Trey Posted August 31, 2009 ID:117651 Share Posted August 31, 2009 A friend had two computers afflicted with 2 different 'fake alert' antiivirus malware programs. The first one was a snap, just downloaded and ran mbam, problem fixed. This second one is totally screwed though. It blocks every reputable anti-malware program, or any other tool that could dislodge it. If a program like Mbam is run, it'll run for a bit then it dies. The malware then changes the programs exe so it won't run and can't be deleted. I've tried renaming, replacing the exe with a saved one and rerunning, running programs from a USB drive, from safemode, running AVG (but it doesn't see anything wrong), every variation of those I could think of and nothing's worked. I found three obvious trojans just sitting in the C: drive, (emxtqjit.exe/enurmyv.exe/fyblb.exe) and deleted them by hand, not that it really helped.Any ideas? Link to post Share on other sites More sharing options...
Trey Posted August 31, 2009 Author ID:117656 Share Posted August 31, 2009 Win32kDiag text:Log file is located at: C:\Documents and Settings\Kei Yamamoto\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Found mount point : C:\WINDOWS\$hf_mig$\KB916281\KB916281Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB918899\KB918899Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB920213\KB920213Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB922760\KB922760Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB924496\KB924496Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB925454\KB925454Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB928090\KB928090Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB931768\KB931768Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB933566\KB933566Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB937143\KB937143Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB939653\KB939653Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\$NtServicePackUninstallIDNMitigationAPIs$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\$NtServicePackUninstallNLSDownlevelMapping$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB888302$\$NtUninstallKB888302$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB893066$\$NtUninstallKB893066$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB896422$\$NtUninstallKB896422$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB896428$\$NtUninstallKB896428$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB898461$\$NtUninstallKB898461$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB899588$\$NtUninstallKB899588$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB904942$\$NtUninstallKB904942$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB905749$\$NtUninstallKB905749$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB911565$\$NtUninstallKB911565$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB911927$\$NtUninstallKB911927$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB913446$\$NtUninstallKB913446$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB915865$\$NtUninstallKB915865$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917159$\$NtUninstallKB917159$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917734_WMP10$\$NtUninstallKB917734_WMP10$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917953$\$NtUninstallKB917953$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB923414$\$NtUninstallKB923414$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB923689$\$NtUninstallKB923689$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB925486$\$NtUninstallKB925486$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB926255$\$NtUninstallKB926255$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB927802$\$NtUninstallKB927802$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB929969$\$NtUninstallKB929969$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB930178$\$NtUninstallKB930178$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB931261$\$NtUninstallKB931261$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB931836$\$NtUninstallKB931836$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB933360$\$NtUninstallKB933360$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB936357$\$NtUninstallKB936357$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB936782_WMP10$\$NtUninstallKB936782_WMP10$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB938127$\$NtUninstallKB938127$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB938464_0$\$NtUninstallKB938464_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB941569$\$NtUninstallKB941569$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB951376-v2_0$\$NtUninstallKB951376-v2_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB954211_0$\$NtUninstallKB954211_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB954600_0$\$NtUninstallKB954600_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB955839$\$NtUninstallKB955839$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB958687_0$\$NtUninstallKB958687_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB958690_0$\$NtUninstallKB958690_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB960803_0$\$NtUninstallKB960803_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\TEMP\TEMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\TMP\TMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CAVTemp\CAVTempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Config\ConfigMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Connection Wizard\Connection WizardMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d1\d1Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d2\d2Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d3\d3Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d4\d4Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d5\d5Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d6\d6Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d7\d7Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d8\d8Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Cbz\CbzMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Lib\LibMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Wave\WaveMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\CHSIME\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\CHTIME\Applets\AppletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMEJP\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMEJP98\IMEJP98Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMJP8_1\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMKR6_1\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMKR6_1\DICTS\DICTSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\SHARED\RES\RESMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\JAVA\TRUSTLIB\TRUSTLIBMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind LogsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Motive\MotiveMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\MSAPPS\MSINFO\MSINFOMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\QHEADLES\QHEADLESMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\QSIGNOFF\QSIGNOFFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\UserDumps\UserDumpsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\BATCH\BATCHMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Config\CheckPoint\CheckPointMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\HelpFiles\HelpFilesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\InstalledSKUs\InstalledSKUsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\DFSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Temp\TempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PIF\PIFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLogMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\DownloadedMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\0eda838ef8ec599d822155030a70ecacMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\0facce6115ab861022eae3087e064a2a\0facce6115ab861022eae3087e064a2aMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backupMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Sun\Java\Deployment\DeploymentMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1025\1025Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1028\1028Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1031\1031Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1037\1037Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1041\1041Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1042\1042Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1054\1054Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\2052\2052Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\3076\3076Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\3COM_DMI\3COM_DMIMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\appmgmt\MACHINE\MACHINEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\appmgmt\S-1-5-21-1173721996-2478878603-2040195317-1006\S-1-5-21-1173721996-2478878603-2040195317-1006Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch1\ch1Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch2\ch2Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Jasc Software Inc\Paint Shop Pro 8\Cache\CacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-861567501-1078081533-725345543-500\S-1-5-21-861567501-1078081533-725345543-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Media Player\Media PlayerMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\CertificatesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Sun\Java\Deployment\javaws\cache\cacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Desktop\DesktopMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\CD Burning\CD BurningMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-861567501-1078081533-725345543-500\S-1-5-21-861567501-1078081533-725345543-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temp\TempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\Jasc Paint Shop