00 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-09 03:22 . 2006-12-26 04:19 -------- d-----w- c:\documents and settings\me\Application Data\Lavasoft

2009-06-09 03:21 . 2007-06-27 04:15 -------- d-----w- c:\program files\123Movies2PSP

2009-06-08 03:57 . 2006-10-15 10:01 4764 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2009-06-08 03:27 . 2009-06-08 03:27 906 ----a-w- C:\fix.bat

2009-06-06 02:32 . 2007-03-31 04:43 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-06-06 02:17 . 2009-06-06 02:16 -------- d-----w- c:\program files\America's Army test

2009-06-06 01:43 . 2008-03-08 22:17 142200 ----a-w- c:\documents and settings\me\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-06 01:01 . 2009-06-06 00:36 -------- d-----w- c:\documents and settings\All Users\Application Data\AA2DeployClient

2009-06-06 00:41 . 2009-06-06 00:36 280292 ----a-w- c:\documents and settings\All Users\Application Data\America's Army Deploy Client\dcds\patches\AA2DeployInstaller.exe

2009-06-04 23:39 . 2006-06-20 12:18 457248 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-06-03 22:41 . 2008-05-08 05:02 37472 ----a-w- c:\windows\Fonts\INFOview.fon\infoview.fon

2009-06-03 22:41 . 2008-05-08 05:02 -------- d-----w- c:\windows\Fonts\INFOview.fon

2009-05-28 18:59 . 2007-08-22 04:46 59160 ----a-w- c:\windows\system32\zlib.dll

2009-05-05 20:35 . 2009-05-05 20:35 604416 ----a-w- c:\windows\system32\TUProgSt.exe

2009-05-05 20:35 . 2009-05-05 20:35 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe

2003-08-27 22:19 . 2005-01-30 19:29 36963 ----a-r- c:\program files\Common Files\SM1updtr.dll

2009-07-22 21:00 . 2009-02-22 00:34 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-07-31_14.44.47 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-08-03 19:13 . 2009-08-03 19:13 16384 c:\windows\temp\Perflib_Perfdata_6ec.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2007-04-10 894720]

"RWipeD"="c:\program files\R-Wipe&Clean\rwiped.exe" [2007-02-15 32768]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2006-04-07 135168]

"DT HPW"="c:\program files\Portrait Displays\HP My Display\DTHtml.exe" [2007-06-29 278528]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2005-07-23 28160]

"CTxfiHlp"="CTXFIHLP.EXE" - c:\windows\system32\Ctxfihlp.exe [2008-07-11 19968]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsNetHood"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-10-19 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]

2005-01-31 23:13 49152 ----a-w- c:\progra~1\COMMON~1\stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Multi]

2005-04-17 23:36 90112 ----a-w- c:\program files\Stardock\ThinkDesk\Multiplicity\MultiWin32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt\0sprestrt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\America's Army test\\System\\ArmyOps.exe"=

R0 ABIT-IO;ABIT-IO;c:\windows\system32\drivers\ABIT-IO.SYS [10/13/2005 2:18 AM 7680]

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [10/13/2005 2:19 AM 16640]

R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [7/29/2004 5:13 AM 46779]

R2 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [3/6/2005 5:19 PM 3744]

R2 FLEXlm Service 1;FLEXlm Service 1;c:\autodesk network license manager\lmgrd.exe [1/29/2005 12:46 PM 659456]

R2 GdFsHook;McAfee Privacy Service File Guardian;c:\windows\system32\drivers\gdfshk.sys [9/17/2003 7:00 AM 26816]

R2 GdTdi;McAfee Privacy Service Transport Filter;c:\windows\system32\drivers\gdtdi.sys [9/17/2003 7:00 AM 33330]

R2 LANPkt;Linksys LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [10/13/2005 5:32 AM 8568]

R2 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [3/6/2005 5:19 PM 3904]

R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [11/17/2007 11:02 PM 15896]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [5/5/2009 1:35 PM 604416]

S0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [7/29/2004 4:33 AM 138780]

S1 atitray;atitray;\??\c:\program files\Ray Adams\ATI Tray Tools\atitray.sys --> c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [?]

S1 BS_DEF;BS_DEF;c:\windows\BS_DEF.sys [7/25/2009 3:35 AM 8416]

S1 esihdrv;esihdrv;\??\c:\docume~1\me\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\me\LOCALS~1\Temp\esihdrv.sys [?]

S1 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\A.tmp --> c:\windows\system32\A.tmp [?]

S1 UltraCrypt;UltraCrypt;c:\program files\UltraLeecher\UltraCrypt.sys [7/25/2009 3:35 AM 8416]

S2 NProtectService;Norton Unerase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE --> c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [?]

S2 WinDefend;Windows Defender Service;"c:\program files\Windows Defender\MsMpEng.exe" --> c:\program files\Windows Defender\MsMpEng.exe [?]

S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [1/15/2005 4:12 PM 5824]

S3 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;c:\macromedia\runtime\bin\jrunsvc.exe [3/22/2006 2:00 PM 61440]

S3 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;c:\macromedia\verity\k2\_nti40\bin\k2admin.exe [3/22/2006 1:59 PM 2732608]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [11/22/2008 10:18 PM 79360]

S3 CW50;CW50 Device;c:\windows\system32\drivers\CW50.sys [1/30/2005 12:38 PM 24059]

S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [10/13/2005 5:32 AM 11351]

S3 GuardDogEXE;McAfee Privacy Service;"c:\program files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE --> c:\program files\McAfee\McAfee Privacy Service\GUARDDOG.EXE [?]

