Jump to content

Malwarebytes Won't Run


Recommended Posts

Hi, I'm experiencing difficulty in getting Malwarebytes to run, and was looking for some help. Ido have anti-virus, and it downloaded just fine.... Here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:24:19 PM, on 8/30/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\NavNT\defwatch.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NavNT\rtvscan.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\NavNT\vptray.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE

C:\Compaq\EAKDRV\EAUSBKBD.EXE

C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uiowa.edu/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/yessentials_.../search/ie.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://desktop.presario.net/scripts/redire...c02&lc=0409

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;*.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

N3 - Netscape 7: # Mozilla User Preferences

// This is a generated file!

user_pref("aim.internal.buddy.MaxBuddies", 200);

user_pref("aim.internal.intproxyprotocol", 1);

user_pref("aim.session.finishedwizard", true);

user_pref("aim.session.firsttime", false);

user_pref("aim.session.latestaimscreenname", "saiyan1129");

user_pref("aim.session.screenname", "saiyan1129");

user_pref("browser.bookmarks.added_static_root", true);

user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\~suicidaL feeLing~\\Application Data\\Mozilla\\Profiles\\default\\0j93f9uh.slt");

user_pref("browser.download.dir", "C:\\Program Files\\Netscape\\Netscape 6");

user_pref("browser.history.last_page_visited", "http://verizonwireless.com/sniff.html");

user_pref("browser.history_expire_days", 1);

user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src");

user_pref("browser.sessionhistory.max_entries", 10);

user_pref("browser.startup.homepage",

N3 - Netscape 7: # Mozilla User Preferences

// This is a generated file!

user_pref("aim.internal.buddy.MaxBuddies", 200);

user_pref("aim.internal.intproxyprotocol", 1);

user_pref("aim.session.finishedwizard", true);

user_pref("aim.session.firsttime", false);

user_pref("aim.session.latestaimscreenname", "saiyan1129");

user_pref("aim.session.screenname", "saiyan1129");

user_pref("browser.bookmarks.added_static_root", true);

user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\~suicidaL feeLing~\\Application Data\\Mozilla\\Profiles\\default\\0j93f9uh.slt");

user_pref("browser.download.dir", "C:\\Program Files\\Netscape\\Netscape 6");

user_pref("browser.history.last_page_visited", "http://verizonwireless.com/sniff.html");

user_pref("browser.history_expire_days", 1);

user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src");

user_pref("browser.sessionhistory.max_entries", 10);

user_pref("browser.startup.homepage",

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Nothing - {8d83b16e-0de1-452b-ac52-96ec0b34aa4b} - C:\WINDOWS\system32\hp5D63.tmp (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe

O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe

O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe

O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"

O4 - HKLM\..\Run: [sysurl] C:\WINDOWS\inf\sysurl.exe

O4 - HKLM\..\Run: [lexplore] lexplore.exe

O4 - HKLM\..\Run: [win32] iexplore.exe

O4 - HKLM\..\Run: [sAClient] "C:\Program Files\Mediacom\BBClient\Programs\QicSetup.exe" /AfterReboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\RunServices: [lexplore] lexplore.exe

O4 - HKLM\..\RunServices: [win32] iexplore.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [0urdomzp.exe] C:\DOCUME~1\~SUICI~1\LOCALS~1\Temp\0urdomzp.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKLM\..\Policies\Explorer\Run: [homepage.monitor.exe] C:\Program Files\iCodecPack\isamonitor.exe

O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downlo..._2/axofupld.cab

O16 - DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - http://download.divx.com/player/DivXPlayerInstaller.exe

O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://playroom.icq.com/odyssey_web8.cab

O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...ebio5_1_4_0.cab

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{A4CBD167-42B2-4F2F-A2A9-8FE42885FCD3}: NameServer = 85.255.112.9,85.255.112.24

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.9,85.255.112.24

O18 - Protocol hijack: mhtml -

O21 - SSODL: considerateness - {4d993022-0899-4599-b4b6-0f887d0802e6} - (no file)

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)

O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: WUSB54Gv42SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

--

End of file - 13556 bytes

Any help would be greatly appreciated, thanks.

Link to post
Share on other sites

Hello and welcome to the forum!

My name is Extremeboy, and I will help you with your log.

Please continue with running a scan with RootRepeal, followed by DDS, a scanner tool.

--

Regarding Malwarebyte not running, that may be due to several reasons. You may want to try renaming it.

Rename the C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe <- Rename this file. See if it works.

---

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.

  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the reportTab.png tab at the bottom.
  • Now press the btnScan.png button.
  • A box will pop up, check the boxes beside All Seven options/scan area
    RR_checkbox.jpg
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. saveReport.png
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

Download and run DDS

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Download DDS by sUBs from one of the following links. Save it to your desktop.

    [*]Double click on the DDS icon, allow it to run.

    [*]A small box will open, with an explanation about the tool. No input is needed, the scan is running.

    [*]Notepad will open with the results soon.

    [*]Follow the instructions that pop up for posting the results and then click Ok.

    [*]The black and message box window shall then disappear.

    [*]Please save both log files on your desktop and post the DDS.txt and zip up and attach Attach.txt as instructed.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Also, please provide a description of any remaining problems or symptoms you may still have please.

With Regards,

Extremeboy

Link to post
Share on other sites

Ok, ran the DDS and Root Repeal, here are the logs:

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/09/01 13:59

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: ACPI.sys

Image Path: ACPI.sys

Address: 0xF85E7000 Size: 187776 File Visible: - Signed: -

Status: -

Name: ACPI_HAL

Image Path: \Driver\ACPI_HAL

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: AegisP.sys

Image Path: C:\WINDOWS\system32\DRIVERS\AegisP.sys

Address: 0xF89AE000 Size: 18720 File Visible: - Signed: -

Status: -

Name: afd.sys

Image Path: C:\WINDOWS\System32\drivers\afd.sys

Address: 0xF4D1B000 Size: 138496 File Visible: - Signed: -

Status: -

Name: AmosNt.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\AmosNt.SYS

Address: 0xF7825000 Size: 159744 File Visible: - Signed: -

Status: -

Name: atapi.sys

Image Path: atapi.sys

Address: 0xF855A000 Size: 96512 File Visible: - Signed: -

Status: -

Name: audstub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys

Address: 0xF8C42000 Size: 3072 File Visible: - Signed: -

Status: -

Name: avgio.sys

Image Path: C:\Program Files\Avira\AntiVir Desktop\avgio.sys

Address: 0xF8BB0000 Size: 6144 File Visible: - Signed: -

Status: -

Name: avgntflt.sys

Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys

Address: 0xF3614000 Size: 81920 File Visible: - Signed: -

Status: -

Name: avipbb.sys

Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys

Address: 0xF4B76000 Size: 114688 File Visible: - Signed: -

Status: -

Name: basic2.sys

Image Path: C:\WINDOWS\System32\DRIVERS\basic2.sys

Address: 0xF78D5000 Size: 76096 File Visible: - Signed: -

Status: -

Name: Beep.SYS

Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS

Address: 0xF8BA4000 Size: 4224 File Visible: - Signed: -

Status: -

Name: BOOTVID.dll

Image Path: C:\WINDOWS\system32\BOOTVID.dll

Address: 0xF8A46000 Size: 12288 File Visible: - Signed: -

Status: -

Name: Cdfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS

Address: 0xF4CCB000 Size: 63744 File Visible: - Signed: -

Status: -

Name: Cdr4_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS

Address: 0xF8D1E000 Size: 2432 File Visible: - Signed: -

Status: -

Name: Cdralw2k.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS

Address: 0xF8D20000 Size: 2560 File Visible: - Signed: -

Status: -

Name: cdrom.sys

Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys

Address: 0xF87E6000 Size: 62976 File Visible: - Signed: -

Status: -

Name: cdudf_XP.SYS

Image Path: C:\WINDOWS\System32\Drivers\cdudf_XP.SYS

Address: 0xF4E61000 Size: 240640 File Visible: - Signed: -

Status: -

Name: CLASSPNP.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS

Address: 0xF8676000 Size: 53248 File Visible: - Signed: -

Status: -

Name: ctac32k.sys

Image Path: C:\WINDOWS\System32\drivers\ctac32k.sys

Address: 0xF5C72000 Size: 85728 File Visible: - Signed: -

Status: -

Name: ctaud2k.sys

Image Path: C:\WINDOWS\system32\drivers\ctaud2k.sys

Address: 0xF7948000 Size: 488544 File Visible: - Signed: -

Status: -

Name: ctoss2k.sys

Image Path: C:\WINDOWS\system32\drivers\ctoss2k.sys

Address: 0xF78E8000 Size: 101792 File Visible: - Signed: -

Status: -

Name: ctprxy2k.sys

Image Path: C:\WINDOWS\System32\drivers\ctprxy2k.sys

Address: 0xF8B72000 Size: 5632 File Visible: - Signed: -

Status: -

Name: ctsfm2k.sys

Image Path: C:\WINDOWS\System32\drivers\ctsfm2k.sys

Address: 0xF5C3A000 Size: 125280 File Visible: - Signed: -

Status: -

Name: disk.sys

Image Path: disk.sys

Address: 0xF8666000 Size: 36352 File Visible: - Signed: -

Status: -

Name: drmk.sys

Image Path: C:\WINDOWS\system32\drivers\drmk.sys

Address: 0xF87B6000 Size: 61440 File Visible: - Signed: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xF4721000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8BDA000 Size: 8192 File Visible: No Signed: -