Photo Album ImagesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\My Documents\My PSP8 Files\Workspaces\WorkspacesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NetHood\NetHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\PrintHood\PrintHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\DHCP\DHCPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\DRIVERS\DISDN\DISDNMount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\SYSTEM32\eventlog.dll[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\ServicePackFiles\i386\eventlog.dll (Microsoft Corporation)[1] 2008-04-13 20:11:53 63488 C:\WINDOWS\SYSTEM32\eventlog.dll ()[2] 2008-04-13 20:11:53 56320 C:\WINDOWS\SYSTEM32\logevent.dll (Microsoft Corporation)[1] 2004-08-04 07:00:00 55808 C:\i386\EVENTLOG.DLL (Microsoft Corporation)Found mount point : C:\WINDOWS\SYSTEM32\EXPORT\EXPORTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\FxsTmp\FxsTmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\CINTLGNT\CINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\PINTLGNT\PINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\Microsoft\Crypto\RSA\MachineKeys\MachineKeysMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\MUI\DISPSPEC\DISPSPECMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\ISPSGNUP\ISPSGNUPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMCUST\OEMCUSTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMHW\OEMHWMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMREG\OEMREGMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\SAMPLE\SAMPLEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\ShellExt\ShellExtMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\PRINTERSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\MOF\BAD\BADMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\MOF\GOOD\GOODMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\SNMP\SNMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WINS\WINSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\XIRCOM\XIRCOMMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\Cookies\CookiesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\Google Toolbar\Google ToolbarMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\JVM\JVMMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA11F.tmp\MCA11F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA154.tmp\MCA154.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA18.tmp\MCA18.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA188.tmp\MCA188.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA1BB.tmp\MCA1BB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA1EF.tmp\MCA1EF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA243.tmp\MCA243.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA260.tmp\MCA260.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA276.tmp\MCA276.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA2A7.tmp\MCA2A7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA2A9.tmp\MCA2A9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA2AF.tmp\MCA2AF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA2D3.tmp\MCA2D3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA2FC.tmp\MCA2FC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA337.tmp\MCA337.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA345.tmp\MCA345.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA35A.tmp\MCA35A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA381.tmp\MCA381.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA3C1.tmp\MCA3C1.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA3C5.tmp\MCA3C5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA3D.tmp\MCA3D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA42E.tmp\MCA42E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA499.tmp\MCA499.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA4C.tmp\MCA4C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA569.tmp\MCA569.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA57.tmp\MCA57.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA5D4.tmp\MCA5D4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA63F.tmp\MCA63F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA6A.tmp\MCA6A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA6C2.tmp\MCA6C2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA71.tmp\MCA71.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA72E.tmp\MCA72E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA79C.tmp\MCA79C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA7F.tmp\MCA7F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA83A.tmp\MCA83A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA8A9.tmp\MCA8A9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA914.tmp\MCA914.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCA98C.tmp\MCA98C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCABB.tmp\MCABB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCACC.tmp\MCACC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCAD8.tmp\MCAD8.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MCAF9.tmp\MCAF9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10.tmp\mcu10.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu100.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu101.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu102.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu103.tmp\mcu103.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu104.tmp\mcu104.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu105.tmp\mcu105.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu106.tmp\mcu106.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu107.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu108.tmp\mcu108.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu109.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10A.tmp\mcu10A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10B.tmp\mcu10B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10E.tmp\mcu10E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu10F.tmp\mcu10F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11.tmp\mcu11.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu110.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu111.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu112.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu113.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu114.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu115.tmp\mcu115.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu116.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu117.tmp\mcu117.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu118.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu119.tmp\mcu119.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11B.tmp\mcu11B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11C.tmp\mcu11C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11D.tmp\mcu11D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11E.tmp\mcu11E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu11F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12.tmp\mcu12.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu120.tmp\mcu120.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu121.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu122.tmp\mcu122.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu123.tmp\mcu123.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu124.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu125.tmp\mcu125.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu126.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu127.tmp\mcu127.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu128.tmp\mcu128.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu129.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12A.tmp\mcu12A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12B.tmp\mcu12B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12D.tmp\mcu12D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu12F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13.tmp\mcu13.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu130.tmp\mcu130.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu131.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu132.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu133.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu134.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu135.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu136.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu137.tmp\mcu137.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu138.tmp\mcu138.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu139.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13A.tmp\mcu13A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu13F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14.tmp\mcu14.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu140.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu141.tmp\mcu141.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu142.tmp\mcu142.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu143.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu144.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu145.tmp\mcu145.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu146.tmp\mcu146.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu147.tmp\mcu147.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu148.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu149.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14B.tmp\mcu14B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14C.tmp\mcu14C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu14F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15.tmp\mcu15.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu150.tmp\mcu150.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu151.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu152.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu153.