S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\drivers\Razerlow.sys [4/15/2006 9:03 PM 19020]

S3 RTLVLANXP;Linksys VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLANXP.SYS [10/13/2005 5:32 AM 15360]

S3 SaiH8000;SaiH8000;c:\windows\system32\drivers\SaiH8000.sys [12/3/2004 4:54 PM 56704]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/chsi.html

mSearch Bar =

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm

IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MI8C0D~1\Office12\EXCEL.EXE/3000

IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

IE: SWF Capture tool - c:\program files\Eltima Software\Flash Decompiler\iebt.html

Trusted Zone: homeserver.com\sten

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

FF - ProfilePath - c:\documents and settings\me\Application Data\Mozilla\Firefox\Profiles\zrm9qe1b.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:blank

FF - component: c:\documents and settings\me\Application Data\Mozilla\Firefox\Profiles\zrm9qe1b.default\extensions\mozilla_cc@internetdownloadmanager.com\components\idmmzcc.dll

FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-03 12:13

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet019\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\A.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2025429265-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

[HKEY_LOCAL_MACHINE\software\Adobe\Premiere Elements\1.0\DefaultPreset]

@DACL=(02 0000)

@="c:\\Program Files\\Adobe\\Premiere Elements 1.0\\Settings\\en_US\\DV - NTSC\\Standard 48kHz.prpreset"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]

@Denied: (Full) (Everyone)

"scansk"=hex(0):48,c0,14,cc,2e,45,08,38,f7,94,67,21,87,d5,01,06,f2,ff,86,af,1d,

d6,80,42,69,be,99,55,3a,b9,2f,85,81,b0,e3,84,64,35,ef,a7,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{64017f5b-2b70-44f0-83e3-a2dc513e5c71}]

@Denied: (Full) (Everyone)

"Model"=dword:000000b8

"Therad"=dword:00000015

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,40,02,13,ad,75,b8,fc,03,0e,19,9b,7e,c0,c3,5d,71,13,89,b2,ee,89,f3,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]

@Denied: (Full) (Everyone)

"scansk"=hex(0):91,2a,bc,17,b0,c7,f8,44,b1,5a,8b,23,96,15,ff,81,96,f7,82,23,d6,

5f,ba,24,65,7d,73,c1,07,1b,5e,fd,4c,3a,0c,df,0c,99,49,c2,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{bc7f883f-b90e-4416-acc3-432d452bef72}]

@Denied: (Full) (Everyone)

"Model"=dword:0000005a

"Therad"=dword:0000001e

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,5e,47,40,e8,4d,7f,cb,bf,64,f3,e2,01,bd,95,48,9e,2c,fd,f1,78,d9,1d,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]

"Version"=hex:2c,06,cf,67,cc,4f,e1,eb,a8,36,28,a1,ed,75,14,aa,7b,d9,d0,cc,0d,

d2,af,05,19,c1,7a,96,0d,ac,7e,27,81,4a,da,02,84,9e,ec,c7,43,d7,d9,19,f0,d9,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG08.00.00.01WORKSTATION"="378430C5F33F3FA6C9DEBFB3740888654B1BF4E1EDC905B16DA7748A36F22987C80A30D277B

B132B336C3C47AEC0C972583E70756CA44F202EDD6208764AF34EFEBC9E127BECC74CFEBC9E127BE

C

C74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6

E

667C038D530D6EB3452A6A0AC4980AC7933A6171C11EC38DE3D90A2DB1AC4F113DC312B7F87ABF6F

0

1B16B016794245C0A8EADC31027C8C4E1337067156ECECA4FA595BFAF3E1AD687F3EA5B753C78187

B

9F8126F2CE56332492095273F63F4AA697BD8DA46A5F95F1F88B3FE5B6F5F56734D43567E63CCEFB

D

707F94AD45D169FEB1F1557E1898C449276DDD577F28EABCCB61362D0146AE13E3B407DA83539837

A

D395380AF45FD72DB247B7493ADF5A3EC1F124B1ED0908F49E9FD6562C9E032B005F391B6C4E2B28

0

6EB2449A429D5A3F7622536EEF241B8019B04FF90BE33092EE07DF4A5D3FC581A890B9D63E78B2E3

2

3D1A2792CF045027E04FEB8F0B39A3F5592F85D5A530C5DF1D9AEDF7D95A810A4C0F91C14F03FD79

B

973FDDD8D5F9355AD0CF348852082BAC835E9EDEF4D70DBEC00085B591609EB6B9BDFDA4C77F8764

A

DBDE83BE4E21101B7E854478C7F377ADC3C3928B5208AD6EF0F04BAF77DDE1D4DFC694A28684C58D

6

54911CC4878124CC1D1081B21FE0C9F2A6AB03C7E9F4F203ACF78F2A87ACE371083E4B7A77EF4B03

F

4B361D21C7CA22F6084EB8F5F991959CF2A69EFD59695CECF944300FB1C442177A5E6D4804B33C47

B

74679A1EB0040DCF68BAF10A02A4695DA4789866B227FEBF39B569D34F18881834EBA709AF6E1176

7

3E91B7FFC8D70444F61FD2B76D029C896F737C39EAB83BE5071692625D689F4D9624CB7258DC5FCC

D

7ADC633BE05EF6395AD724E411F059A9768621ACFE50DB8312D855302980E32744574C6B3B128CEF

8

CDAE95F2CC235757C9AC8FBEC7224A9EB0A21E5266ABA3EC0814683886B36DFC3412E60A61C06BB8

9

350FD9EB3329D8679A86A39102A3C3F8655695B3477F80B80030CD6D56E1D9A7D88BA108862B757D

3

B1558B8F9A73EF6FDA5C6EEB5D91DA703D0A2B2FEC280E2FBF84195164B332E0F0189AFB9358A4CB

E

02CE2CF61BD65227166EE9D38733CD8A373D2A40921CFAAFA2CE4EDA99540B8B5A7CA5857C1F7C3E

A

ACF4D4CF14DFD6347AC1F16EC8EEB28F553AEAB0C9F4BBC45B0D58B1B406D8F5C80D90F29790ED85

2

3B935C29BC0AF81AD92FAFA2C42A20F961FDE9785474541CC9D07937391A332128688E79AA6594D2

3

4751D5B6DC4F7571722327A4B613B0088371C8A61C42CA446455877348F65894DE55D961740765DE

E

0A2DE9E8876443B0563A761B34736E7C139B1D8520C6C71FAE101896C347AF1A42D6754641E74248

3

ACE2F6190AC354601EEC921320740"

[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]

"Version"=hex:2c,06,cf,67,cc,4f,e1,eb,a8,36,28,a1,ed,75,14,aa,7b,d9,d0,cc,0d,

d2,af,05,19,c1,7a,96,0d,ac,7e,27,81,4a,da,02,84,9e,ec,c7,43,d7,d9,19,f0,d9,\

[HKEY_LOCAL_MACHINE\System\ControlSet019\Enum\HID\Vid_1532&Pid_0101&MI_00\7&59c965e&0&0000\LogConf]

@DACL=(02 0000)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1684)

c:\progra~1\COMMON~1\Stardock\mcpstub.dll

c:\program files\Stardock\ThinkDesk\Multiplicity\MultiWin32.dll

- - - - - - - > 'explorer.exe'(3284)

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\progra~1\COMMON~1\stardock\MCPCore.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\hnetcfg.dll

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\Shellex.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Creative\Shared Files\CTAudSvc.exe

c:\progra~1\COMMON~1\stardock\SDMCP.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe

c:\progra~1\MICROS~1\rapimgr.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\autodesk network license manager\adskflex.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\Webroot\Spy Sweeper\WRSSSDK.exe

c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

c:\windows\system32\ZuneBusEnum.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\wbem\unsecapp.exe

.