Status: -

Name: Dxapi.sys

Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys

Address: 0xF4C40000 Size: 12288 File Visible: - Signed: -

Status: -

Name: dxg.sys

Image Path: C:\WINDOWS\System32\drivers\dxg.sys

Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: -

Status: -

Name: dxgthk.sys

Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys

Address: 0xF8CA6000 Size: 4096 File Visible: - Signed: -

Status: -

Name: eaps2kbd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\eaps2kbd.sys

Address: 0xF89DE000 Size: 23232 File Visible: - Signed: -

Status: -

Name: EAWDMFD.sys

Image Path: C:\WINDOWS\system32\drivers\EAWDMFD.sys

Address: 0xF8AD2000 Size: 14048 File Visible: - Signed: -

Status: -

Name: emupia2k.sys

Image Path: C:\WINDOWS\System32\drivers\emupia2k.sys

Address: 0xF5C59000 Size: 98720 File Visible: - Signed: -

Status: -

Name: fallback.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fallback.sys

Address: 0xF2AAA000 Size: 281920 File Visible: - Signed: -

Status: -

Name: faxnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\faxnt.sys

Address: 0xF28E4000 Size: 195360 File Visible: - Signed: -

Status: -

Name: fdc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys

Address: 0xF89EE000 Size: 27392 File Visible: - Signed: -

Status: -

Name: Fips.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS

Address: 0xF86C6000 Size: 44544 File Visible: - Signed: -

Status: -

Name: flpydisk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys

Address: 0xF8A2E000 Size: 20480 File Visible: - Signed: -

Status: -

Name: fltmgr.sys

Image Path: fltmgr.sys

Address: 0xF853A000 Size: 129792 File Visible: - Signed: -

Status: -

Name: Fs_Rec.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

Address: 0xF8BA2000 Size: 7936 File Visible: - Signed: -

Status: -

Name: fsksnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fsksnt.sys

Address: 0xF2A8E000 Size: 113024 File Visible: - Signed: -

Status: -

Name: ftdisk.sys

Image Path: ftdisk.sys

Address: 0xF85B7000 Size: 125056 File Visible: - Signed: -

Status: -

Name: gameenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys

Address: 0xF842E000 Size: 10624 File Visible: - Signed: -

Status: -

Name: GEARAspiWDM.sys

Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys

Address: 0xF8816000 Size: 40960 File Visible: - Signed: -

Status: -

Name: GTNDIS5.SYS

Image Path: C:\WINDOWS\system32\GTNDIS5.SYS

Address: 0xF0E96000 Size: 15872 File Visible: - Signed: -

Status: -

Name: gxvxcvwcvmdnchkgssphtodhwlrykubnaiula.sys

Image Path: C:\WINDOWS\system32\drivers\gxvxcvwcvmdnchkgssphtodhwlrykubnaiula.sys

Address: 0xF4E16000 Size: 66944 File Visible: - Signed: -

Status: Hidden from the Windows API!

Name: ha10kx2k.sys

Image Path: C:\WINDOWS\system32\drivers\ha10kx2k.sys

Address: 0xF5C87000 Size: 675872 File Visible: - Signed: -

Status: -

Name: hal.dll

Image Path: C:\WINDOWS\system32\hal.dll

Address: 0x806EE000 Size: 131840 File Visible: - Signed: -

Status: -

Name: HIDCLASS.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS

Address: 0xF109E000 Size: 36864 File Visible: - Signed: -

Status: -

Name: HIDPARSE.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS

Address: 0xF8906000 Size: 28672 File Visible: - Signed: -

Status: -

Name: hidusb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\hidusb.sys

Address: 0xEF776000 Size: 10368 File Visible: - Signed: -

Status: -

Name: HSF_CNXT.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys

Address: 0xF784C000 Size: 558304 File Visible: - Signed: -

Status: -

Name: HTTP.sys

Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys

Address: 0xF1156000 Size: 264832 File Visible: - Signed: -

Status: -

Name: i8042prt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys

Address: 0xF8786000 Size: 52480 File Visible: - Signed: -

Status: -

Name: Imapi.sys

Image Path: C:\WINDOWS\system32\drivers\Imapi.sys

Address: 0xF8826000 Size: 42112 File Visible: - Signed: -

Status: -

Name: ipnat.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys

Address: 0xF4B92000 Size: 152832 File Visible: - Signed: -

Status: -

Name: ipsec.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys

Address: 0xF4DBE000 Size: 75264 File Visible: - Signed: -

Status: -

Name: isapnp.sys

Image Path: isapnp.sys

Address: 0xF8636000 Size: 37248 File Visible: - Signed: -

Status: -

Name: k56nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\k56nt.sys

Address: 0xF2A2E000 Size: 392992 File Visible: - Signed: -

Status: -

Name: kbdclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys

Address: 0xF89E6000 Size: 24576 File Visible: - Signed: -

Status: -

Name: KDCOM.DLL

Image Path: C:\WINDOWS\system32\KDCOM.DLL

Address: 0xF8B36000 Size: 8192 File Visible: - Signed: -

Status: -

Name: kmixer.sys

Image Path: C:\WINDOWS\system32\drivers\kmixer.sys

Address: 0xEF71F000 Size: 172416 File Visible: - Signed: -

Status: -

Name: ks.sys

Image Path: C:\WINDOWS\system32\drivers\ks.sys

Address: 0xF7901000 Size: 143360 File Visible: - Signed: -

Status: -

Name: KSecDD.sys

Image Path: KSecDD.sys

Address: 0xF8511000 Size: 92928 File Visible: - Signed: -

Status: -

Name: Lbd.sys

Image Path: Lbd.sys

Address: 0xF8686000 Size: 57472 File Visible: - Signed: -

Status: -

Name: LVPrcMon.sys

Image Path: C:\WINDOWS\system32\drivers\LVPrcMon.sys

Address: 0xF893E000 Size: 16768 File Visible: - Signed: -

Status: -

Name: mdmxsdk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys

Address: 0xF2BE7000 Size: 8896 File Visible: - Signed: -

Status: -

Name: mmc_2K.SYS

Image Path: C:\WINDOWS\System32\Drivers\mmc_2K.SYS

Address: 0xF8A1E000 Size: 22464 File Visible: - Signed: -

Status: -

Name: mnmdd.SYS

Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS

Address: 0xF8BA6000 Size: 4224 File Visible: - Signed: -

Status: -

Name: Modem.SYS

Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS

Address: 0xF89FE000 Size: 30080 File Visible: - Signed: -

Status: -

Name: mouclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys

Address: 0xF89D6000 Size: 23040 File Visible: - Signed: -

Status: -

Name: mouhid.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys

Address: 0xEF76E000 Size: 12160 File Visible: - Signed: -

Status: -

Name: MountMgr.sys

Image Path: MountMgr.sys

Address: 0xF8646000 Size: 42368 File Visible: - Signed: -

Status: -

Name: mrxdav.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys

Address: 0xF2C07000 Size: 180608 File Visible: - Signed: -

Status: -

Name: mrxsmb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

Address: 0xF4BB8000 Size: 455296 File Visible: - Signed: -

Status: -

Name: Msfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS

Address: 0xF88EE000 Size: 19072 File Visible: - Signed: -

Status: -

Name: msgpc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys

Address: 0xF7C03000 Size: 35072 File Visible: - Signed: -

Status: -

Name: mssmbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys

Address: 0xF7A1C000 Size: 15488 File Visible: - Signed: -

Status: -

Name: Mup.sys

Image Path: Mup.sys

Address: 0xF846A000 Size: 105344 File Visible: - Signed: -

Status: -

Name: NAVAPEL.SYS

Image Path: C:\Program Files\NavNT\NAVAPEL.SYS

Address: 0xF4952000 Size: 17056 File Visible: - Signed: -

Status: -

Name: NDIS.SYS

Image Path: C:\WINDOWS\system32\Drivers\NDIS.SYS

Address: 0xF8572000 Size: 182656 File Visible: - Signed: -

Status: -

Name: ndistapi.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys

Address: 0xF8ACA000 Size: 10112 File Visible: - Signed: -

Status: -

Name: ndisuio.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndisuio.sys

Address: 0xF3644000 Size: 14592 File Visible: - Signed: -

Status: -

Name: ndiswan.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys

Address: 0xF764C000 Size: 91520 File Visible: - Signed: -

Status: -

Name: NDProxy.SYS

Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS

Address: 0xF7BE3000 Size: 40576 File Visible: - Signed: -

Status: -

Name: netbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys

Address: 0xF7B93000 Size: 34688 File Visible: - Signed: -

Status: -

Name: netbt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys

Address: 0xF4D3D000 Size: 162816 File Visible: - Signed: -

Status: -

Name: Npfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS

Address: 0xF88F6000 Size: 30848 File Visible: - Signed: -

Status: -

Name: Ntfs.sys

Image Path: Ntfs.sys

Address: 0xF8484000 Size: 574976 File Visible: - Signed: -

Status: -

Name: ntoskrnl.exe

Image Path: C:\WINDOWS\system32\ntoskrnl.exe

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: Null.SYS

Image Path: C:\WINDOWS\System32\Drivers\Null.SYS

Address: 0xF8D21000 Size: 2944 File Visible: - Signed: -

Status: -

Name: nv4_disp.dll

Image Path: C:\WINDOWS\System32\nv4_disp.dll

Address: 0xBF9D5000 Size: 4247552 File Visible: - Signed: -

Status: -

Name: nv4_mini.sys

Image Path: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

Address: 0xF7691000 Size: 1465312 File Visible: - Signed: -

Status: -

Name: nv_agp.sys

Image Path: nv_agp.sys

Address: 0xF8A4A000 Size: 12160 File Visible: - Signed: -

Status: -

Name: parport.sys

Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys

Address: 0xF79E4000 Size: 80128 File Visible: - Signed: -

Status: -

Name: PartMgr.sys

Image Path: PartMgr.sys

Address: 0xF88BE000 Size: 19712 File Visible: - Signed: -

Status: -

Name: ParVdm.SYS

Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS

Address: 0xF8B54000 Size: 6784 File Visible: - Signed: -

Status: -

Name: pci.sys

Image Path: pci.sys

Address: 0xF85D6000 Size: 68224 File Visible: - Signed: -

Status: -

Name: pciide.sys

Image Path: pciide.sys

Address: 0xF8BFE000 Size: 3328 File Visible: - Signed: -

Status: -

Name: PCIIDEX.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS

Address: 0xF88B6000 Size: 28672 File Visible: - Signed: -

Status: -

Name: pfc.sys

Image Path: C:\WINDOWS\system32\drivers\pfc.sys

Address: 0xF842A000 Size: 9856 File Visible: - Signed: -

Status: -

Name: PfModNT.sys

Image Path: C:\WINDOWS\System32\PfModNT.sys

Address: 0xF8B6E000 Size: 4352 File Visible: - Signed: -

Status: -

Name: PnpManager

Image Path: \Driver\PnpManager

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: portcls.sys

Image Path: C:\WINDOWS\system32\drivers\portcls.sys

Address: 0xF7924000 Size: 147456 File Visible: - Signed: -

Status: -

Name: psched.sys

Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys

Address: 0xF763B000 Size: 69120 File Visible: - Signed: -

Status: -

Name: ptilink.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys

Address: 0xF8A0E000 Size: 17792 File Visible: - Signed: -

Status: -

Name: pwd_2K.SYS

Image Path: C:\WINDOWS\System32\Drivers\pwd_2K.SYS

Address: 0xF77F7000 Size: 117536 File Visible: - Signed: -

Status: -

Name: PxHelp20.sys

Image Path: PxHelp20.sys

Address: 0xF8696000 Size: 35648 File Visible: - Signed: -

Status: -

Name: rasacd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys

Address: 0xF8AEE000 Size: 8832 File Visible: - Signed: -

Status: -

Name: rasl2tp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys

Address: 0xF8896000 Size: 51328 File Visible: - Signed: -

Status: -

Name: raspppoe.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys

Address: 0xF88A6000 Size: 41472 File Visible: - Signed: -

Status: -

Name: raspptp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys

Address: 0xF7C13000 Size: 48384 File Visible: - Signed: -

Status: -

Name: raspti.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys

Address: 0xF8A16000 Size: 16512 File Visible: - Signed: -

Status: -

Name: RAW

Image Path: \FileSystem\RAW

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: rdbss.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys

Address: 0xF4C50000 Size: 175744 File Visible: - Signed: -

Status: -

Name: RDPCDD.sys

Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

Address: 0xF8BA8000 Size: 4224 File Visible: - Signed: -

Status: -

Name: redbook.sys

Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys

Address: 0xF87F6000 Size: 57600 File Visible: - Signed: -

Status: -

Name: rksample.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rksample.sys

Address: 0xF8806000 Size: 54688 File Visible: - Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xEF9B5000 Size: 49152 File Visible: No Signed: -

Status: -

Name: serenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys

Address: 0xF8432000 Size: 15744 File Visible: - Signed: -

Status: -

Name: serial.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys

Address: 0xF8796000 Size: 64512 File Visible: - Signed: -

Status: -

Name: SOAR.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\SOAR.SYS

Address: 0xF87D6000 Size: 61440 File Visible: - Signed: -

Status: -

Name: sr.sys

Image Path: sr.sys

Address: 0xF8528000 Size: 73472 File Visible: - Signed: -

Status: -

Name: srv.sys

Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys

Address: 0xF2914000 Size: 333952 File Visible: - Signed: -

Status: -

Name: SSI.SYS

Image Path: SSI.SYS

Address: 0xF859F000 Size: 98304 File Visible: - Signed: -

Status: -

Name: ssmdrv.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

Address: 0xF88FE000 Size: 23040 File Visible: - Signed: -

Status: -

Name: strmdisp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\strmdisp.sys

Address: 0xF494A000 Size: 18880 File Visible: - Signed: -

Status: -

Name: swenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys

Address: 0xF8B92000 Size: 4352 File Visible: - Signed: -

Status: -

Name: SYMEVENT.SYS

Image Path: C:\Program Files\Symantec\SYMEVENT.SYS

Address: 0xF1D89000 Size: 50880 File Visible: - Signed: -

Status: -

Name: sysaudio.sys

Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys

Address: 0xF2B3F000 Size: 60800 File Visible: - Signed: -

Status: -

Name: tcpip.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys

Address: 0xF4D65000 Size: 361600 File Visible: - Signed: -

Status: -

Name: TDI.SYS

Image Path: C:\WINDOWS\system32\Drivers\TDI.SYS

Address: 0xF88C6000 Size: 20480 File Visible: - Signed: -

Status: -

Name: termdd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys

Address: 0xF7BF3000 Size: 40704 File Visible: - Signed: -

Status: -

Name: tonesnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tonesnt.sys

Address: 0xF1C69000 Size: 53792 File Visible: - Signed: -

Status: -

Name: UdfReadr_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS

Address: 0xF4DE3000 Size: 206464 File Visible: - Signed: -

Status: -

Name: update.sys

Image Path: C:\WINDOWS\System32\DRIVERS\update.sys

Address: 0xF75DD000 Size: 384768 File Visible: - Signed: -

Status: -

Name: USBD.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS

Address: 0xF8B9C000 Size: 8192 File Visible: - Signed: -

Status: -

Name: usbhub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys

Address: 0xF7BC3000 Size: 59520 File Visible: - Signed: -

Status: -

Name: usbohci.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbohci.sys

Address: 0xF89F6000 Size: 17152 File Visible: - Signed: -

Status: -

Name: USBPORT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS

Address: 0xF79C0000 Size: 147456 File Visible: - Signed: -

Status: -

Name: v124nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\v124nt.sys

Address: 0xF1B27000 Size: 497312 File Visible: - Signed: -

Status: -

Name: vga.sys

Image Path: C:\WINDOWS\System32\drivers\vga.sys

Address: 0xF88E6000 Size: 20992 File Visible: - Signed: -

Status: -

Name: VIDEOPRT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS

Address: 0xF767D000 Size: 81920 File Visible: - Signed: -

Status: -

Name: VolSnap.sys

Image Path: VolSnap.sys

Address: 0xF8656000 Size: 52352 File Visible: - Signed: -

Status: -

Name: wanarp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys

Address: 0xF86D6000 Size: 34560 File Visible: - Signed: -

Status: -

Name: watchdog.sys

Image Path: C:\WINDOWS\System32\watchdog.sys

Address: 0xF8996000 Size: 20480 File Visible: - Signed: -

Status: -

Name: wdmaud.sys

Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys

Address: 0xF1FB7000 Size: 83072 File Visible: - Signed: -

Status: -

Name: Win32k

Image Path: \Driver\Win32k

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

Name: win32k.sys

Image Path: C:\WINDOWS\System32\win32k.sys

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

Name: WMILIB.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS

Address: 0xF8B38000 Size: 8192 File Visible: - Signed: -

Status: -

Name: WMIxWDM

Image Path: \Driver\WMIxWDM

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

DDS:

DDS (Ver_09-07-30.01) - NTFSx86

Run by ~suicidaL feeLing~ at 14:05:53.68 on Tue 09/01/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_12

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.183 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\NavNT\defwatch.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NavNT\rtvscan.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\carpserv.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\NavNT\vptray.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\~suicidaL feeLing~\Desktop\dds.scr

============== Pseudo HJT Report ===============

uWindow Title = Microsoft Internet Explorer provided by Compaq

uStart Page = hxxp://www.uiowa.edu/

mSearch Bar = hxxp://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html

uInternet Connection Wizard,ShellNext = hxxp://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&c=2c02&lc=0409

uInternet Settings,ProxyOverride = *.r21.mchsi.com;*.local

uCustomizeSearch = about:blank

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Nothing: {8d83b16e-0de1-452b-ac52-96ec0b34aa4b} - c:\windows\system32\hp5D63.tmp

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: MoneySide: {9404901d-06da-4b23-a0ee-3ea4f64ec9b3} - c:\program files\microsoft money\system\mnyviewer.dll

uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_7

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [0urdomzp.exe] c:\docume~1\~suici~1\locals~1\temp\0urdomzp.exe

uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

mRun: [CARPService] carpserv.exe

mRun: [WINDVDPatch] CTHELPER.EXE

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe"

mRun: [srmclean] c:\cpqs\scom\srmclean.exe

mRun: [Microsoft Works Portfolio] c:\program files\microsoft works\WksSb.exe /AllUsers

mRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

mRun: [AutoLogon]

mRun: [vptray] c:\program files\navnt\vptray.exe

mRun: [FineReader7NewsReaderPro] "c:\program files\abbyy finereader 7.0 professional edition\AbbyyNewsReader.exe"

mRun: [sysurl] c:\windows\inf\sysurl.exe

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRunServices: [lexplore] lexplore.exe

mRunServices: [win32] iexplore.exe

mExplorerRun: [homepage.monitor.exe] c:\program files\icodecpack\isamonitor.exe

StartupFolder: c:\docume~1\~suici~1\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)

uPolicies-explorer: NoThemesTab = 0 (0x0)

uPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)

uPolicies-system: NoColorChoice = 0 (0x0)

uPolicies-system: NoSizeChoice = 0 (0x0)

uPolicies-system: NoVisualStyleChoice = 0 (0x0)

uPolicies-system: NoDispSettingsPage = 0 (0x0)

uPolicies-system: NoDispAppearancePage = 0 (0x0)

mPolicies-explorer: <NO NAME> =

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper200711281.dll

DPF: {33363249-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/i263_32.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://targetphoto.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - hxxp://download.divx.com/player/DivXPlayerInstaller.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - hxxp://playroom.icq.com/odyssey_web8.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37577.4731597222

DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab

DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - hxxp://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx

TCP: NameServer = 85.255.112.9,85.255.112.24

TCP: {A4CBD167-42B2-4F2F-A2A9-8FE42885FCD3} = 85.255.112.9,85.255.112.24

Notify: MCPClient - c:\program files\common files\stardock\mcpstub.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

Notify: WRNotifier - WRLogonNTF.dll

SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\program files\common files\stardock\MCPCore.dll

SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - c:\windows\system32\iprepair.dll

SSODL: considerateness - {4d993022-0899-4599-b4b6-0f887d0802e6} - No File

LSA: Notification Packages = scecli scecli scecli

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\~suici~1\applic~1\mozilla\firefox\profiles\520wdkqh.default user\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.facebook.com

FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-26 64160]

R0 SSI;SSI;c:\windows\system32\drivers\ssi.sys [2006-3-7 78336]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-30 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-30 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-30 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-30 55656]

R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2002-6-7 17968]

R2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2002-6-3 471040]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-22 24652]

R2 WUSB54Gv42SVC;WUSB54Gv42SVC;c:\program files\linksys wireless-g usb wireless network monitor\WLService.exe [2007-8-25 53307]

S3 FBIKB_NT;FBIKB_NT;\??\c:\windows\system32\drivers\fbikb_nt.sys --> c:\windows\system32\drivers\FBIKB_NT.Sys [?]

S3 iscFlash;iscFlash;\??\c:\windows\system32\drivers\iscflash.sys --> c:\windows\system32\drivers\iscflash.sys [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]

S3 msCMTSrvc;Content Monitoring Tool;c:\windows\system32\mscmtsrvc.exe --> c:\windows\system32\msCMTSrvc.exe [?]