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu154.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu155.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu156.tmp\mcu156.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu157.tmp\mcu157.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu158.tmp\mcu158.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu159.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15B.tmp\mcu15B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15C.tmp\mcu15C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu15F.tmp\mcu15F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu16.tmp\mcu16.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu160.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu161.tmp\mcu161.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu162.tmp\mcu162.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu163.tmp\mcu163.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu164.tmp\mcu164.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu165.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu166.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu167.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu168.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu169.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu16A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu16B.tmp\mcu16B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu16C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu16F.tmp\mcu16F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17.tmp\mcu17.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu173.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu175.tmp\mcu175.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu177.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17A.tmp\mcu17A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17B.tmp\mcu17B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17C.tmp\mcu17C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17D.tmp\mcu17D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17E.tmp\mcu17E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu17F.tmp\mcu17F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18.tmp\mcu18.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu180.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu181.tmp\mcu181.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu182.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu183.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu184.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu185.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu186.tmp\mcu186.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu187.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu188.tmp\mcu188.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu189.tmp\mcu189.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18A.tmp\mcu18A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18C.tmp\mcu18C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18D.tmp\mcu18D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu18F.tmp\mcu18F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19.tmp\mcu19.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu190.tmp\mcu190.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu191.tmp\mcu191.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu192.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu193.tmp\mcu193.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu194.tmp\mcu194.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu195.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu196.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu197.tmp\mcu197.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu198.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu199.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19E.tmp\mcu19E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu19F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A.tmp\mcu1A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A0.tmp\mcu1A0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A2.tmp\mcu1A2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A3.tmp\mcu1A3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A4.tmp\mcu1A4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A5.tmp\mcu1A5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A7.tmp\mcu1A7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1A9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AA.tmp\mcu1AA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AC.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AD.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AE.tmp\mcu1AE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1AF.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B.tmp\mcu1B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B0.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B1.tmp\mcu1B1.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B2.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B3.tmp\mcu1B3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B4.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B5.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B7.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1B9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1BA.tmp\mcu1BA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1BB.tmp\mcu1BB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1BE.tmp\mcu1BE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1BF.tmp\mcu1BF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C0.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C2.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C5.tmp\mcu1C5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1C7.tmp\mcu1C7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CA.tmp\mcu1CA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CC.tmp\mcu1CC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CD.tmp\mcu1CD.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CE.tmp\mcu1CE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1CF.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1D.tmp\mcu1D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1D0.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1D5.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1DB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1DF.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E.tmp\mcu1E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E2.tmp\mcu1E2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E3.tmp\mcu1E3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E6.tmp\mcu1E6.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E7.tmp\mcu1E7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1E9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1EA.tmp\mcu1EA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1EB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1EE.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1EF.tmp\mcu1EF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F0.tmp\mcu1F0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F3.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F4.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F6.tmp\mcu1F6.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1F9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu1FD.tmp\mcu1FD.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu20.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu200.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu204.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu209.tmp\mcu209.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu20B.tmp\mcu20B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu20C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu21.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu211.tmp\mcu211.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu212.tmp\mcu212.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu215.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu216.tmp\mcu216.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu217.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu218.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu22.tmp\mcu22.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu223.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu23.tmp\mcu23.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu230.tmp\mcu230.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu233.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu234.tmp\mcu234.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu238.tmp\mcu238.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu239.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu24.tmp\mcu24.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu241.tmp\mcu241.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu25.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu252.tmp\mcu252.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu253.tmp\mcu253.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu254.tmp\mcu254.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu257.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu25E.tmp\mcu25E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu26.tmp\mcu26.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu261.tmp\mcu261.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu26D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu27.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu276.tmp\mcu276.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu279.tmp\mcu279.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu28.tmp\mcu28.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu284.tmp\mcu284.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu285.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu28F.tmp\mcu28F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu29.