**************************************************************************

.

Completion time: 2009-08-03 12:18 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-03 19:18

ComboFix2.txt 2009-07-31 14:49

ComboFix3.txt 2009-07-30 21:11

Pre-Run: 20,003,905,536 bytes free

Post-Run: 19,896,487,936 bytes free

335 --- E O F --- 2008-10-15 15:56

Log.txt

Logfile of random's system information tool 1.06 (written by random/random)

Run by me at 2009-08-03 12:24:57

Microsoft Windows XP Professional Service Pack 2

System drive C: has 19 GB (13%) free of 142 GB

Total RAM: 2046 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:24:57 PM, on 8/3/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Creative\Shared Files\CTAudSvc.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\nvraidservice.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\R-Wipe&Clean\rwiped.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\MICROS~1\rapimgr.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Autodesk Network License Manager\lmgrd.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Autodesk Network License Manager\adskflex.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\WINDOWS\system32\ZuneBusEnum.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\me\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\me.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/chsi.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [RWipeD] C:\Program Files\R-Wipe&Clean\rwiped.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI8C0D~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

O8 - Extra context menu item: SWF Capture tool - C:\Program Files\Eltima Software\Flash Decompiler\iebt.html

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...677/mcfscan.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI8C0D~1\Office12\GR99D3~1.DLL

O20 - AppInit_DLLs: C:\WINDOWS\system32\acaptuser32.dll

O20 - Winlogon Notify: Multi - C:\Program Files\Stardock\ThinkDesk\Multiplicity\MultiWin32.dll

O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Gateway\EzTune\dtsslsrv.exe (file missing)

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: ColdFusion MX 7 Application Server - Macromedia Inc. - C:\macromedia\runtime\bin\jrunsvc.exe

O23 - Service: ColdFusion MX 7 Search Server - Verity, Inc. - C:\macromedia\verity\k2\_nti40\bin\k2admin.exe

O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe

O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe (file missing)

O23 - Service: FLEXlm Service 1 - Macrovision Corporation - C:\Autodesk Network License Manager\lmgrd.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe

O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe

O23 - Service: Sandra Data Service (SandraDataSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcDataSrv.exe (file missing)

O23 - Service: Sandra Service (SandraTheSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcSandraSrv.exe (file missing)

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: Speed Disk service - Unknown owner - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE (file missing)

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing)

O23 - Service: wampapache - Unknown owner - F:\wamp\apache2\bin\Apache.exe (file missing)

O23 - Service: wampmysqld - Unknown owner - F:\wamp\mysql\bin\mysqld-nt.exe (file missing)

O23 - Service: Windows Defender Service (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--

End of file - 11351 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"NVRaidService"=C:\WINDOWS\system32\nvraidservice.exe [2006-04-07 135168]

"Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2005-07-23 28160]

"DT HPW"=C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe [2007-06-29 278528]

"CTxfiHlp"=C:\WINDOWS\system32\CTXFIHLP.EXE [2008-07-11 19968]

"Zune Launcher"=C:\Program Files\Zune\ZuneLauncher.exe [2008-11-10 157312]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]

"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2008-06-12 37232]

"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-06-11 640376]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-06-10 13758464]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2007-04-09 894720]

"RWipeD"=C:\Program Files\R-Wipe&Clean\rwiped.exe [2007-02-14 32768]

"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="C:\WINDOWS\system32\acaptuser32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCPClient]

C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll [2005-01-31 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Multi]

C:\Program Files\Stardock\ThinkDesk\Multiplicity\MultiWin32.dll [2005-04-17 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - C:\PROGRA~1\COMMON~1\stardock\MCPCore.dll [2005-05-10 86016]

UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-04 239616]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]

IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll [2009-03-08 11063808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-10-19 293888]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoRecentDocsNetHood"=1

"NoDriveAutoRun"=67108863

"NoDriveTypeAutoRun"=323

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveAutoRun"=

"NoDrives"=

"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"

"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"

"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:*:Disabled:ActiveSync RAPI Manager"

"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"

"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"

"C:\Program Files\America's Army test\System\ArmyOps.exe"="C:\Program Files\America's Army test\System\ArmyOps.exe:*:Enabled:ArmyOps"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2"

======List of files/folders created in the last 1 months======

2009-08-03 12:23:28 ----SHD---- C:\RECYCLER

2009-08-03 12:18:11 ----A---- C:\ComboFix.txt

2009-07-31 07:50:43 ----D---- C:\rsit

2009-07-31 07:34:02 ----A---- C:\WINDOWS\zip.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\SWXCACLS.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\SWSC.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\SWREG.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\sed.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\PEV.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\NIRCMD.exe