=============== Created Last 30 ================

2009-09-01 13:39 158 a---h--- C:\aaw7boot.cmd

2009-09-01 10:24 11,518 a------- c:\windows\59272v9ruz2a9.dll

2009-09-01 06:53 7,397 a------- c:\windows\3599troz6b5.cpl

2009-09-01 02:05 13,934 a------- c:\windows\61659pyware2z25.dll

2009-08-30 23:19 <DIR> --d----- c:\program files\Trend Micro

2009-08-30 12:50 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-30 12:50 <DIR> --d----- c:\program files\Avira

2009-08-30 12:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira

2009-08-28 11:08 3,634 a------- c:\windows\55d6z9ief2503.exe

2009-08-28 02:07 15,234 a------- c:\windows\system32\371noz-a-v9rus1145.ocx

2009-08-27 00:11 5,487 a------- c:\windows\system32\4fe8b95kdoorz69.exe

2009-08-26 01:06 5,153 a------- c:\windows\system32\2a52backdoo932z4.exe

2009-08-23 21:12 <DIR> --dsh--- c:\documents and settings\~suicidal feeling~\IECompatCache

2009-08-21 23:11 15,299 a------- c:\windows\system32\247229rzj545.exe

2009-08-21 12:55 4,996 a------- c:\windows\6939spars589z.cpl

2009-08-20 04:23 5,372 a------- c:\windows\52397virus910z.dll

2009-08-19 16:12 3,497 a------- c:\windows\system32\z5b59ir5555.bin

2009-08-19 03:23 14,227 a------- c:\windows\98945zroj436.cpl

2009-08-19 03:02 <DIR> --d----- c:\windows\ie8updates

2009-08-18 11:18 <DIR> --d----- c:\windows\system32\Adobe

2009-08-18 10:56 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx

2009-08-18 10:55 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll

2009-08-18 10:55 12,800 -------- c:\windows\system32\dllcache\xpshims.dll

2009-08-18 00:02 17,942 a------- c:\windows\system32\19259zorm9f5.dll

2009-08-16 09:36 11,508 a------- c:\windows\2097759rz7e9.dll

2009-08-16 00:05 14,717 a------- c:\windows\5b64threatz5793.dll

2009-08-15 15:09 3,348 a------- c:\windows\95662troj7z5.dll

2009-08-15 08:15 9,585 a------- c:\windows\system32\5054virz079.dll

2009-08-14 18:08 10,488 a------- c:\windows\33a95ir79z.cpl

2009-08-14 00:09 9,185 a------- c:\windows\40f0ste5l9z34.exe

2009-08-11 08:25 4,583 a------- c:\windows\16954zpy679.bin

2009-08-11 04:00 18,010 a------- c:\windows\1188sza9s5831.exe

2009-08-10 10:16 15,670 a------- c:\windows\2537zw9rm659.dll

2009-08-10 01:17 16,719 a------- c:\windows\7336downlo9de5161z.exe

2009-08-07 22:01 5,996 a------- c:\windows\1053s9yware329z.ocx

2009-08-07 18:02 15,018 a------- c:\windows\25857not-azvir9s5f6.cpl

2009-08-06 07:34 8,366 a------- c:\windows\3c51sparsez99.exe

2009-08-05 07:24 12,292 a------- c:\windows\5000backdoo9z6.dll

2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

2009-08-04 04:25 9,468 a------- c:\windows\32cd5z9al293.cpl

==================== Find3M ====================

2009-08-23 20:36 15,688 a------- c:\windows\system32\lsdelete.exe

2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-08-01 22:43 9,196 a------- c:\windows\system32\1152thr5at24759z.dll

2009-08-01 04:00 2,711 a------- c:\windows\system32\5b87st9az5934.exe

2009-07-28 11:38 4,428 a------- c:\windows\27451spyz7b9.exe

2009-07-28 07:45 9,384 a------- c:\windows\system32\31e9thie531z9.exe

2009-07-26 06:02 15,669 a------- c:\windows\5e53bazkdo9r1563.bin

2009-07-24 15:33 4,569 a------- c:\windows\system32\7759ba9kzoor255.dll

2009-07-20 22:25 9,170 a------- c:\windows\system32\496zth5eat19969.bin

2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll

2009-07-19 08:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll

2009-07-17 23:43 14,820 a------- c:\windows\system32\z1295troj7a89.dll

2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll

2009-07-16 14:59 6,161 a------- c:\windows\z29as59rse1519.bin

2009-07-16 14:59 18,090 a------- c:\windows\49z9backdoor19295.dll

2009-07-16 14:59 15,767 a------- c:\windows\10865zp925.bin

2009-07-16 14:59 10,941 a------- c:\windows\system32\19z4thre5t21595.bin

2009-07-16 14:59 8,074 a------- c:\windows\system32\11937spa5bot9a7z.bin

2009-07-16 14:59 6,433 a------- c:\windows\225z6hacktool9d1.dll

2009-07-16 14:59 3,236 a------- c:\windows\32594s5yz96.bin

2009-07-16 14:59 9,452 a------- c:\windows\5757addwaze3879.exe

2009-07-16 14:59 5,982 a------- c:\windows\system32\194cbazkdoor5864.dll

2009-07-16 14:59 360,960 a------- c:\windows\system32\0urdomzp.exe

2009-07-16 07:52 3,405 a------- c:\windows\system32\zae09t5al352.exe

2009-07-13 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-13 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-07-12 13:17 17,984 a------- c:\windows\system32\z016vi93558.exe

2009-07-12 12:21 4,874,240 a------- c:\windows\system32\dllcache\wmp.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\wmpdxm.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\dllcache\wmpdxm.dll

2009-07-10 08:27 1,315,328 a------- c:\windows\system32\dllcache\msoe.dll

2009-07-05 08:09 18,353 a------- c:\windows\25472ha9kzoo5705.bin

2009-07-05 01:50 9,847 a------- c:\windows\system32\297czddware5129.exe

2009-07-04 18:59 17,697 a------- c:\windows\28555v9zus20f.dll

2009-07-03 13:55 7,542 a------- c:\windows\system32\2659trojz3.bin

2009-07-03 12:09 915,456 a------- c:\windows\system32\wininet.dll

2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll

2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll

2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll

2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll

2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll

2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll

2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll

2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll

2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll

2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe

2009-07-02 11:27 18,195 a------- c:\windows\454fazdw5re9524.dll

2009-07-02 10:48 12,085 a------- c:\windows\4553addwa9e165z.dll

2009-06-29 11:12 133,120 a------- c:\windows\system32\dllcache\extmgr.dll

2009-06-29 06:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe

2009-06-26 03:42 5,077 a------- c:\windows\52395paz9e2850.bin

2009-06-25 12:35 13,794 a------- c:\windows\15995hiefz74.dll

2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\dllcache\schannel.dll

2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\dllcache\secur32.dll

2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\lsasrv.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll

2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll

2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll

2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll

2009-06-24 18:48 10,650 a------- c:\windows\38zdsp95se2578.bin

2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys

2009-06-23 13:24 3,115 a------- c:\windows\27961wor5290z.dll

2009-06-22 01:02 13,097 a------- c:\windows\29119acktzol1e75.bin

2009-06-20 19:58 14,795 a------- c:\windows\system32\4393spazb5t106.dll

2009-06-20 17:02 11,724 a------- c:\windows\5d5f9ddwzre5555.dll

2009-06-18 13:45 3,421 a------- c:\windows\23895not-z-virus955.dll

2009-06-18 12:42 15,719 a------- c:\windows\412t5rezt22796.exe

2009-06-17 19:49 3,942 a------- c:\windows\9z98hack9ool335.bin

2009-06-17 16:43 12,242 a------- c:\windows\45e5azdware9644.dll

2009-06-16 18:44 9,711 a------- c:\windows\system32\18zethr9at30154.bin

2009-06-16 09:36 119,808 -------- c:\windows\system32\t2embed.dll

2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\fontsub.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll

2009-06-15 23:13 5,105 a------- c:\windows\system32\45fcdo5nlo9zer982.dll

2009-06-14 17:55 15,685 a------- c:\windows\system32\15529hacktool7bz.dll

2009-06-14 04:22 10,415 a------- c:\windows\8708zac5to9l343.exe

2009-06-12 07:31 76,288 -------- c:\windows\system32\telnet.exe

2009-06-12 07:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe

2009-06-10 18:02 13,338 a------- c:\windows\system32\207155iru979fz.dll

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\dllcache\mstscax.dll

2009-06-10 09:19 2,066,432 -------- c:\windows\system32\mstscax.dll

2009-06-10 09:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\wkssvc.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll

2009-06-09 20:10 13,833 a------- c:\windows\zdefbackdo9r3125.bin

2009-06-09 15:31 6,311 a------- c:\windows\94204n5t-a-virus7z.dll

2009-06-09 06:15 16,365 a------- c:\windows\system32\289179ozm545.dll

2009-06-09 05:23 18,073 a------- c:\windows\system32\29626szambot1e5.bin

2009-06-07 12:41 5,642 a------- c:\windows\system32\6275downloa9ez252.dll

2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll

2009-06-05 07:03 13,386 a------- c:\windows\7bz1add9are3425.dll

2009-06-03 14:09:37 A------- 1,291,264 c:\windows\system32\quartz.dll

2004-10-11 11:16 71 ac-sh--- c:\windows\system32\SYSDRVREB.SYS

2008-09-14 03:22 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 14:06:14.15 ===============

Also renamed the malwarebytes file and a scan is being run as we speak... Thanks lot for your help thus far. New problem with my comp as of late has been random freezes, not sure if that's due to any virus/malware or not.

Hello and welcome to the forum!

My name is Extremeboy, and I will help you with your log.

Please continue with running a scan with RootRepeal, followed by DDS, a scanner tool.

--

Regarding Malwarebyte not running, that may be due to several reasons. You may want to try renaming it.

Rename the C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe <- Rename this file. See if it works.

---

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.

  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the reportTab.png tab at the bottom.
  • Now press the btnScan.png button.
  • A box will pop up, check the boxes beside All Seven options/scan area
    RR_checkbox.jpg
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. saveReport.png
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

Download and run DDS

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Download DDS by sUBs from one of the following links. Save it to your desktop.

    [*]Double click on the DDS icon, allow it to run.

    [*]A small box will open, with an explanation about the tool. No input is needed, the scan is running.

    [*]Notepad will open with the results soon.

    [*]Follow the instructions that pop up for posting the results and then click Ok.

    [*]The black and message box window shall then disappear.

    [*]Please save both log files on your desktop and post the DDS.txt and zip up and attach Attach.txt as instructed.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Also, please provide a description of any remaining problems or symptoms you may still have please.

With Regards,

Extremeboy

Link to post
Share on other sites

Hello.

Thanks for the logs I requested.

Next time however, please do not quote everything I said. If there's something specific which you need to quote, then feel free to. Other than that, it's not necessary to do so.

Download and Run ComboFix

Note to readers of this post other than the starter of this thread:

ComboFix is a VERY POWERFUL tool which should NOT BE USED without guidance of an expert.

Download Combofix from any of the links below, and save it to your desktop.

Link 1

Link 2

Please refer to this page for full instructions on how to run ComboFix.

  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click ComboFix.exe to start the program. Agree to the prompts.
  • When ComboFix is finished, a log report (C:\ComboFix.txt) will open. Post back with it.

Leave your computer alone while ComboFix is running.

ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may call it to stall.