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2A.tmp\mcu2A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2A1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2AB.tmp\mcu2AB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2AE.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2B.tmp\mcu2B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2B9.tmp\mcu2B9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2CB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2CD.tmp\mcu2CD.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2D.tmp\mcu2D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2F.tmp\mcu2F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2F2.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2F5.tmp\mcu2F5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu2FB.tmp\mcu2FB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu30.tmp\mcu30.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu304.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu31.tmp\mcu31.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu311.tmp\mcu311.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu31B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu32.tmp\mcu32.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu324.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu33.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu332.tmp\mcu332.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu34.tmp\mcu34.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu34A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu35.tmp\mcu35.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu35F.tmp\mcu35F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu36.tmp\mcu36.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu37.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu372.tmp\mcu372.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu378.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu38.tmp\mcu38.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu385.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu39.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3A.tmp\mcu3A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3A4.tmp\mcu3A4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3A7.tmp\mcu3A7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3B.tmp\mcu3B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3B1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3C.tmp\msk\en-us\en-usMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3D.tmp\mcu3D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3DD.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu3F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu40.tmp\mcu40.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu409.tmp\mcu409.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu41.tmp\mcu41.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu414.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu42.tmp\mcu42.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu423.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu43.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu43E.tmp\mcu43E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu44.tmp\mcu44.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu441.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu45.tmp\mcu45.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu454.tmp\mcu454.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu457.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu45B.tmp\mcu45B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu45E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu46.tmp\mcu46.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu466.tmp\mcu466.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu46F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu47.tmp\mcu47.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu476.tmp\mcu476.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu479.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu48.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu49.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu49A.tmp\mcu49A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4C.tmp\mcu4C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4D.tmp\mcu4D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4E4.tmp\mcu4E4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu4F1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu50.tmp\mcu50.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu51.tmp\mcu51.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu52.tmp\mcu52.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu53.tmp\mcu53.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu53A.tmp\mcu53A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu54.tmp\mcu54.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu545.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu55.tmp\mcu55.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu56.tmp\mcu56.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu57.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu58.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu58B.tmp\mcu58B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu59.tmp\mcu59.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5A.tmp\mcu5A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5C.tmp\mcu5C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu5F.tmp\mcu5F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu60.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu61.tmp\mcu61.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu62.tmp\mcu62.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu63.tmp\mcu63.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu64.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu65.tmp\mcu65.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu66.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu67.tmp\mcu67.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu68.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu69.tmp\mcu69.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6C.tmp\mcu6C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6D.tmp\mcu6D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6E.tmp\mcu6E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu6F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu70.tmp\mcu70.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu71.tmp\mcu71.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu72.tmp\mcu72.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu73.tmp\mcu73.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu74.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu75.tmp\mcu75.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu76.tmp\mcu76.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu77.tmp\mcu77.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu78.tmp\mcu78.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu79.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7A.tmp\mcu7A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7B.tmp\mcu7B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7E.tmp\mcu7E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu7F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu80.tmp\mcu80.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu81.tmp\mcu81.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu82.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu83.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu84.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu85.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu86.tmp\mcu86.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu87.tmp\mcu87.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu88.tmp\mcu88.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu89.tmp\mcu89.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8A.tmp\mcu8A.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8B.tmp\mcu8B.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8C.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8D.tmp\mcu8D.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu8F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu90.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu91.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu92.tmp\mcu92.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu93.tmp\mcu93.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu94.tmp\mcu94.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu95.tmp\mcu95.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu96.tmp\mcu96.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu97.tmp\mcu97.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu98.tmp\mcu98.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu99.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9A.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9B.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9C.tmp\mcu9C.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9D.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9E.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcu9F.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA0.tmp\mcuA0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA1.tmp\mcuA1.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA2.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA3.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA4.tmp\mcuA4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA5.tmp\mcuA5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA6.tmp\mcuA6.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA7.tmp\mcuA7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA8.tmp\mcuA8.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuA9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAA.tmp\mcuAA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAC.tmp\mcuAC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAD.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAE.tmp\mcuAE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuAF.tmp\mcuAF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB0.tmp\mcuB0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB2.tmp\mcuB2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB3.tmp\mcuB3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB4.tmp\mcuB4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB5.tmp\mcuB5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB7.tmp\mcuB7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB8.tmp\mcuB8.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuB9.tmp\mcuB9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBA.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBC.tmp\mcuBC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBD.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBE.tmp\mcuBE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuBF.tmp\mcuBF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC0.tmp\mcuC0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC1.tmp\mcuC1.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC2.tmp\mcuC2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC3.tmp\mcuC3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC4.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC5.tmp\mcuC5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC7.tmp\mcuC7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuC9.tmp\mcuC9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCA.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCC.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCD.tmp\mcuCD.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCE.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuCF.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD0.tmp\mcuD0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD2.tmp\mcuD2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD3.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD4.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD5.tmp\mcuD5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD6.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD7.tmp\mcuD7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuD9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDA.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDC.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDD.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDE.tmp\mcuDE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuDF.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE.tmp\mcuE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE0.tmp\mcuE0.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE2.tmp\mcuE2.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE3.tmp\mcuE3.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE4.tmp\mcuE4.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE5.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE6.tmp\mcuE6.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE7.tmp\mcuE7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE8.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuE9.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuEA.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuEB.tmp\mcuEB.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuEC.tmp\mcuEC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuED.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuEE.tmp\mcuEE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuEF.tmp\mcuEF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF.tmp\mcuF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF0.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF1.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF2.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF3.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF4.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF5.tmp\mcuF5.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF6.tmp\mcuF6.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF7.tmp\mcuF7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF8.tmp\mcuF8.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuF9.tmp\mcuF9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFA.tmp\mcuFA.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFB.tmp\vso\vsoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFC.tmp\mcuFC.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFD.tmp\mcuFD.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFE.tmp\mcuFE.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\mcuFF.tmp\mcuFF.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Temp\MPTelemetrySubmit\MPTelemetrySubmitMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTempMount point destination : \Device\__max++>\^Finished! Link to post Share on other sites More sharing options...
Trey Posted August 31, 2009 Author ID:117663 Share Posted August 31, 2009 I was able to run Sophos Anti-Rootkit, but I'm hesitant to start deleting stuff. Can't save text from it, so...Screenshots:http://s204.photobucket.com/albums/bb97/Tr...t=untitled3.jpghttp://s204.photobucket.com/albums/bb97/Tr...t=untitled4.jpg Link to post Share on other sites More sharing options...
extremeboy Posted September 1, 2009 ID:118688 Share Posted September 1, 2009 Hello.You have a nasty infection here..We are going to start with Combofix. If you have any problems, STOP and LET ME KNOW please.Thanks.Download and Run ComboFixNote to readers of this post other than the starter of this thread:ComboFix is a VERY POWERFUL tool which should NOT BE USED without guidance of an expert.Download Combofix from any of the links below, and save it to your desktop. Link 1Link 2 Please refer to this page for full instructions on how to run ComboFix.Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.Double click ComboFix.exe to start the program. Agree to the prompts.When ComboFix is finished, a log report (C:\ComboFix.txt) will open. Post back with it.Leave your computer alone while ComboFix is running.ComboFix will restart your computer if malware is found; allow it to do so.Note: Please Do NOT mouseclick combofix's window while its running because it may call it to stall.With Regards,Extremeboy Link to post Share on other sites More sharing options...
Trey Posted September 2, 2009 Author ID:118799 Share Posted September 2, 2009 ComboFix 09-09-01.04 - Kei Yamamoto 09/01/2009 19:42.1.2 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.220 [GMT -4:00]Running from: c:\documents and settings\Kei Yamamoto\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} * Created a new restore point.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\Installer\15515.msic:\windows\Installer\dff1a4e.msic:\windows\Installer\dff1a54.msic:\windows\system32\1.tmpc:\windows\system32\2.tmpc:\windows\system32\3.tmpc:\windows\system32\bcvokkke.dllc:\windows\system32\cru629.datc:\windows\system32\drivers\kbiwkmxkqpvaqc.sysc:\windows\system32\drivers\rzqxigxn.sysc:\windows\system32\drivers\tteabttq.sysc:\windows\system32\drivers\UACkadtnomndo.sysc:\windows\system32\kbiwkmijpixfte.datc:\windows\system32\kbiwkmmyvxifav.dllc:\windows\system32\kbiwkmrsumnqoy.dllc:\windows\system32\kbiwkmxddvelte.datc:\windows\system32\njbywds.dllc:\windows\system32\nnqeiqy.dllc:\windows\system32\resdll.dllc:\windows\system32\UACwkawnklacp.dllc:\windows\system32\wisdstr.exec:\windows\system32\wscsvc32.exec:\windows\Tasks\At1.jobInfected copy of c:\windows\system32\eventlog.dll was found and disinfected Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Service_kbiwkmcpxursnw-------\Legacy_kbiwkmcpxursnw-------\Service_UACd.sys-------\Legacy_UACd.sys-------\Legacy_RZQXIGXN-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}-------\Service_rzqxigxn((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 ))))))))))))))))))))))))))))))).2009-08-31 01:04 . 2009-08-31 01:04 -------- d-----w- c:\program files\Trend Micro2009-08-30 05:13 . 2009-08-30 05:13 117760 ----a-w- c:\documents and settings\Kei Yamamoto\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL2009-08-30 05:12 . 2009-08-30 05:12 -------- d-----w- c:\documents and settings\Kei Yamamoto\Application Data\SUPERAntiSpyware.com2009-08-30 05:12 . 2009-08-30 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com2009-08-30 04:22 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2009-08-30 04:22 . 2009-08-30 04:23 -------- d-----w- c:\program files\aalwarebytes' Anti-Malware2009-08-30 04:22 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys2009-08-30 03:56 . 2009-08-30 05:37 -------- d--h--w- c:\windows\PIF2009-08-30 03:23 . 2009-08-30 03:23 -------- d-----w- c:\program files\Sophos2009-08-30 02:20 . 2009-08-30 04:02 -------- d-----w- c:\program files\alwarebytes' Anti-Malware2009-08-30 00:47 . 2009-08-30 00:47 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache2009-08-29 22:16 . 2009-08-29 22:16 954368 ----a-w- c:\windows\system32\uacav.dll2009-08-29 22:16 . 2009-08-29 22:16 174 ----a-w- c:\windows\system32\uacsr.dat2009-08-29 22:16 . 2009-08-29 22:27 74240 ----a-w- c:\windows\system32\uacbbr.dll2009-08-19 16:35 . 2009-08-19 16:35 -------- d-sh--w- c:\documents and settings\Kei Yamamoto\PrivacIE2009-08-18 21:36 . 2009-08-18 21:36 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache2009-08-18 21:36 . 2009-08-18 21:36 -------- d-sh--w- c:\documents and settings\Kei Yamamoto\IETldCache2009-08-18 21:33 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll2009-08-18 21:33 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll2009-08-18 21:33 . 2009-08-18 21:33 -------- d-----w- c:\windows\ie8updates2009-08-18 21:33 . 2009-07-01 07:08 101376 ------w- c:\windows\system32\dllcache\iecompat.dll2009-08-18 21:31 . 2009-08-18 21:32 -------- dc-h--w- c:\windows\ie82009-08-15 13:30 . 2009-08-11 21:10 335752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys2009-08-15 13:30 . 2009-08-11 21:10 692504 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcsrvx.exe2009-08-15 13:30 . 