2009-07-31 07:34:02 ----A---- C:\WINDOWS\grep.exe

2009-07-31 07:31:59 ----D---- C:\Qoobox

2009-07-31 07:28:01 ----A---- C:\avenger.txt

2009-07-30 19:55:13 ----D---- C:\Avenger

2009-07-30 19:48:11 ----D---- C:\Program Files\ERUNT

2009-07-30 14:30:24 ----SD---- C:\Combo-Fix

2009-07-24 07:20:05 ----A---- C:\WINDOWS\ntbtlog.txt

2009-07-24 07:09:00 ----D---- C:\rootrepeal

2009-07-21 07:51:30 ----D---- C:\WINDOWS\Sun

2009-07-16 06:59:39 ----D---- C:\Program Files\ESET

2009-07-16 06:28:02 ----D---- C:\Program Files\Java

2009-07-16 06:27:52 ----D---- C:\Documents and Settings\me\Application Data\Sun

2009-07-16 06:20:02 ----D---- C:\WINDOWS\temp

2009-07-16 05:51:43 ----D---- C:\Program Files\CCleaner

2009-07-15 22:49:46 ----A---- C:\RootRepeal report 07-15-09 (22-49-46).txt

2009-07-15 22:49:20 ----A---- C:\RootRepeal report 07-15-09 (22-49-20).txt

2009-07-15 20:42:25 ----A---- C:\Boot.bak

2009-07-15 20:42:22 ----RASHD---- C:\cmdcons

2009-07-15 18:41:15 ----A---- C:\RootRepeal report 07-15-09 (18-41-15).txt

2009-07-15 18:32:46 ----D---- C:\Program Files\Trend Micro

2009-07-15 17:23:37 ----D---- C:\WINDOWS\ERDNT

2009-07-15 17:03:24 ----D---- C:\123Qoobox

2009-07-15 15:26:00 ----D---- C:\Program Files\Sophos

======List of files/folders modified in the last 1 months======

2009-08-03 12:18:12 ----D---- C:\WINDOWS\system32\drivers

2009-08-03 12:18:12 ----D---- C:\WINDOWS\system32

2009-08-03 12:16:40 ----D---- C:\WINDOWS\system32\CatRoot2

2009-08-03 12:13:52 ----D---- C:\WINDOWS

2009-08-03 12:13:52 ----D---- C:\Documents and Settings\me\Application Data\DMCache

2009-08-03 12:13:52 ----A---- C:\WINDOWS\system.ini

2009-08-03 12:09:00 ----D---- C:\WINDOWS\AppPatch

2009-08-03 12:08:59 ----D---- C:\Program Files\Common Files

2009-08-03 12:05:39 ----A---- C:\WINDOWS\SchedLgU.Txt

2009-08-03 12:04:44 ----D---- C:\WINDOWS\Prefetch

2009-08-03 12:00:38 ----D---- C:\Documents and Settings\me\Application Data\R-Wipe&Clean

2009-08-03 11:58:22 ----D---- C:\WINDOWS\system32\config

2009-08-03 11:54:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-08-03 08:51:59 ----D---- C:\Program Files\Mozilla Firefox

2009-08-02 09:07:20 ----A---- C:\WINDOWS\NeroDigital.ini

2009-07-31 07:28:01 ----D---- C:\Program Files

2009-07-30 14:30:46 ----SHD---- C:\System Volume Information

2009-07-30 14:30:46 ----D---- C:\WINDOWS\system32\Restore

2009-07-30 10:21:10 ----D---- C:\flexlm

2009-07-25 20:57:31 ----RSHDC---- C:\WINDOWS\system32\dllcache

2009-07-25 03:35:23 ----D---- C:\Program Files\UltraLeecher

2009-07-23 18:57:10 ----D---- C:\Program Files\WinRAR

2009-07-23 18:56:16 ----D---- C:\Program Files\MagicISO

2009-07-19 09:34:28 ----RASH---- C:\boot.ini

2009-07-19 09:34:28 ----A---- C:\WINDOWS\win.ini

2009-07-16 16:42:00 ----D---- C:\Program Files\CoffeeCup Software

2009-07-16 13:19:48 ----D---- C:\Program Files\MasterSplitter

2009-07-16 06:59:42 ----SD---- C:\WINDOWS\Downloaded Program Files

2009-07-16 06:28:14 ----SHD---- C:\WINDOWS\Installer

2009-07-16 06:28:14 ----D---- C:\Config.Msi

2009-07-16 06:28:03 ----A---- C:\WINDOWS\system32\javaws.exe

2009-07-16 06:28:03 ----A---- C:\WINDOWS\system32\javaw.exe

2009-07-16 06:28:03 ----A---- C:\WINDOWS\system32\java.exe

2009-07-16 06:28:03 ----A---- C:\WINDOWS\system32\deploytk.dll

2009-07-15 17:31:28 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee

2009-07-15 17:22:47 ----SD---- C:\WINDOWS\Tasks

2009-07-13 20:21:33 ----A---- C:\WINDOWS\IfoEdit.INI

2009-07-12 08:22:08 ----D---- C:\Documents and Settings\me\Application Data\Vidalia

2009-07-12 08:22:05 ----D---- C:\Documents and Settings\me\Application Data\tor

2009-07-07 08:10:58 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2009-07-25 8416]

R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2005-12-21 5685]

R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2004-11-10 44288]

R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2004-11-10 24832]

R1 cdudf_xp;cdudf_xp; C:\WINDOWS\system32\drivers\cdudf_xp.sys [2004-04-13 285824]

R1 DVDVRRdr_xp;DVDVRRdr_xp; C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys [2004-04-13 140416]

R1 ikhlayer;Kernel Anti-Spyware Driver; \??\C:\WINDOWS\system32\drivers\ikhlayer.sys []

R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []

R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]

R1 pivot;pivot; C:\WINDOWS\System32\drivers\pivot.sys [2005-12-07 17465]

R1 PQIMount;PQIMount; C:\WINDOWS\system32\drivers\PQIMount.sys [2004-07-29 46779]

R1 pwd_2k;pwd_2k; C:\WINDOWS\system32\drivers\pwd_2k.sys [2004-04-13 117248]

R1 UDFReadr;UDFReadr; C:\WINDOWS\system32\drivers\UDFReadr.sys [2004-04-13 198528]

R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]

R2 BCMNTIO;BCMNTIO; \??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys []

R2 GdFsHook;McAfee Privacy Service File Guardian; \??\C:\WINDOWS\system32\Drivers\GDFSHK.SYS []

R2 GdTdi;McAfee Privacy Service Transport Filter; \??\C:\WINDOWS\system32\Drivers\GDTDI.SYS []

R2 LANPkt;Linksys LANPkt Protocol Driver; C:\WINDOWS\system32\DRIVERS\LANPkt.sys [2004-03-09 8568]

R2 MAPMEM;MAPMEM; \??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys []

R2 PfDetNT;PfDetNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []

R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []

R2 zumbus;Zune Bus Enumerator Driver; C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-11-10 40832]

R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-04 60800]

R3 catchme;catchme; \??\C:\ComboFix1\catchme.sys []

R3 CT20XUT.DLL;CT20XUT.DLL; C:\WINDOWS\system32\CT20XUT.DLL [2008-07-15 170520]

R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2008-07-15 511000]

R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2008-07-15 527384]

R3 CTEXFIFX.DLL;CTEXFIFX.DLL; C:\WINDOWS\system32\CTEXFIFX.DLL [2008-07-15 1323544]

R3 CTHWIUT.DLL;CTHWIUT.DLL; C:\WINDOWS\system32\CTHWIUT.DLL [2008-07-15 72728]

R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2008-07-15 14360]

R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2008-07-15 157208]

R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2008-07-15 92696]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]

R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2008-07-15 1173016]

R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]

R3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidKE.Sys [2005-07-23 26112]

R3 LHidUsbK;Logitech SetPoint USB Receiver device driver; C:\WINDOWS\System32\Drivers\LHidUsbK.Sys [2005-07-23 36608]

R3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2005-07-23 68864]

R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]

R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-04 61824]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-06-10 8087712]

R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-21 52736]

R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-21 18944]

R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2008-07-15 127000]

R3 PdiPorts;Portrait Displays low level device driver; C:\WINDOWS\System32\Drivers\PdiPorts.sys [2006-11-16 15920]

R3 RadProbe;Radeon Probe Driver; C:\WINDOWS\system32\DRIVERS\RadProbe.sys [2005-04-27 20428]

R3 SaiMini;SaiMini; C:\WINDOWS\system32\DRIVERS\SaiMini.sys [2004-07-26 15616]

R3 SaiNtBus;SaiNtBus; C:\WINDOWS\system32\drivers\SaiNtBus.sys [2004-07-26 26752]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]

R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]

R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]

R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]

R3 WinDriver6;WinDriver6; C:\WINDOWS\system32\drivers\windrvr6.sys [2004-09-07 316152]

S1 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2009-07-25 8416]

S1 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2009-07-25 8416]

S1 ASInsHelp;ASInsHelp; \??\C:\WINDOWS\system32\drivers\AsInsHelp32.sys []

S1 ATITool;ATITool Overclocking Utility; C:\WINDOWS\system32\DRIVERS\ATITool.sys [2005-06-16 28160]

S1 atitray;atitray; \??\C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys []

S1 BS_DEF;BS_DEF; \??\C:\WINDOWS\BS_DEF.sys []

S1 DS1410D;DS1410D; C:\WINDOWS\SYSTEM32\drivers\DS1410D.SYS []

S1 esihdrv;esihdrv; \??\C:\DOCUME~1\me\LOCALS~1\Temp\esihdrv.sys []

S1 Memctl;Memctl; \??\C:\Program Files\ABIT\ABIT uGuru\Memctl.sys []

S1 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\A.tmp []

S1 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR1\Sandra.sys []

S1 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2009-07-25 8416]

S1 Si3114r5;SiI-3114 SoftRaid 5 Controller; C:\WINDOWS\System32\DRIVERS\Si3114r5.sys [2009-07-25 8416]

S1 UltraCrypt;UltraCrypt; \??\C:\Program Files\UltraLeecher\UltraCrypt.sys []

S3 Asushwio;Asushwio; \??\C:\WINDOWS\system32\drivers\Asushwio.sys []

S3 ATI Remote Wonder II;ATI Remote Wonder II; C:\WINDOWS\system32\drivers\ATIRWVD.SYS [2004-01-23 258044]

S3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-08-03 701440]

S3 atinevxx;ATI WDM Rage Theater Video NSP; C:\WINDOWS\system32\DRIVERS\atinevxx.sys [2006-01-03 166400]

S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]

S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2008-07-15 347080]

S3 CW50;CW50 Device; C:\WINDOWS\system32\DRIVERS\CW50.sys [2002-07-01 24059]

S3 Diag69xp;Diag69xp; C:\WINDOWS\System32\Drivers\Diag69xp.sys [2004-05-24 11351]

S3 dvd_2K;dvd_2K; C:\WINDOWS\system32\drivers\dvd_2K.sys [2004-04-13 23680]

S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []

S3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2006-08-17 765952]

S3 hap16v2k;Creative P16V HAL Driver; C:\WINDOWS\system32\drivers\hap16v2k.sys [2006-08-17 154112]

S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2005-07-23 55040]

S3 mmc_2K;mmc_2K; C:\WINDOWS\system32\drivers\mmc_2K.sys [2004-04-13 23680]

S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]

S3 MVDCODEC;ATI WDM Specialized MVD Codec; C:\WINDOWS\system32\DRIVERS\atinmdxx.sys [2006-01-03 15360]

S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]

S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]

S3 NPDriver;Norton Unerase Protection Driver; \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS []

S3 pdiddcci;DDC/CI monitor; C:\WINDOWS\System32\DRIVERS\pdiddcci.sys [2007-06-12 11776]

S3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2004-04-01 10368]

S3 pivotmou;Pivot Mouse/Pointers Filter Driver; \??\C:\WINDOWS\System32\drivers\pivotmou.sys []

S3 Razerlow;Razer Copperhead Driver; C:\WINDOWS\System32\Drivers\Razerlow.sys [2005-08-12 19020]

S3 RTL8023xp;Linksys EG1032 v3 Instant Gigabit Desktop Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\EG1032xp.sys [2005-01-31 71040]

S3 RTLVLANXP;Linksys VLAN Intermediate Driver; C:\WINDOWS\system32\DRIVERS\RTLVLANXP.SYS [2005-01-26 15360]

S3 SaiH8000;SaiH8000; C:\WINDOWS\system32\DRIVERS\SaiH8000.sys [2004-12-03 56704]

S3 SDdriver;SDdriver; \??\C:\WINDOWS\system32\Drivers\sddriver.sys []

S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]

S3 Sntnlusb;Rainbow USB SuperPro; C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS [2001-06-21 20032]

S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2009-03-22 80552]

S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2009-03-22 11944]

S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2009-03-22 106792]