With Regards,

Extremeboy

Link to post
Share on other sites

Alright ran it, here is my ComboFix Log:

ComboFix 09-09-01.04 - ~suicidaL feeLing~ 09/01/2009 15:48.1.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.257 [GMT -5:00]

Running from: c:\documents and settings\~suicidaL feeLing~\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

c:\windows\1053s9yware329z.ocx

c:\windows\10865zp925.bin

c:\windows\1119zvirus7d35.bin

c:\windows\111dspazs511919.bin

c:\windows\11396notza-vir5s119.exe

c:\windows\11530troj94z5.bin

c:\windows\11855ha9kzool502.ocx

c:\windows\1188sza9s5831.exe

c:\windows\12131hzc5tool29a.cpl

c:\windows\1317h5ckto9l19cz.cpl

c:\windows\13755spz7195.bin

c:\windows\13796wzrm2fa5.cpl

c:\windows\139z0hackto9l315.ocx

c:\windows\13z72spamb9t3c55.bin

c:\windows\14z7vir93945.cpl

c:\windows\15049viruz71b9.cpl

c:\windows\15290wzr5696.exe

c:\windows\152z8t9oj4b6.ocx

c:\windows\1539v9rz852.dll

c:\windows\154779pazbot1d9.exe

c:\windows\15598not-z-virus1359.cpl

c:\windows\15726spa9bot206z.exe

c:\windows\15746vzru569a.exe

c:\windows\15995hiefz74.dll

c:\windows\15c7zt5al419.dll

c:\windows\15z83s9y2b75.exe

c:\windows\1600s9y5dz.dll

c:\windows\16805not-a-viru92d6z.dll

c:\windows\16954zpy679.bin

c:\windows\17145virz57a99.dll

c:\windows\174565acktool7z69.exe

c:\windows\17470not5a-virus9z9.bin

c:\windows\175z8no9-a-vir5s7f3.exe

c:\windows\17612wzr539f.dll

c:\windows\1779stealz57.cpl

c:\windows\177b9hzeat309435.ocx

c:\windows\179145pz12.exe

c:\windows\18115zoj6429.bin

c:\windows\181605py594z.exe

c:\windows\18588spamzot7f89.ocx

c:\windows\18601spzmb5t3a59.dll

c:\windows\18z55worm392.bin

c:\windows\19253notza-virus9c8.cpl

c:\windows\1935st9az3242.dll

c:\windows\19525not-a-viruz25f9.exe

c:\windows\19615spambo57fz.cpl

c:\windows\19705troz18a5.cpl

c:\windows\19789spy58fz.dll

c:\windows\19886szy5c5.dll

c:\windows\199295zcktool1ff.exe

c:\windows\1b75szarse9369.dll

c:\windows\1f03v5z2962.exe

c:\windows\1z51thief3196.ocx

c:\windows\1z5espyware2569.ocx

c:\windows\1z663vir9s7635.cpl

c:\windows\1z72vir595.ocx

c:\windows\1z75359y3ef.bin

c:\windows\1z7719irus25c.ocx

c:\windows\207895ot-a-vizus79c.bin

c:\windows\20915virus38z.dll

c:\windows\2097759rz7e9.dll

c:\windows\210865orm49z.ocx

c:\windows\21553wzrm139.dll

c:\windows\2185pywaze3149.ocx

c:\windows\21995tro947z.dll

c:\windows\21a9spyzare1554.bin

c:\windows\2230vzr28459.dll

c:\windows\22495spambzt39c5.exe

c:\windows\225z6hacktool9d1.dll

c:\windows\22735s5y19z.exe

c:\windows\22941t5ojz5f.bin

c:\windows\23035hac9tool567z.cpl

c:\windows\231z8hackto5l9b4.cpl

c:\windows\236965pamboz944.exe

c:\windows\236z6virus590.bin

c:\windows\23895not-z-virus955.dll

c:\windows\241z9wor5399.ocx

c:\windows\24204spamz9t7c95.ocx

c:\windows\24749hackto5l2ze.cpl

c:\windows\25034noz-9-5irus3ba.bin

c:\windows\25040virus9za.ocx

c:\windows\25099orz7c.exe

c:\windows\250z8sp9mbotd0.dll

c:\windows\2537zw9rm659.dll

c:\windows\25392hackt5zl434.cpl

c:\windows\25472ha9kzoo5705.bin

c:\windows\25535v9rzs7f4.dll

c:\windows\25565wzr9196.dll

c:\windows\256z3w9rm1d5.exe

c:\windows\257z5p9rse2876.bin

c:\windows\25857not-azvir9s5f6.cpl

c:\windows\258z5troj935.bin

c:\windows\2597zhief2512.ocx

c:\windows\25995trzj399.bin

c:\windows\259cspywa9e50z.bin

c:\windows\25z0spa9se1500.cpl

c:\windows\26780wor917z5.cpl

c:\windows\2682not-a-viruz598.exe

c:\windows\268zdow9loader2956.cpl

c:\windows\26929h9ck5ool36cz.exe

c:\windows\27291tro945ez.dll

c:\windows\27451spyz7b9.exe

c:\windows\2754spywar921z7.bin

c:\windows\2759t5rzat1779.cpl

c:\windows\27961wor5290z.dll

c:\windows\28335vizus1e9.exe

c:\windows\28555v9zus20f.dll

c:\windows\2855zteal1940.dll

c:\windows\28675vizu9748.cpl

c:\windows\28701not-a5vi9usza7.dll

c:\windows\2878znot-a-5iru95d1.ocx

c:\windows\28793spzm59t7f4.dll

c:\windows\29095w9rm59z5.cpl

c:\windows\29116sp5522z.exe

c:\windows\29119acktzol1e75.bin

c:\windows\29545viruszdb.bin

c:\windows\295fthiefz9595.cpl

c:\windows\29932notza-vir5s312.dll

c:\windows\29d9ba5kdozr3028.dll

c:\windows\29zd9hie5716.exe

c:\windows\2c51bazkd9or1026.bin

c:\windows\2c99ste9l2z53.dll

c:\windows\2cfbspy5are9z33.cpl

c:\windows\2d22doznloader15935.exe

c:\windows\2d9ddownloa9zr5229.cpl

c:\windows\2e09hreaz14562.exe

c:\windows\2ed5a9dwaze1012.ocx

c:\windows\2z125worm7d9.bin

c:\windows\2z19v5r2555.dll

c:\windows\2z477tro559e.dll

c:\windows\2z4995orm760.exe

c:\windows\2z939spy3355.exe

c:\windows\2z997worm250.exe

c:\windows\2z9esp5r9e332.dll

c:\windows\30077szy3559.bin

c:\windows\301245ac9tozl4ff.ocx

c:\windows\3018bazkdoo5936.cpl

c:\windows\302fdownloadez24159.dll

c:\windows\3049vi532z6.dll

c:\windows\30520wzr928.bin

c:\windows\30583virus22z9.ocx

c:\windows\312399otza-v5rus1b3.cpl

c:\windows\321z7v5rus39c.cpl

c:\windows\32526viruz7b9.dll

c:\windows\32594s5yz96.bin

c:\windows\32636n5t-z-9irus7c2.cpl

c:\windows\32bb5owzload9r2745.dll

c:\windows\32cd5z9al293.cpl

c:\windows\33a95ir79z.cpl

c:\windows\34e5thi9z499.exe

c:\windows\351zspy1295.bin

c:\windows\352709py2f9z.ocx

c:\windows\354cviz2945.dll

c:\windows\3572hackto9z6b5.bin

c:\windows\3599troz6b5.cpl

c:\windows\35fcspy9zre2952.exe

c:\windows\361ft9ief1z53.exe

c:\windows\36z8tr9570e.exe

c:\windows\370a95azse2262.bin

c:\windows\3755addw9re1z88.cpl

c:\windows\38zdsp95se2578.bin

c:\windows\39659n5z-a-virus46.dll

c:\windows\396czhief352.exe

c:\windows\39995orz730.ocx

c:\windows\3999s5arze351.dll

c:\windows\3a89th5ea928z66.exe

c:\windows\3c2zspywar926015.bin

c:\windows\3c51sparsez99.exe

c:\windows\3cab9hrea5240z4.ocx

c:\windows\3d2fsp5z9re2514.cpl

c:\windows\3d87backd95z565.ocx

c:\windows\3ez1back9o5r2032.ocx

c:\windows\3ezbsp5ware2996.bin

c:\windows\3z2fdown5oad9r1197.bin

c:\windows\3z45th59f3050.bin

c:\windows\400c9ackdzor859.dll

c:\windows\4055ziru96a9.ocx

c:\windows\4070dow59oaderz740.exe

c:\windows\40c7baczdoor5942.cpl

c:\windows\40f0ste5l9z34.exe

c:\windows\412t5rezt22796.exe

c:\windows\41d59r3257z.exe

c:\windows\43399ot-a-vizus495.dll

c:\windows\4355addware2976z.bin

c:\windows\439daddw9rez935.ocx

c:\windows\4523st59lz167.cpl

c:\windows\4531dow5lzader20269.dll

c:\windows\454fazdw5re9524.dll

c:\windows\4550azdw9re2122.cpl

c:\windows\4553addwa9e165z.dll

c:\windows\4565v9rz9055.cpl

c:\windows\45e15iz2927.cpl

c:\windows\45e5azdware9644.dll

c:\windows\469cthrzat15325.dll

c:\windows\476fzow9loade5473.cpl

c:\windows\4809zr9j6115.bin

c:\windows\48a4b5ckdo9r2z00.bin

c:\windows\4927zhreat25539.dll

c:\windows\495fdownzoader509.bin

c:\windows\49b95pyware32z.ocx

c:\windows\49dbvir5113z.cpl

c:\windows\49z9backdoor19295.dll

c:\windows\4af059r127z.cpl

c:\windows\4d1bd5wnloadzr1593.bin

c:\windows\4e469hief192z5.ocx

c:\windows\4fc8spa5se1190z.cpl

c:\windows\4z50addw9re5667.bin

c:\windows\4z57spyware2950.cpl

c:\windows\5000backdoo9z6.dll

c:\windows\50306zo9m7df.bin

c:\windows\5063s9arze6495.dll

c:\windows\50z97spy1609.cpl

c:\windows\51775wormc9z.ocx

c:\windows\52395paz9e2850.bin

c:\windows\52397virus910z.dll

c:\windows\53585z95a6.ocx

c:\windows\53749pyzare2522.cpl

c:\windows\5398sz9mbot21a.ocx

c:\windows\54186spz9c6.exe

c:\windows\5435spz4f59.ocx

c:\windows\545s9azbot415.dll

c:\windows\5544not-z-virus3909.cpl

c:\windows\55987hackzool351.bin

c:\windows\559c9p5ware1z19.exe

c:\windows\55d6z9ief2503.exe

c:\windows\560fzackdoor1559.bin

c:\windows\56409z9rm60f.exe

c:\windows\5666trojzc69.dll

c:\windows\5683backdooz93.exe

c:\windows\56fdsp9zare25165.exe

c:\windows\573vi9z596.bin

c:\windows\5751t9ief506z.ocx

c:\windows\5757addwaze3879.exe

c:\windows\578not-z-vi5us799.bin

c:\windows\5820hackto9l3fcz.ocx

c:\windows\585ebac9door70z.bin

c:\windows\58985pzrse3172.ocx

c:\windows\58ec9zywar52361.ocx

c:\windows\58z719irus592.cpl

c:\windows\5917tz9j34d.dll

c:\windows\59272v9ruz2a9.dll

c:\windows\5929vzr1652.ocx

c:\windows\596zspyware2472.bin

c:\windows\5992tzreat800.bin

c:\windows\5995zpyware144.exe

c:\windows\599bthiefz747.dll

c:\windows\59babackdoor37z.dll