2009-08-11 21:10 417560 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcclix.dll2009-08-15 13:30 . 2009-08-11 21:10 382744 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgclitx.dll2009-08-15 13:30 . 2009-08-11 21:10 69912 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcrlpx.dll2009-08-15 13:30 . 2009-08-11 21:10 2053912 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll2009-08-15 13:30 . 2009-08-11 21:10 2807576 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguires.dll2009-08-15 13:30 . 2009-08-11 21:10 2301720 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll2009-08-15 13:28 . 2009-08-11 21:09 1086744 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe2009-08-15 13:28 . 2009-08-11 21:09 755992 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll2009-08-15 13:28 . 2009-08-11 21:09 587032 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgiproxy.exe2009-08-15 13:28 . 2009-08-11 21:09 1471768 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll2009-08-12 02:16 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll2009-08-11 22:31 . 2009-08-11 22:31 -------- d-----w- c:\program files\Safari2009-08-11 22:27 . 2009-08-11 22:27 -------- d-----w- c:\program files\iPod2009-08-11 22:27 . 2009-08-11 22:28 -------- d-----w- c:\program files\iTunes2009-08-11 22:27 . 2009-08-11 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}2009-08-11 22:25 . 2009-08-11 22:25 -------- d-----w- c:\program files\QuickTime2009-08-11 22:19 . 2009-08-11 22:19 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-09-01 23:49 . 2007-04-11 07:07 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP2009-09-01 23:33 . 2004-08-04 11:00 56320 ----a-w- c:\windows\system32\eventlog.dll2009-08-30 03:12 . 2007-04-09 23:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard2009-08-30 02:00 . 2009-05-27 21:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2009-08-30 01:51 . 2005-03-18 14:09 -------- d-----w- c:\program files\Canon2009-08-30 01:50 . 2005-01-27 17:49 -------- d--h--w- c:\program files\InstallShield Installation Information2009-08-30 01:50 . 2005-05-30 22:33 -------- d-----w- c:\program files\Google2009-08-30 01:48 . 2007-07-26 23:13 -------- d-----w- c:\program files\PopCap Games2009-08-30 01:48 . 2005-01-27 17:57 -------- d-----w- c:\program files\Common Files\AOL2009-08-30 01:47 . 2005-01-27 17:58 -------- d-----w- c:\program files\Common Files\Nullsoft2009-08-05 09:01 . 2004-08-04 11:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll2009-07-29 04:37 . 2004-08-04 11:00 81920 ----a-w- c:\windows\system32\fontsub.dll2009-07-29 04:37 . 2004-08-04 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll2009-07-17 19:01 . 2004-08-04 11:00 58880 ----a-w- c:\windows\system32\atl.dll2009-07-13 14:08 . 2004-08-04 11:00 286720 ----a-w- c:\windows\system32\wmpdxm.dll2009-07-03 17:09 . 2004-08-04 11:00 915456 ----a-w- c:\windows\system32\wininet.dll2009-06-12 12:31 . 2004-08-04 11:00 80896 ----a-w- c:\windows\system32\tlntsess.exe2009-06-12 12:31 . 2004-08-04 11:00 76288 ----a-w- c:\windows\system32\telnet.exe2009-06-10 14:13 . 2004-08-04 11:00 84992 ----a-w- c:\windows\system32\avifil32.dll2009-06-10 13:19 . 2004-08-04 11:00 2066432 ----a-w- c:\windows\system32\mstscax.dll2009-06-10 06:14 . 2004-08-04 11:00 132096 ----a-w- c:\windows\system32\wkssvc.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-15 2007832]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2007-4-9 7168][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-08-15 13:29 11952 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]@="Service"[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" /startup"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"SFP"=c:\program files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe""mmtask"=c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" /startup"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe""IntelMeM"=c:\program files\Intel\Modem Event Monitor\IntelMEM.exe"RealTray"=c:\program files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER"dla"=c:\windows\system32\dla\tfswctrl.exe"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r"ledofasedi"=Rundll32.exe "c:\windows\system32\yayiluya.dll",s"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe"[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusOverride"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="c:\\Program Files\\AIM\\aim.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"="c:\\Program Files\\AVG\\AVG8\\avgupd.exe"="c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="c:\\Program Files\\iTunes\\iTunes.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol"10426:UDP"= 10426:UDP:SingleClick ICCR1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [5/27/2009 6:51 PM 335240]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [5/27/2009 6:51 PM 108552]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/27/2009 6:51 PM 297752]R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\SYSTEM32\TUProgSt.exe [5/27/2009 7:03 PM 603904]R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/15/2007 5:07 AM 24652]R2 WUSB54Gv42SVC;WUSB54Gv42SVC;c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe [1/21/2009 12:30 PM 53307]S1 SASDIFSV;SASDIFSV;\??\f:\superantispyware\SASDIFSV.SYS --> f:\superantispyware\SASDIFSV.SYS [?]S1 SASKUTIL;SASKUTIL;\??\f:\superantispyware\SASKUTIL.sys --> f:\superantispyware\SASKUTIL.sys [?]S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4.tmp --> c:\windows\system32\4.tmp [?]S3 SASENUM;SASENUM;\??\f:\superantispyware\SASENUM.SYS --> f:\superantispyware\SASENUM.SYS [?]--- Other Services/Drivers In Memory ---*NewlyCreated* - RZQXIGXN*Deregistered* - rzqxigxnHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsUxTuneUpzelxplou[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP.Contents of the 'Scheduled Tasks' folder2009-09-01 c:\windows\Tasks\1-Click Maintenance.job- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 20:28]2009-08-22 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]2009-09-01 c:\windows\Tasks\MP Scheduled Scan.job- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20].- - - - ORPHANS REMOVED - - - -BHO-{52388bc5-b89c-40b3-8d98-b1e516455aae} - (no file)HKCU-Run-SUPERAntiSpyware - f:\superantispyware\SUPERAntiSpyware.exe.------- Supplementary Scan -------.uStart Page = hxxp://www.google.comuSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uDefault_Search_URL = hxxp://www.google.com/iemStart Page = hxxp://www.google.comuInternet Settings,ProxyOverride = 127.0.0.1;*.localuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htmIE: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm813YYUSIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000IE: iGive Shopping Window - file://c:\program files\iGive__Shopping__Window\igivt\igivC5.htmDPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-09-01 19:49Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]"ImagePath"="\??\c:\windows\system32\4.tmp".--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(3752)c:\windows\system32\WININET.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dll.------------------------ Other Running Processes ------------------------.c:\windows\SYSTEM32\ati2evxx.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Dell Network Assistant\hnm_svc.exec:\program files\Java\jre6\bin\jqs.exec:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEc:\windows\SYSTEM32\wdfmgr.exec:\program files\AVG\AVG8\avgrsx.exec:\program files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exec:\progra~1\AVG\AVG8\avgnsx.exec:\program files\Dell Network Assistant\ezi_hnm2.exec:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exec:\windows\SYSTEM32\wscntfy.exe.**************************************************************************.Completion time: 2009-09-01 19:53 - machine was rebootedComboFix-quarantined-files.txt 2009-09-01 23:53Pre-Run: 144,139,587,584 bytes freePost-Run: 144,343,273,472 bytes freeWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect262 --- E O F --- 2009-08-29 19:01 Link to post Share on other sites More sharing options...
extremeboy Posted September 2, 2009 ID:119141 Share Posted September 2, 2009 Hello.Run a new Win32KDiag scan for me. Download and Run Win32KDiagPlease download Win32Diag from one of the links below and save it to your desktop.Link 1Link 2Link 3Double-click on Win32Diag.exe to run it. If you are using Windows Vista, please right-click and select Run As AdministratorA black command prompt window shall appear.It will now begin to scan. This may take a while, please be paitent until the scan is complete.Once it's done, in the black screen it will say "Finished! Press any key to exit.... Press any key to exit.A log file called Win32KDiag.txt will be created on your desktop.Please copy and paste the contents of that log file here in your next reply please.Also, see if Malwarebytes work now...Download and run MalwareBytes Anti-MalwarePlease download Malwarebytes Anti-Malware and save it to your desktop.alternate download link 1Make sure you are connected to the Internet.Double-click on Download_mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-Malware[*]Then click Finish.[*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.[*]On the Scanner tab:Make sure the "Perform Quick Scan" option is selected.Then click on the Scan button.[*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.[*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".[*]Click OK to close the message box and continue with the removal process.[*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.[*]Make sure that everything is checked, and click Remove Selected.[*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)[*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.[*]Copy and paste the contents of that report in your next reply and exit MBAM.Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this linkAny problems, please let me know.With Regards,Extremeboy Link to post Share on other sites More sharing options...