S3 sscdserd;SAMSUNG Mobile Modem Diagnostic Serial Port (WDM); C:\WINDOWS\system32\DRIVERS\sscdserd.sys [2009-03-22 86824]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]

S3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []

S3 uisp;Freescale USB JW32 driver; C:\WINDOWS\System32\Drivers\usbicp.sys [2005-12-21 14592]

S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]

S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]

S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]

S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

S3 WinUSB;WinUSB; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2006-11-02 39368]

S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]

S3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [2004-11-26 224000]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]

R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2004-08-27 197752]

R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2004-08-27 164984]

R2 CTAudSvcService;Creative Audio Service; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-04-30 417792]

R2 FLEXlm Service 1;FLEXlm Service 1; C:\Autodesk Network License Manager\lmgrd.exe [2003-12-10 659456]

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-16 152984]

R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-06-10 168004]

R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-05 75064]

R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]

R2 svcWRSSSDK;Webroot Spy Sweeper Engine; C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe [2005-08-03 1700864]

R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2005-03-06 819352]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-05-05 604416]

R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]

R2 ZuneBusEnum;Zune Bus Enumerator; C:\WINDOWS\system32\ZuneBusEnum.exe [2008-11-10 60032]

R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]

S2 Asset Management Daemon;Asset Management Daemon; C:\Program Files\Gateway\EzTune\dtsslsrv.exe []

S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe []

S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe []

S2 ccPwdSvc;Symantec Password Validation; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2004-08-27 78968]

S2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files\Gateway\EzTune\DTSRVC.exe []

S2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2005-10-14 28768528]

S2 NProtectService;Norton Unerase Protection; C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE []

S2 RadClock;RadClock; C:\WINDOWS\system32\RadClock.exe [2005-04-27 102400]

S2 Speed Disk service;Speed Disk service; C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE []

S2 WinDefend;Windows Defender Service; C:\Program Files\Windows Defender\MsMpEng.exe []

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2005-06-28 72704]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-04-15 79360]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server; C:\macromedia\runtime\bin\jrunsvc.exe [2005-09-09 61440]

S3 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server; C:\macromedia\verity\k2\_nti40\bin\k2admin.exe [2005-06-29 2732608]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-11-22 79360]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-05-27 651720]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 GuardDogEXE;McAfee Privacy Service; C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE /SERVICE []

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 Macromedia Licensing Service;Macromedia Licensing Service; C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [2005-02-23 69632]

S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager; C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe []

S3 Norton Ghost;Norton Ghost; C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe [2004-07-29 1269760]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 SandraDataSrv;Sandra Data Service; C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcDataSrv.exe []

S3 SandraTheSrv;Sandra Service; C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcSandraSrv.exe []

S3 SDhelper;PC Tools Spyware Doctor; C:\Program Files\Spyware Doctor\sdhelp.exe [2005-12-20 870624]

S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-05-05 361216]

S3 Visual Studio Analyzer RPC bridge;Visual Studio Analyzer RPC bridge; C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe []

S3 wampapache;wampapache; F:\wamp\apache2\bin\Apache.exe -k runservice []

S3 wampmysqld;wampmysqld; F:\wamp\mysql\bin\mysqld-nt.exe --defaults-file=F:\wamp\mysql\my.ini wampmysqld []

S3 WmcCds;Windows Media Connect (WMC); c:\program files\windows media connect\mswmccds.exe [2004-08-11 483328]

S3 WmcCdsLs;Windows Media Connect (WMC) Helper; C:\Program Files\Windows Media Connect\mswmcls.exe [2004-08-10 28160]

S3 x10nets;X10 Device Network Service; C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe []

S3 ZuneNetworkSvc;Zune Network Sharing Service; C:\Program Files\Zune\ZuneNss.exe [2008-11-10 5117568]

S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service; C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-11-10 243840]

S4 GEARSecurity;GEARSecurity; C:\WINDOWS\System32\GEARSec.exe [2004-07-29 53248]

S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-02-18 242544]

-----------------EOF-----------------

cont. next post

brew · August 3, 2009

Info.txt

info.txt logfile of random's system information tool 1.06 2009-08-03 12:24:58

======Uninstall list======

-->"C:\Program Files\Creative\Sound Blaster X-Fi\Program\SETUP.EXE" /S /U /W

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL

-->C:\WINDOWS\UNNMP.exe /UNINSTALL

-->MsiExec /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}

-->MsiExec.exe /I{983DD781-10DA-4C25-8706-9E152DFCEF90}

-->MsiExec.exe /I{C3BC473E-FACD-4BAA-86B9-5FB52DD80495}

-->MsiExec.exe /X{57922B53-02D4-4DFC-AC24-A3519DC1F49A}

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E5AA361-4B16-4282-B639-9E5B2B6A2EC8}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E5AA361-4B16-4282-B639-9E5B2B6A2EC8}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32903944-19A2-418C-901D-4BBAF4C55ABA}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32903944-19A2-418C-901D-4BBAF4C55ABA}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4D8AA0B4-E890-4BF7-A9D1-8E63027E76D3}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4D8AA0B4-E890-4BF7-A9D1-8E63027E76D3}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6BF90A01-FA3F-42B9-A071-7D744409967E}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6BF90A01-FA3F-42B9-A071-7D744409967E}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8DA9EB2-DBEF-4F0A-B90A-45B77D9E65B2}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8DA9EB2-DBEF-4F0A-B90A-45B77D9E65B2}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x9 /remove

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 /remove

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

3DMark06-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1AE27FE6-05DB-40CB-A29E-2945980ACE27}\setup.exe" -l0x9 -removeonly

55mm v7.5 for Adobe Photoshop & Compatible Applications-->C:\WINDOWS\unvise32.exe c:\program files\adobe\adobe photoshop cs3\plug-ins\55mm_v7.5_uninstal.log

7-Zip 4.32-->"C:\Program Files\7-Zip\Uninstall.exe"

AA Forceclass Install-->C:\Program Files\MasterSplitter\uninstal.exe

Acronis True Image Home-->MsiExec.exe /X{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}

Adobe Acrobat 9 Pro Extended - English, Fran

Maurice Naggar · August 4, 2009

Hello Brew,

Let's do this next:

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

Double-click gmer.exe. to start it.

The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click Yes.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop.