c:\windows\5a6bviz2990.exe

c:\windows\5b19ad5ware2z65.bin

c:\windows\5b64threatz5793.dll

c:\windows\5b6dbazk9oor1409.ocx

c:\windows\5b6thr59tz319.dll

c:\windows\5b7bthre5z3409.cpl

c:\windows\5bzfspa5se9265.ocx

c:\windows\5c34bzckdo9r1375.cpl

c:\windows\5c665own9oadzr220.dll

c:\windows\5c91zparse1335.ocx

c:\windows\5cf9thief26z5.ocx

c:\windows\5d5f9ddwzre5555.dll

c:\windows\5d92vzr565.bin

c:\windows\5e33spar9e319z.exe

c:\windows\5e53bazkdo9r1563.bin

c:\windows\5ezfsteal15779.cpl

c:\windows\5f7aad5wzre8549.exe

c:\windows\5fz0sparse29955.exe

c:\windows\5fz3vir9156.dll

c:\windows\5z6bbackdo9r5117.ocx

c:\windows\5z9bbac5door3257.cpl

c:\windows\5z9c9parse3755.exe

c:\windows\5zcfsp5ware829.exe

c:\windows\6158stezl2269.dll

c:\windows\61659pyware2z25.dll

c:\windows\61fdv5r9z71.ocx

c:\windows\624659rz507.cpl

c:\windows\6346z95j3da.ocx

c:\windows\6531addw9re3z89.cpl

c:\windows\6551thr9az11705.ocx

c:\windows\65e4zack95or58.cpl

c:\windows\66z9w5rmd5.bin

c:\windows\68c5tzief2909.cpl

c:\windows\6939spars589z.cpl

c:\windows\69a3z5yware2691.dll

c:\windows\69z259rm25c.dll

c:\windows\6c2eaddw5rez927.exe

c:\windows\6d27thre5tz3950.bin

c:\windows\6d2e9i5z906.cpl

c:\windows\6e05hief29z1.cpl

c:\windows\6e13add9arz2059.cpl

c:\windows\6e535dd9are265z.exe

c:\windows\6eb6baz59oor35.ocx

c:\windows\6f92downloa5ez2765.ocx

c:\windows\6z28thie52949.ocx

c:\windows\6z7bsp5rse9808.cpl

c:\windows\6z7ddownloa9er1655.dll

c:\windows\6z9faddwa9e5729.dll

c:\windows\6zc7ste9l5707.dll

c:\windows\6ze9t5r9at15325.ocx

c:\windows\70b5spazse9705.bin

c:\windows\71bbthrezt54593.exe

c:\windows\7336downlo9de5161z.exe

c:\windows\740edo5nloz9er1371.ocx

c:\windows\7535sp9z2a5.bin

c:\windows\75559ownloader10z.cpl

c:\windows\7588vir591z1.dll

c:\windows\75ebaddwzre9112.cpl

c:\windows\767th59zt15294.bin

c:\windows\76965teal21z6.bin

c:\windows\76a8spywaz51792.ocx

c:\windows\773359r1263z.ocx

c:\windows\775f9hreat1z466.cpl

c:\windows\77a5adz59re2899.dll

c:\windows\77bbzckdoor31985.ocx

c:\windows\78ab5hze9585.cpl

c:\windows\78zsp9rse1035.dll

c:\windows\79z5downloade59839.exe

c:\windows\7a3f9ackd5oz2752.dll

c:\windows\7ad4spyw59z3218.dll

c:\windows\7b29vir501z.exe

c:\windows\7bz1add9are3425.dll

c:\windows\7cf6ste9l1665z.dll

c:\windows\7db9zow5loader2384.ocx

c:\windows\7dbza59ware3003.cpl

c:\windows\7ec65pyzare991.dll

c:\windows\7ez6thre5t91547.ocx

c:\windows\7z15spywa5e1976.ocx

c:\windows\8048troj5z9.ocx

c:\windows\8139no5za-virus711.exe

c:\windows\83fth9ea51495z.dll

c:\windows\853spywarz2925.cpl

c:\windows\8708zac5to9l343.exe

c:\windows\89dspywa5e5z.dll

c:\windows\8z67spy9275.exe

c:\windows\901z6not-a-virus154.exe

c:\windows\9065spy719z.cpl

c:\windows\9139not5a-9iruszc6.cpl

c:\windows\9154zir96.cpl

c:\windows\92z155irus51f.cpl

c:\windows\93c25ir2z5.cpl

c:\windows\94204n5t-a-virus7z.dll

c:\windows\9489s5z60.ocx

c:\windows\954sparze1709.cpl

c:\windows\9553addzare889.ocx

c:\windows\95541wzrm7f.bin

c:\windows\9558szeal1817.dll

c:\windows\95662troj7z5.dll

c:\windows\95zdthief1058.bin

c:\windows\9665thzeat18279.ocx

c:\windows\979695rusz42.exe

c:\windows\9858szambot4765.exe

c:\windows\98945zroj436.cpl

c:\windows\98zbackdoor22539.dll

c:\windows\9915vzrus593.bin

c:\windows\992cvi5241z.bin

c:\windows\997zteal572.cpl

c:\windows\9aast5al99z.exe

c:\windows\9c6cv5r56z.bin

c:\windows\9cc15ddwarez8.cpl

c:\windows\9d8ftzief17995.bin

c:\windows\9eecszarse1855.ocx

c:\windows\9z98hack9ool335.bin

c:\windows\9zf6do5nloader2944.ocx

c:\windows\b7zt9ief29605.ocx

c:\windows\compaq.reg

c:\windows\ff6downlzader30925.bin

c:\windows\inf\MSView.inf

c:\windows\Installer\156f3e74.msi

c:\windows\Installer\156f3e7a.msi

c:\windows\Installer\31baca4.msi

c:\windows\Installer\3255ea37.msi

c:\windows\Installer\596959d.msp

c:\windows\system32\10752not-a-vzru5409.cpl

c:\windows\system32\10z595pambot34f.dll

c:\windows\system32\1152thr5at24759z.dll

c:\windows\system32\11655wo59z28.bin

c:\windows\system32\11755irzse9.cpl

c:\windows\system32\11937spa5bot9a7z.bin

c:\windows\system32\11z95hief292.bin

c:\windows\system32\12255spy189z.ocx

c:\windows\system32\12494zp5689.ocx

c:\windows\system32\12652sp9zf.dll

c:\windows\system32\12796zp5mbot5a0.exe

c:\windows\system32\12aszeal2925.bin

c:\windows\system32\12cftzi9f13715.dll

c:\windows\system32\135ztroj279.ocx

c:\windows\system32\1371downloa5ez899.cpl

c:\windows\system32\13c0vir265z9.dll

c:\windows\system32\14280spzmb9t5b3.ocx

c:\windows\system32\14953worm595z.cpl

c:\windows\system32\14c9steal2z759.ocx

c:\windows\system32\1528s95alz206.ocx

c:\windows\system32\15529hacktool7bz.dll

c:\windows\system32\1565zworm6779.dll

c:\windows\system32\16457zorm3869.exe

c:\windows\system32\16z21hacktoo92d55.dll

c:\windows\system32\17799tro52caz.cpl

c:\windows\system32\179565or97zf.exe

c:\windows\system32\1816znot-a-vi9u540c.exe

c:\windows\system32\18409not-a5vzru91d0.bin

c:\windows\system32\1897thr5atz3898.cpl

c:\windows\system32\18zethr9at30154.bin

c:\windows\system32\19085not-9-zirus55c.exe

c:\windows\system32\19259zorm9f5.dll

c:\windows\system32\19358zp552c.bin

c:\windows\system32\194cbazkdoor5864.dll

c:\windows\system32\195zworm795.exe

c:\windows\system32\19701not-a-v5rus2cz.cpl

c:\windows\system32\19fed5wnloader219z.cpl

c:\windows\system32\19z00sp5mbot932.ocx

c:\windows\system32\19z4thre5t21595.bin

c:\windows\system32\19z59vi5us15a.dll

c:\windows\system32\19z59w5rm396.dll

c:\windows\system32\1a9cbackdoor5z99.dll

c:\windows\system32\1cf6zteal5009.cpl

c:\windows\system32\1dz1s9arse975.ocx

c:\windows\system32\1dz9thie59750.bin

c:\windows\system32\1e04backdoor2952z.exe

c:\windows\system32\1z209tr95228.bin

c:\windows\system32\1z703hacktool759.cpl

c:\windows\system32\20589not-a-virzs6c4.cpl

c:\windows\system32\2059zp5294.dll

c:\windows\system32\207155iru979fz.dll

c:\windows\system32\207dback9oor576z.ocx

c:\windows\system32\209zvir24415.cpl

c:\windows\system32\20z5back9oor2255.dll

c:\windows\system32\21117not-9-virus5zf.exe

c:\windows\system32\2181threa9590z7.exe

c:\windows\system32\2196spyw5re92z.dll

c:\windows\system32\21979hazktool549.exe

c:\windows\system32\2197hackt5olz94.cpl

c:\windows\system32\2206z5orm919.ocx

c:\windows\system32\2219v5r2z2.exe

c:\windows\system32\22226wzr5159.cpl

c:\windows\system32\222549pambotz26.cpl

c:\windows\system32\22359spz392.exe

c:\windows\system32\2259z5ro9cb.exe

c:\windows\system32\22796spambot654z.exe

c:\windows\system32\22966zot-a9vi5usf8.cpl

c:\windows\system32\2298tr5j1z9.dll

c:\windows\system32\229spzware2857.exe

c:\windows\system32\23081tro5z79.bin

c:\windows\system32\23117spamb5z179.cpl

c:\windows\system32\23272n9t5azvirus81.exe

c:\windows\system32\23535tr952f0z.exe

c:\windows\system32\23541h9ckto5lz0.dll

c:\windows\system32\23z39w9rm5fb.exe

c:\windows\system32\24285wor9562z.bin

c:\windows\system32\247229rzj545.exe

c:\windows\system32\24925wzrm6a0.dll

c:\windows\system32\249789ot-a-vzrus456.exe

c:\windows\system32\251685zy964.dll

c:\windows\system32\2520zackto9l139.ocx

c:\windows\system32\254459ot-a-virus6zd.dll

c:\windows\system32\2550spamb9t2c0z.dll

c:\windows\system32\25599wo5z2e09.ocx

c:\windows\system32\2586noz-a-virus529.dll

c:\windows\system32\25971viz5939f.ocx

c:\windows\system32\25997hacktzol498.bin

c:\windows\system32\259z5ir18709.ocx

c:\windows\system32\25c9spazse621.dll

c:\windows\system32\25das5arse2309z.bin

c:\windows\system32\26263spambot2z59.ocx

c:\windows\system32\2659trojz3.bin

c:\windows\system32\265zstea9573.exe

c:\windows\system32\27211spam5ot79z.dll

c:\windows\system32\27293wor91z5.dll

c:\windows\system32\276599acktool44z.dll

c:\windows\system32\27757szam9ot4ef.cpl

c:\windows\system32\2826znot-5-virus9f.ocx

c:\windows\system32\28769not-a-vzrus56e.exe

c:\windows\system32\289179ozm545.dll

c:\windows\system32\28975hzef1333.cpl

c:\windows\system32\28z23hack5ool179.ocx

c:\windows\system32\29046s5ambotz8c.exe

c:\windows\system32\29157not-a5virus2bz.ocx

c:\windows\system32\29188wozm9bc5.bin