Trey Posted September 2, 2009 Author ID:119334 Share Posted September 2, 2009 Seems to be pretty good now. I cleaned up the locked files. Uninstalled Winows Defender and AVG (both were damamged), I'm going to reinstall AVG. Cleaned the registery.Log file is located at: C:\Documents and Settings\Kei Yamamoto\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Found mount point : C:\WINDOWS\$hf_mig$\KB916281\KB916281Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB918899\KB918899Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB920213\KB920213Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB922760\KB922760Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB924496\KB924496Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB925454\KB925454Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB928090\KB928090Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB931768\KB931768Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB933566\KB933566Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB937143\KB937143Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB939653\KB939653Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\$NtServicePackUninstallIDNMitigationAPIs$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\$NtServicePackUninstallNLSDownlevelMapping$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB888302$\$NtUninstallKB888302$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB893066$\$NtUninstallKB893066$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB896422$\$NtUninstallKB896422$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB896428$\$NtUninstallKB896428$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB898461$\$NtUninstallKB898461$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB899588$\$NtUninstallKB899588$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB904942$\$NtUninstallKB904942$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB905749$\$NtUninstallKB905749$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB911565$\$NtUninstallKB911565$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB911927$\$NtUninstallKB911927$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB913446$\$NtUninstallKB913446$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB915865$\$NtUninstallKB915865$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917159$\$NtUninstallKB917159$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917734_WMP10$\$NtUninstallKB917734_WMP10$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB917953$\$NtUninstallKB917953$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB923414$\$NtUninstallKB923414$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB923689$\$NtUninstallKB923689$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB925486$\$NtUninstallKB925486$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB926255$\$NtUninstallKB926255$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB927802$\$NtUninstallKB927802$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB929969$\$NtUninstallKB929969$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB930178$\$NtUninstallKB930178$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB931261$\$NtUninstallKB931261$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB931836$\$NtUninstallKB931836$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB933360$\$NtUninstallKB933360$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB936357$\$NtUninstallKB936357$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB936782_WMP10$\$NtUninstallKB936782_WMP10$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB938127$\$NtUninstallKB938127$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB938464_0$\$NtUninstallKB938464_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB941569$\$NtUninstallKB941569$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB951376-v2_0$\$NtUninstallKB951376-v2_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB954211_0$\$NtUninstallKB954211_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB954600_0$\$NtUninstallKB954600_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB955839$\$NtUninstallKB955839$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB958687_0$\$NtUninstallKB958687_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB958690_0$\$NtUninstallKB958690_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$NtUninstallKB960803_0$\$NtUninstallKB960803_0$Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\TEMP\TEMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\TMP\TMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CAVTemp\CAVTempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Config\ConfigMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Connection Wizard\Connection WizardMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d1\d1Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d2\d2Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d3\d3Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d4\d4Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d5\d5Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d6\d6Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d7\d7Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d8\d8Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Cbz\CbzMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Lib\LibMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Wave\WaveMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\CHSIME\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\CHTIME\Applets\AppletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMEJP\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMEJP98\IMEJP98Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMJP8_1\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMKR6_1\APPLETS\APPLETSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\IMKR6_1\DICTS\DICTSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\IME\SHARED\RES\RESMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\JAVA\TRUSTLIB\TRUSTLIBMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind LogsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Motive\MotiveMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\MSAPPS\MSINFO\MSINFOMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\QHEADLES\QHEADLESMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\QSIGNOFF\QSIGNOFFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\ERRORREP\UserDumps\UserDumpsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\BATCH\BATCHMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Config\CheckPoint\CheckPointMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\HelpFiles\HelpFilesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\InstalledSKUs\InstalledSKUsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\DFSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Temp\TempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PIF\PIFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLogMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\DownloadedMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\0eda838ef8ec599d822155030a70ecac\0eda838ef8ec599d822155030a70ecacMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\0facce6115ab861022eae3087e064a2a\0facce6115ab861022eae3087e064a2aMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backupMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Sun\Java\Deployment\DeploymentMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1025\1025Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1028\1028Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1031\1031Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1037\1037Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1041\1041Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1042\1042Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\1054\1054Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\2052\2052Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\3076\3076Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\3COM_DMI\3COM_DMIMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\appmgmt\MACHINE\MACHINEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\appmgmt\S-1-5-21-1173721996-2478878603-2040195317-1006\S-1-5-21-1173721996-2478878603-2040195317-1006Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch1\ch1Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch2\ch2Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Jasc Software Inc\Paint Shop Pro 8\Cache\CacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-861567501-1078081533-725345543-500\S-1-5-21-861567501-1078081533-725345543-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\Media Player\Media PlayerMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\CertificatesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Sun\Java\Deployment\javaws\cache\cacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Desktop\DesktopMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\CD Burning\CD BurningMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1173721996-2478878603-2040195317-500\S-1-5-21-1173721996-2478878603-2040195317-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-861567501-1078081533-725345543-500\S-1-5-21-861567501-1078081533-725345543-500Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\My Documents\My Pictures\Jasc Paint Shop Photo Album Images\Jasc Paint Shop Photo Album ImagesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\My Documents\My PSP8 Files\Workspaces\WorkspacesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NetHood\NetHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\PrintHood\PrintHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\DHCP\DHCPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\DRIVERS\DISDN\DISDNMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\EXPORT\EXPORTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\FxsTmp\FxsTmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\CINTLGNT\CINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\PINTLGNT\PINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\Microsoft\Crypto\RSA\MachineKeys\MachineKeysMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\MUI\DISPSPEC\DISPSPECMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\ISPSGNUP\ISPSGNUPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMCUST\OEMCUSTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMHW\OEMHWMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\HTML\OEMREG\OEMREGMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\OOBE\SAMPLE\SAMPLEMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\ShellExt\ShellExtMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\PRINTERSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\MOF\BAD\BADMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\MOF\GOOD\GOODMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WBEM\SNMP\SNMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\WINS\WINSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SYSTEM32\XIRCOM\XIRCOMMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTempMount point destination : \Device\__max++>\^Finished! Link to post Share on other sites More sharing options...
Trey Posted September 2, 2009 Author ID:119337 Share Posted September 2, 2009 How the heck do you edit a post on here??P.S. ran Mbam, found a couple things, quarenteed items and volume restores. Deleted everything. Link to post Share on other sites More sharing options...
extremeboy Posted September 2, 2009 ID:119338 Share Posted September 2, 2009 Hello.Please delete the exisiting Win32kDiag.txt that is on your desktop.Now re-run Win32KDiag again and ATTACH the log once it's done. Don't post it.--Post back with the MBAM log once it's scan is done as well.Also, re-run DDS and post back with those logs as well.Thanks.With Regards,Extremeboy Link to post Share on other sites More sharing options...
extremeboy Posted September 2, 2009 ID:119339 Share Posted September 2, 2009 Hello.How the heck do you edit a post on here??Take a look here: http://www.malwarebytes.org/forums/index.php?showtopic=23443P.S. ran Mbam, found a couple things, quarenteed items and volume restores. Deleted everything.I want to see the log and...Post back with the MBAM log once it's scan is done as well.Also, re-run DDS and post back with those logs as well.I need to leave now. I'll review those once I come back.~Extremeboy Link to post Share on other sites More sharing options...