Pleae attach the gmer.txt to your reply:

Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and
Click Upload.

brew · August 5, 2009

Thanks for the continued help Maurice.

I ran gmer and recieved no notice of roortkit activity. I made sure the "showall" tab was unticked and selected scan. The scan was still going strong after 8+ hours when I went to bed, only to discover the pc had rebooted with no sign of the gmer.log file.

I re-ran gmer and unticked the "file" box to get the info to you faster (gmer.txt attached). I will rerun the full scan if needed.

gmer.txt

brew · August 6, 2009

Tried to re-run the full scan overnight with no success. Recieved a BSOD after several hours with the error - Kernal_Stack_Inpage_Error

brew · August 7, 2009

I believe my issue may be resolved. I ran avira and let it quarantine several files in the windows/system32 and drivers folder. All my scans with MBAM now come back clean.

Portion of avira log

C:\WINDOWS\

BS_DEF.sys

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4ad9f9e6.qua'!

C:\WINDOWS\system32\

wuaumgr.exe

[DETECTION] Contains a recognition pattern of the (harmful) BDS/Shark.B back-door program

[NOTE] The file was moved to '4adbfa08.qua'!

C:\WINDOWS\system32\comdw\

svchost.exe

[DETECTION] Is the TR/Drop.Agent.cal.2 Trojan

[NOTE] The file was moved to '4addfa09.qua'!

C:\WINDOWS\system32\comdw\

winhelper.dll

[DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper

[NOTE] The file was moved to '4ae8f9fc.qua'!

C:\WINDOWS\system32\comdw\

winlogon.dll

[DETECTION] Is the TR/PSW.Delf.adm Trojan

[NOTE] The file was moved to '4f835df5.qua'!

C:\WINDOWS\system32\comoq\

svchost.exe

[DETECTION] Is the TR/Drop.Agent.cal.2 Trojan

[NOTE] The file was moved to '4f8b10b2.qua'!

C:\WINDOWS\system32\comoq\

winhelper.dll

[DETECTION] Contains recognition pattern of the DR/Delphi.Gen dropper

[NOTE] The file was moved to '4faf4815.qua'!

C:\WINDOWS\system32\comoq\

winlogon.dll

[DETECTION] Is the TR/PSW.Delf.adm Trojan

[NOTE] The file was moved to '4f64e82d.qua'!

C:\WINDOWS\system32\drivers\

a347bus.sys

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4aaef9c6.qua'!

C:\WINDOWS\system32\drivers\

a347scsi.sys

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4ff90b47.qua'!

C:\WINDOWS\system32\drivers\

ALCXWDM.SYS

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4abdf9df.qua'!

C:\WINDOWS\system32\drivers\

AsInsHelp32.sys

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4ac3fa06.qua'!

C:\WINDOWS\system32\drivers\

SENTINEL.SYS

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4ac8f9d8.qua'!

C:\WINDOWS\system32\drivers\

Si3114r5.sys

[DETECTION] Contains recognition pattern of the RKIT/Agent.8416 root kit

[NOTE] The file was moved to '4aadf9fc.qua'!

MBAM Log

Malwarebytes' Anti-Malware 1.40

Database version: 2573

Windows 5.1.2600 Service Pack 2

8/6/2009 4:46:40 PM

mbam-log-2009-08-06 (16-46-40).txt

Scan type: Quick Scan

Objects scanned: 114208

Time elapsed: 6 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Maurice Naggar · August 7, 2009

One question I have for you: You have TuneUp utilities I believe and that has set TUKERNEL as an alternate kernel.

Are you aware of that?

and for what purpose do you have TuneUp utilities?

brew · August 7, 2009

I Use some of the "utilities" of tuneup utilities, ie. Disk defrag, memory optimizer, process manager, startup manager etc.. I have used version 2007, 2008, and now 2009 with no issues. I am not sure what TUKERNAL is or the purpose of it. I would not hesitate to abandon tuneup utilities if you think it is a security risk.

Maurice Naggar · August 8, 2009

TUKERNEL apparently is an "alternate" kernel to what XP uses. You need to consider not using it.

See the 5th reply by mutronics dated 16 February

http://forum.sysinternals.com/forum_posts.asp?TID=13645

Take a look at your Boot.ini to see if there is a mention of TUKERNEL

TUKERNEL will cause a blockage in your getting XP Service pack 3, which you need to get eventually, and soon (after malware is gone)

brew · August 8, 2009

Maurice,

After doing some research, the TUKernal is part of tuneup styler, a program that lets you create and specify custom bootup screens. I have had a custom boot screen for a couple years and haven't thought much about it. It is better explained here - http://www.neowin.net/forum/lofiversion/in...hp/t387432.html

First, you gotta go to TuneUp WinStyle 2 and select the Bootscreen you wanna have, and click on "Install Bootscreen"... What it is going to do, is to compile the file to the System 32 folder as an .exe archive... once you have it as .exe you are able to share your bootscreen and/or add it to another OS by just editing the boot.ini file (ill xlpain that in a few seconds...)
Now, Go to X:\WINDOWS\System32\ and look for the file called "TUKernel.exe"
This file is the actual Bootscreen you have chosen. Copy and paste to wherever you want/need it.
Now, for the boot.ini editing part:
If you want to add your Bootscreen to any other OS without having to install TuneUp Utilties, simply follow these easy steps:
1 - Go to the partition in which you should boot all of your OSs from. (C:\ most of the times... depends on your installation) and type in the address bar: C:\boot.ini
An ini file should open with junk like this:
[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows Vista 5231 CTP" /NOEXECUTE=OPTIN /FASTDETECT /USENEWLOADER
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /NOEXECUTE=OPTIN /FASTDETECT /TUTAG=O4F3OT /KERNEL=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition (TuneUp Backup)" /NOEXECUTE=OPTIN /FASTDETECT /TUTAG=O4F3OT-BAK
c:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /CMDCONS
dont get confused by all this junk, this is just all the stuff I got loading on my machine lol
now lets say you got something like this:
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /NOEXECUTE=OPTIN /FASTDETECT
all what you have to do is add these words " /KERNEL=TUKernel.exe" right after the "FASTDETECT" string, making sure you leave an space between both words...
ONE THING! - You have to copy your bootscreen exe to the SYSTEM32 folder, in order to use it as your bootscreen.
You can name it whatever you want.. lets say that you wanna call it MYBOOTSCREEN.exe.... then the string you just moddified should look like this:
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /NOEXECUTE=OPTIN /FASTDETECT /KERNEL=MYBOOTSCREEN.exe
now simply save and close that inf file... If you get an error, go to Folders Option, uncheck "Hide System Protected Files" and "Do not show Hidden Files" options, click apply, and Ok. Then right click on the boot.ini file that is going to show up on the main C:\ folder after you've disable those two options, and uncheck where it says "Read-Only" if its checked...
then save again and close that file.
ANOTHER NOTE!
Before you close, copy that string and delete the KERNEL part, so you have a loader backup just in case your bootscreen executable is not working or was damaged. Make sure you add something like "BACKUP" within the OS description lines. After you are done doing that, you should have something like this:
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /NOEXECUTE=OPTIN /FASTDETECT /KERNEL=MYBOOTSCREEN.exe
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition BACKUP" /NOEXECUTE=OPTIN /FASTDETECT