c:\windows\system32\29253not-a-5i9us5z9.dll

c:\windows\system32\292d5ddwar92z92.ocx

c:\windows\system32\29549spazbot255.dll

c:\windows\system32\29555virus360z.ocx

c:\windows\system32\295bthie5z43.exe

c:\windows\system32\295z995yf9.exe

c:\windows\system32\29626szambot1e5.bin

c:\windows\system32\2965zwormf9.bin

c:\windows\system32\297czddware5129.exe

c:\windows\system32\2989ztroj95.dll

c:\windows\system32\29958notza-vir595f3.bin

c:\windows\system32\29z96vi5us9e.cpl

c:\windows\system32\2a52backdoo932z4.exe

c:\windows\system32\2a59s9arze305.bin

c:\windows\system32\2b55thie9529z.exe

c:\windows\system32\2b9dad5zare596.ocx

c:\windows\system32\2bc9s9arze511.dll

c:\windows\system32\2fd1s9azse5425.bin

c:\windows\system32\2fzd9ir20255.bin

c:\windows\system32\2z233w9r53d.bin

c:\windows\system32\2z9495py571.cpl

c:\windows\system32\2z95backdoor1354.bin

c:\windows\system32\30049no5za-virus618.ocx

c:\windows\system32\3075spaz9ot36b.dll

c:\windows\system32\309789iru5z7.exe

c:\windows\system32\3125z9eal652.cpl

c:\windows\system32\3189zworm659.bin

c:\windows\system32\318d9tzal1548.cpl

c:\windows\system32\31e9thie531z9.exe

c:\windows\system32\31t5zea919396.ocx

c:\windows\system32\3207spy5aze11009.cpl

c:\windows\system32\322z49orm58e.bin

c:\windows\system32\32533s9amzot196.dll

c:\windows\system32\327ft5iefz797.bin

c:\windows\system32\32b9z5door1069.cpl

c:\windows\system32\3360tzi5f97.bin

c:\windows\system32\33zed9wnload5r1722.exe

c:\windows\system32\351zspya99.exe

c:\windows\system32\352zsteal31099.dll

c:\windows\system32\3566h9ckto5l5d8z.cpl

c:\windows\system32\3597spy9aze98.cpl

c:\windows\system32\35z6spars985.cpl

c:\windows\system32\371noz-a-v9rus1145.ocx

c:\windows\system32\3811z5ywa9e505.bin

c:\windows\system32\3855addwarz1489.dll

c:\windows\system32\3895backzo9r609.bin

c:\windows\system32\39009te5l29z5.cpl

c:\windows\system32\39113hazk5oolfb.exe

c:\windows\system32\3911t9i5f1674z.exe

c:\windows\system32\3965tzief333.bin

c:\windows\system32\3998thrzat58645.exe

c:\windows\system32\3a26down9oader951z.cpl

c:\windows\system32\3b35zpywa59782.dll

c:\windows\system32\3c329d5warez294.exe

c:\windows\system32\3c61sp5rse3z359.cpl

c:\windows\system32\3ca55ze9l1914.dll

c:\windows\system32\3e5ezown59ader779.ocx

c:\windows\system32\3f28spyw9re51z8.ocx

c:\windows\system32\3f41s9zal8095.bin

c:\windows\system32\3f58st9al48z.exe

c:\windows\system32\3z01add5are995.ocx

c:\windows\system32\3z5389ro5271.exe

c:\windows\system32\3z559no9-a-virus1f.ocx

c:\windows\system32\3z79vir5550.ocx

c:\windows\system32\400e5pywarz32339.cpl

c:\windows\system32\404d9hi5f95z.bin

c:\windows\system32\4093vir5s4z0.ocx

c:\windows\system32\42z95irus594.exe

c:\windows\system32\4349hack59olza8.exe

c:\windows\system32\4393spazb5t106.dll

c:\windows\system32\456s5eaz2609.bin

c:\windows\system32\45e9tzief17.bin

c:\windows\system32\45fcdo5nlo9zer982.dll

c:\windows\system32\46fcbac5do9r2z40.ocx

c:\windows\system32\482bdow95oadez1869.exe

c:\windows\system32\4895virusdz.exe

c:\windows\system32\4935bac9zoor3000.exe

c:\windows\system32\4953threat7z92.exe

c:\windows\system32\496zth5eat19969.bin

c:\windows\system32\4a1ab9ck5oor852z.cpl

c:\windows\system32\4cf4thr9at284z65.cpl

c:\windows\system32\4dz0ste9l2506.ocx

c:\windows\system32\4e6d5hief96z8.dll

c:\windows\system32\4f76vzr29655.bin

c:\windows\system32\4fe8b95kdoorz69.exe

c:\windows\system32\4ff85parsz24689.bin

c:\windows\system32\4z5fthie95256.cpl

c:\windows\system32\4z7ethie9537.cpl

c:\windows\system32\500zworm9d5.bin

c:\windows\system32\5054virz079.dll

c:\windows\system32\5104threatz55559.dll

c:\windows\system32\527d9h5zat12383.cpl

c:\windows\system32\5287no95a-vzrus5b5.dll

c:\windows\system32\5295baczdoor2335.exe

c:\windows\system32\529zhacktool719.cpl

c:\windows\system32\52z29irus55e5.exe

c:\windows\system32\53745troj9abz.bin

c:\windows\system32\54144zot9a-virus77a.dll

c:\windows\system32\5454spambot192z.ocx

c:\windows\system32\545cspar9z1198.ocx

c:\windows\system32\5462h9cztoo53c0.cpl

c:\windows\system32\5495virus24z9.cpl

c:\windows\system32\54e2th9ef286z5.cpl

c:\windows\system32\553fspywar9783z.dll

c:\windows\system32\555a9ownlozder1506.dll

c:\windows\system32\55b7spazs91214.ocx

c:\windows\system32\55zfaddwar92801.bin

c:\windows\system32\5619thrza925469.exe

c:\windows\system32\5652sp919z5.bin

c:\windows\system32\56c0threa99046z.ocx

c:\windows\system32\56f9spaz953199.exe

c:\windows\system32\57691not-a-virus694z.bin

c:\windows\system32\58035pars92231z.cpl

c:\windows\system32\580czteal23009.dll

c:\windows\system32\58504troz951.exe

c:\windows\system32\585cthr5az591.ocx

c:\windows\system32\58fbaddwaze1960.exe

c:\windows\system32\5904threaz249595.bin

c:\windows\system32\590zaddware985.bin

c:\windows\system32\595addzare2416.bin

c:\windows\system32\595bstza93075.cpl

c:\windows\system32\5964sparze1820.bin

c:\windows\system32\59771trojz50.bin

c:\windows\system32\597thzef2159.dll

c:\windows\system32\59z4vir9939.dll

c:\windows\system32\5a9azpyware1272.dll

c:\windows\system32\5abczpar9e1199.dll

c:\windows\system32\5afdspar9e1z37.bin

c:\windows\system32\5b0zv9r32375.dll

c:\windows\system32\5b77threat59z17.exe

c:\windows\system32\5b87st9az5934.exe

c:\windows\system32\5c59viz48.dll

c:\windows\system32\5c69v9525z7.ocx

c:\windows\system32\5d2fste9l2851z.ocx

c:\windows\system32\5d59backdooz537.ocx

c:\windows\system32\5f00szywa9e2905.exe

c:\windows\system32\5f4bthre5z90269.cpl

c:\windows\system32\5f9dv9r2562z.bin

c:\windows\system32\5fz6st95l710.ocx

c:\windows\system32\5z19threat94176.dll

c:\windows\system32\5z597hacktool332.bin

c:\windows\system32\5z5worm393.ocx

c:\windows\system32\5z617hacktool99.cpl

c:\windows\system32\5z875ownloa9er280.cpl

c:\windows\system32\5zd7steal859.bin

c:\windows\system32\5zf3sp9rse1771.cpl

c:\windows\system32\62299aczdoo5428.ocx

c:\windows\system32\6275downloa9ez252.dll

c:\windows\system32\63fcdow5loadez3195.cpl

c:\windows\system32\64z9steal95.bin

c:\windows\system32\650spywa9e3012z.ocx

c:\windows\system32\65z3spa9bot1015.ocx

c:\windows\system32\65z9spy5d0.exe

c:\windows\system32\667dba9kdoo5118z.ocx

c:\windows\system32\66zaddw95e3238.ocx

c:\windows\system32\6767bzck5oor2698.cpl

c:\windows\system32\68azsparse1935.exe

c:\windows\system32\68zft95ef1218.exe

c:\windows\system32\6949ziru547a.exe

c:\windows\system32\695fthzeat9325.ocx

c:\windows\system32\695zacktool7d9.exe

c:\windows\system32\6986spywarez495.dll

c:\windows\system32\6994not-a-zirus531.bin

c:\windows\system32\699spyw5re271z.cpl

c:\windows\system32\69cbzckdo5r304.cpl

c:\windows\system32\69d1spyware3z55.cpl

c:\windows\system32\6bbzd9wnloader22975.exe

c:\windows\system32\6dccadd9zre3255.exe

c:\windows\system32\6e27szy5are2291.ocx

c:\windows\system32\6e5a5py9are189z.exe

c:\windows\system32\6e5stezl29049.cpl

c:\windows\system32\6fc95ownlozder493.cpl

c:\windows\system32\6zc5steal11799.dll

c:\windows\system32\70579hiez11645.bin

c:\windows\system32\7095tzreat25951.cpl

c:\windows\system32\710z9ac5door1511.dll

c:\windows\system32\71b35hief239z.bin

c:\windows\system32\7283trz51969.exe

c:\windows\system32\736fsteal55z9.exe

c:\windows\system32\74c7bz5kdo9r1069.cpl

c:\windows\system32\74d5zparse579.bin

c:\windows\system32\7531baz9door3135.bin

c:\windows\system32\76d9oznload5r824.ocx

c:\windows\system32\7757spywarz9620.exe

c:\windows\system32\7759ba9kzoor255.dll

c:\windows\system32\77z9th5ef1854.ocx

c:\windows\system32\7879vzrus5b9.exe

c:\windows\system32\79039oz-a-virus7d25.ocx

c:\windows\system32\7a5spy9arz5185.dll

c:\windows\system32\7bzd59r1441.dll

c:\windows\system32\7d24bzckd5or25619.cpl

c:\windows\system32\7dcbth9zat51149.cpl

c:\windows\system32\7f9aa5dwarz294.dll

c:\windows\system32\7z9dvir2758.bin

c:\windows\system32\8065zirus45e9.dll

c:\windows\system32\8255wo9m4fz.bin

c:\windows\system32\8695not-a-v9rusz55.exe

c:\windows\system32\8819t59z654.bin

c:\windows\system32\89ebackdo9rz5945.cpl

c:\windows\system32\9008zspambot598.ocx

c:\windows\system32\905z9worm4eb.bin