Trey Posted September 3, 2009 Author ID:119565 Share Posted September 3, 2009 Logs from Mbam/Win32k/SSD attached.mbam_log_2009_09_02__16_12_18_.txtmbam_log_2009_09_03__00_03_32_.txtDDS.txtAttach.txtWin32kDiag.txt Link to post Share on other sites More sharing options...
extremeboy Posted September 3, 2009 ID:119873 Share Posted September 3, 2009 Hello.That looks pretty good.Continue wtih...Run Fix with Win32KDiagPlease download Win32Diag from one of the links below and save it to your desktop if you have not done so already.It's important that it is saved on your desktop and not anywhere else.Link 1Link 2Link 3Delete the Win32KDiag.txt you currently have on your desktop.Now go to Start >> Run >> In the open field please copy and paste in the following without the word "code":"%userprofile%\desktop\win32kdiag.exe" -f -rNow press OkWin32KDiag will now begin to fix.Once it's done a log file called Win32kDiag.txt will be located on your desktop.Please attach that log file here in your next reply.Update Java to Version 6 Update 16Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.Look for "Java Runtime Environment (JRE)" JRE 6 Update 16.Click the Download button to the right.Select your Platform: "Windows".Select your Language: "Multi-language".Read the License Agreement, and then check the box that says: "Accept License Agreement".Click Continue and the page will refresh.Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.Close any programs you may have running - especially your web browser.Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.Repeat as many times as necessary to remove each Java versions.Reboot your computer once all Java components are removed.Then from your desktop double-click on jre-6u16-windows-i586.exe to install the newest version.-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.Run Scan with KasperskyPlease do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.Open the Kaspersky WebScannerpage.Click on the button on the main page.The program will launch and fill in the Information section on the left.Read the "Requirements and Limitations" then press the button.The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.Once the files have been downloaded, click on the ...button.In the scan settings make sure the following are selected:Detect malicious programs of the following categories:Viruses, Worms, Trojan Horses, RootkitsSpyware, Adware, Dialers and other potentially dangerous programsScan compound files (doesn't apply to the File scan area):ArchivesMail databasesBy default the above items should already be checked.Click the button, if you made any changes.[*]Now under the Scan section on the left:Select My Computer[*]The program will now start and scan your system. This will run for a while, be patient and let it finish.[*]Once the scan is complete, click on View scan report[*]Now, click on the Save Report as button.[*]Save the file to your desktop.[*]Copy and paste that information in your next post.You can refer to this animation by sundavis if needed.Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.Thanks.With Regards,Extremeboy Link to post Share on other sites More sharing options...
Trey Posted September 4, 2009 Author ID:120296 Share Posted September 4, 2009 Logs attached!Win32kDiag.txtKScan.txtDDS.txtAttach.txt Link to post Share on other sites More sharing options...
extremeboy Posted September 4, 2009 ID:120554 Share Posted September 4, 2009 Hello.That looks pretty good.Just a few things we need to remove...Download and Run OTMPlease download OTM by OldTimer and save it to your desktop. Double click the icon on your desktop If you are running on Vista, right click on the file and choose Run As Administrator. Paste the following code under the area. Do not include the word "Code".:servicesSASENUMSASKUTILMEMSWEEP2SASDIFSV:filesc:\windows\system32\uacav.dllc:\windows\system32\uacsr.datc:\windows\system32\uacbbr.dllf:\superantispywarec:\windows\system32\4.tmp:commands[EmptyTemp][Reboot]Click the large button.If OTM requires are reboot, please allow it to do so.Copy/Paste the contents under the line here in your next reply.Note: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.Thanks.With Regards,Extremeboy Link to post Share on other sites More sharing options...
Trey Posted September 5, 2009 Author ID:120890 Share Posted September 5, 2009 This computer (which isn't mine luckily) is running 100 percent better, it was damn near inoperable before. Appart the suspisious things in the reports I wouldn't know there was any problem at all now. OTM kind of half-crashed when it started, and a error message popped up, but it did run all the way to the finish, the report is attached. Oh, and any items listed as being on f: will be gone, f: was a USB drive.OTM.txtDDS.txtAttach.txt Link to post Share on other sites More sharing options...
extremeboy Posted September 5, 2009 ID:121218 Share Posted September 5, 2009 Hello.Looks good.Just manually delete this file in your C:\ drive...C:\478115611 <- This file..Log looks clean. Good job. We can wrap up then.Please follow/read the steps below to remove the tools we used and for some more information. Uninstall ComboFixRemove Combofix now that we're done with it.Click on your Start Menu, then Run....Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".You will then recieve a message letting you know that Combofix was uninstalled Successfully.This will remove files/folders assoicated with combofix and uninstall it.Download and Run OTCWe will now remove the tools we used during this fix using OTC.Download OTC by OldTimer and save it to your desktop.Double click icon to start the program. If you are using Vista, please right-click and choose run as administratorThen Click the big button. You will get a prompt saying "Being Cleanup Process". Please select Yes.Restart your computer when prompted.System A bit Slow? Try StartupLightYou may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.Congratulations! You now appear clean! Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:Preventing Infections in the FuturePlease also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:So How did I get infected?Miekies' prevention suggestionsHardening Windows Security - Part 1 & Part 2.[*]Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a sm Link to post Share on other sites More sharing options...
Trey Posted September 6, 2009 Author ID:121316 Share Posted September 6, 2009 Thanks for all your help! Link to post Share on other sites More sharing options...
extremeboy Posted September 6, 2009 ID:121333 Share Posted September 6, 2009 You're welcome. Happy surfing again.Take care,Extremeboy Link to post Share on other sites More sharing options...
extremeboy Posted September 6, 2009 ID:121334 Share Posted September 6, 2009 Hello.Since the problem appears to be resolved, this topic is now Closed. Glad we could help If you need this topic reopened, pleaseSend Me a Message. In your message please include the address of this thread in your request.This applies only to the original topic starterEveryone else please start a new topic in the Hijackthis-Malware Removal Forum.With Regards,Extremeboy Link to post Share on other sites More sharing options...
Recommended Posts