I have set the boot screen back to default and now the boot.ini reads -

[boot loader]

timeout=3

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optin /tutag=X1I2A6 /usepmtimer

I believe I am free of malware as MBAM log comes up clean. What is the next step and/or what logs do you need to see to confirm this?

Again, your time and help is much appreciated!

Maurice Naggar · August 8, 2009

I believe we are very near to closing, but since I'd like to see you in good shape for a successful service pack upgrade....

tell me why you left

/tutag=X1I2A6 /usepmtimer

in your last line of Boot.ini ?

I'd have you take those bits out.

brew · August 9, 2009

I didn't make any actual changes to the boot.ini file. All I did was go into tuneup stylizer and select the XP default bootup screen. It removed the reference to tukernal in the boot.ini file.

I am not sure what the /tutag=X1I2A6 is so I will remove it manually. I believe the /usepmtimer is part of amd's dual core utility -

http://support.amd.com/us/Pages/dynamicDet...&ItemID=153 and would prefer to leave it , if it does not pose a security risk.

Maurice Naggar · August 9, 2009

Hello brew,

Good catch on the /usepmtimer in Boot.ini. It is not a security risk.

We can now proceed to cleanup the tools. And I have some recommendations below on Service pack 3.

=

Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe
This next will delete 2 folders
Please double-click OTL.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy all the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
:filesC:\WINDOWS\system32\comdwC:\WINDOWS\system32\comoq
```
Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
Close any browser(s) windows that may be open.
Using your mouse, click on the red-lettered button Run Fix.
Once you see a message box "Fix complete! Click OK to open the fix log."
Click the OK button
The log will open in Notepad (your default text editor).
Save the log. Post a copy of that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.

If you are asked to reboot the machine choose Yes.

=

While this thread was underway, over these past number of days, a newer Java runtime has been released.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) - JRE 6 Update 15 -"
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u15 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u15-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
  [*]Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  [*]Click OK to leave the Temporary Files Window
  [*]Click OK to leave the Java Control Panel.

To test your Java Run-time, you may go to this page http://www.java.com/en/download/help/testvm.xml

When all is well, you should see Java Version: 1.6.0_15 from Sun Microsystems Inc.

=

Unless you have purchased Malwarebytes' Anti Malware {MBAM}, you should to un-install it.

(One can download it if needed in future).

Go to Control Panel and Add-or-Remove programs.

Look for it and click the line for it. Select Change/Remove to de-install it.

OK & Exit out of Control Panel

I see that you are clear of your original issues.

If you have a problem with these steps, or something does not quite work here, do let me know.

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders.

By whichever name you named it, ( you had named it combofix1 ), put that name in the RUN box stated just below.

The "/u" in the Run line below is to start Combofix for it's cleanup & removal function.

Note the space after x and before the slash mark.

The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.

Click Start, then click Run.
In the command box that opens, type or copy/paste
combofix1 /u
and then click OK.

Please double-click OTL.exe to run it.
Click on the CleanUp! button at upper Right corner. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTL attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
This step removes the files, folders, and shortcuts created by the tools I had you download and run.

Run ATF Cleaner, and checkmark "Empty Recycle Bin", click "Empty Selected" and exit the program. You can delete or keep this utility as you wish.
You may reset your Windows Explorer {My Computer} Folder Options > VIEW settings back to where they had been before. {under hidden files & folders to not show hidden or system files -and- to "hide protected operating system files" }
Delete any downloads & any leftovers of Sysprot, as well as RootRepeal, if any still left.
I would urge you to plan for and get and apply Windows XP Service Pack 3.
See Windows XP Service Pack 3 (SP3): Installation Guide
Make a note that your antivirus and anti-malware apps need to be disabled just prior to and during the service pack update.
Configure your Antivirus software to check for updates daily, at a time in which you are sure the computer will be on.
Check in at Windows Update and install any Critical Updates offered.
Download and Install Windows Defender by Microsoft (free) if you do not already have it:
http://www.microsoft.com/downloads/details...A4-F7F14E605A0D
Make certain that Automatic Updates is enabled.
How to configure and use Automatic Updates in WinXP:
http://support.microsoft.com/kb/306525
Download, install, and keep updated Spyware Blaster (free): http://www.javacoolsoftware.com/spywareblaster.html (all Protections should be enabled at all times)
I'd recommend that you get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm
See the FAQ page http://mvps.org/winhelp2002/hostsfaq.htm
That would help to keep your browser away from known spyware/malware sites.
Make regular backups of your system to removable media: DVD, USB external hard drive, etc.
On some regular schedule, it is a good idea to do an online scan for viruses and malware. Here is a very short list of sites where this may be done:
Kaspersky Webscan Online Virus Scanner
ESET Online Scanner
Panda ActiveScan
Trend Micro Housecall
F-Secure Online Scanner
Read Tony Klein's article How Did I Get Infected In The First Place
Never, ever download free games, free tools, smileys, or anything free unless you can be absolutely sure the source is safe !
Finally, spend some time reading about how to keep your computer safe on the Internet: http://www.bleepingcomputer.com/tutorials/tutorial82.html

We are finished here. Best regards.

Trojan.TDSS

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information