c:\windows\system32\905zvir352.cpl

c:\windows\system32\91454not5a-virusz0e.dll

c:\windows\system32\917stz5l637.ocx

c:\windows\system32\9296spywzre1415.cpl

c:\windows\system32\92z10w5rm81.exe

c:\windows\system32\949545acktoolz85.exe

c:\windows\system32\95850troj4f5z.exe

c:\windows\system32\960bdown5ozder1581.cpl

c:\windows\system32\977425orz3a3.bin

c:\windows\system32\98350n5t-a-zirus57c.dll

c:\windows\system32\9a7ctzie51968.ocx

c:\windows\system32\9adbth5eat35z9.exe

c:\windows\system32\9c75virz210.ocx

c:\windows\system32\9d5vir933z.ocx

c:\windows\system32\9f13s5ywarez098.cpl

c:\windows\system32\9f99spywaze545.cpl

c:\windows\system32\9fbspywaze2235.cpl

c:\windows\system32\9z035spambot675.dll

c:\windows\system32\a39s5arze839.exe

c:\windows\system32\ac5backdozr2393.dll

c:\windows\system32\ba9down5ozde9223.ocx

c:\windows\system32\bcbzc9do5r1117.dll

c:\windows\system32\Cache

c:\windows\system32\Cache\buts.bin

c:\windows\system32\Cache\chart 1.bmp

c:\windows\system32\Cache\ding.bmp

c:\windows\system32\Cache\disk 1.bmp

c:\windows\system32\Cache\document.bmp

c:\windows\system32\Cache\mail unreaded.bmp

c:\windows\system32\Cache\msg.bin

c:\windows\system32\Cache\peoples 1.bmp

c:\windows\system32\Cache\search find 2.bmp

c:\windows\system32\Cache\web app.bmp

c:\windows\system32\dc3do9n5oazer289.dll

c:\windows\system32\drivers\gxvxcvwcvmdnchkgssphtodhwlrykubnaiula.sys

c:\windows\system32\e52b9ckdoor541z.exe

c:\windows\system32\f36zpyw9re875.dll

c:\windows\system32\f40s9ywz5e2209.dll

c:\windows\system32\gxvxcejaagkwunqytsyjseluawiwqkhkiccde.dll

c:\windows\system32\uninstall.exe

c:\windows\system32\z016vi93558.exe

c:\windows\system32\z039v5r707.exe

c:\windows\system32\z065backdo9r1044.exe

c:\windows\system32\z1295troj7a89.dll

c:\windows\system32\z1655not-a-vi5us9d.ocx

c:\windows\system32\z254s9ea597.cpl

c:\windows\system32\z46cba9k5oor970.ocx

c:\windows\system32\z552thief8509.dll

c:\windows\system32\z569steal554.dll

c:\windows\system32\z5b59ir5555.bin

c:\windows\system32\z6293h9ck5ool65e.ocx

c:\windows\system32\z659not-a-virus75c.exe

c:\windows\system32\z6744t5oj5729.ocx

c:\windows\system32\z8d0s5ea92912.dll

c:\windows\system32\z946hack9oo53ba.ocx

c:\windows\system32\z9519tro5c69.dll

c:\windows\system32\z97c5ir1958.cpl

c:\windows\system32\z99eadd5are1285.exe

c:\windows\system32\z9e6a5dware1729.exe

c:\windows\system32\zae09t5al352.exe

c:\windows\system32\zd9b5ir507.ocx

c:\windows\system32\zdadste5l2997.exe

c:\windows\z049v9ru55bf.ocx

c:\windows\z0695irusfe9.bin

c:\windows\z1935parse302.cpl

c:\windows\z2255ro953f.exe

c:\windows\z2445t9oj73a5.exe

c:\windows\z2765irus95.exe

c:\windows\z29as59rse1519.bin

c:\windows\z2f9thief19995.dll

c:\windows\z488v5r9s785.dll

c:\windows\z4995ckdoor2402.dll

c:\windows\z549spy908.ocx

c:\windows\z5515wo9m565.dll

c:\windows\z5955worm84.dll

c:\windows\z5cf9ir3245.bin

c:\windows\z5d6thief1290.exe

c:\windows\z6303hacktool598.exe

c:\windows\z6985ddware1599.ocx

c:\windows\z73535roj90.dll

c:\windows\z753s9arse825.bin

c:\windows\z75bsteal15919.exe

c:\windows\z904t9re5t633.exe

c:\windows\z945st9al21505.dll

c:\windows\z949s5yware2826.bin

c:\windows\z983d5wnloader2269.ocx

c:\windows\z9d9sparse351.bin

c:\windows\zb05thief24129.dll

c:\windows\zdefbackdo9r3125.bin

c:\windows\zefe95r782.bin

c:\windows\zf6aspyw9re27065.ocx

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_gxvxcserv.sys

-------\Legacy_gxvxcserv.sys

((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))

.

2009-09-01 19:12 . 2009-09-01 19:12 -------- d-----w- c:\documents and settings\~suicidaL feeLing~\Application Data\Malwarebytes

2009-08-31 04:19 . 2009-08-31 04:19 -------- d-----w- c:\program files\Trend Micro

2009-08-30 17:50 . 2009-07-28 21:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-08-30 17:50 . 2009-03-30 15:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-08-30 17:50 . 2009-02-13 17:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-08-30 17:50 . 2009-02-13 17:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-08-30 17:50 . 2009-08-30 17:50 -------- d-----w- c:\program files\Avira

2009-08-30 17:50 . 2009-08-30 17:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-08-24 02:12 . 2009-08-24 02:12 -------- d-sh--w- c:\documents and settings\~suicidaL feeLing~\IECompatCache

2009-08-24 01:35 . 2009-08-24 01:35 629072 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe

2009-08-24 01:35 . 2009-08-24 01:35 520024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe

2009-08-24 01:35 . 2009-08-24 01:35 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe

2009-08-19 08:02 . 2009-08-19 08:02 -------- d-----w- c:\windows\ie8updates

2009-08-18 16:18 . 2009-08-18 16:18 -------- d-----w- c:\windows\system32\Adobe

2009-08-18 15:55 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll

2009-08-18 15:55 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll

2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-01 21:03 . 2002-10-21 06:04 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000005-00000000-00000006-00001102-00000002-806B1102}.dat

2009-09-01 21:03 . 2002-10-21 06:04 24 ----a-w- c:\windows\system32\DVCState-{00000005-00000000-00000006-00001102-00000002-806B1102}.dat

2009-09-01 19:12 . 2009-07-19 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-31 19:23 . 2003-09-12 17:40 -------- d-----w- c:\program files\Steam

2009-08-31 04:45 . 2003-09-09 23:07 -------- d-----w- c:\program files\Kazaa Lite K++

2009-08-30 20:01 . 2004-01-04 06:08 -------- d-----w- c:\program files\Trillian

2009-08-25 19:00 . 2008-12-05 19:55 -------- d-----w- c:\documents and settings\~suicidaL feeLing~\Application Data\FrostWire

2009-08-25 18:27 . 2008-12-05 19:42 -------- d-----w- c:\program files\FrostWire

2009-08-20 20:48 . 2006-01-15 05:45 -------- d-----w- c:\documents and settings\~suicidaL feeLing~\Application Data\uTorrent

2009-08-18 16:17 . 2002-10-21 06:19 -------- d-----w- c:\program files\Common Files\Adobe

2009-08-05 09:01 . 2004-08-11 06:14 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-30 05:37 . 2009-07-23 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2009-07-30 05:37 . 2009-07-23 18:08 -------- d-----w- c:\program files\NOS

2009-07-23 18:16 . 2009-07-23 18:16 -------- d-----w- c:\program files\Common Files\Adobe AIR

2009-07-23 18:09 . 2009-07-23 18:09 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

2009-07-19 21:06 . 2009-07-19 21:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-19 19:28 . 2009-07-16 18:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-17 19:01 . 2004-08-11 06:15 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-17 13:25 . 2009-07-17 13:24 -------- d-----w- c:\program files\iTunes

2009-07-17 13:25 . 2009-07-17 13:25 -------- d-----w- c:\program files\iPod

2009-07-17 13:25 . 2008-08-17 21:31 -------- d-----w- c:\program files\Common Files\Apple

2009-07-17 13:03 . 2009-07-17 13:03 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe

2009-07-16 19:59 . 2009-07-16 19:59 360960 ----a-w- c:\windows\system32\0urdomzp.exe

2009-07-14 06:38 . 2002-10-23 20:34 110224 -c--a-w- c:\documents and settings\~suicidaL feeLing~\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-13 18:36 . 2009-07-19 21:06 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-13 18:36 . 2009-07-19 21:06 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-12 17:21 . 2004-08-11 06:17 233472 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-10 18:11 . 2009-07-10 18:10 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-07-10 18:01 . 2009-04-04 04:44 -------- d-----w- c:\program files\QuickTime

2009-07-03 17:09 . 2004-08-11 06:14 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-25 08:25 . 2004-08-11 06:15 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-06-25 08:25 . 2004-08-11 06:14 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2004-08-11 06:14 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2004-08-11 06:13 730112 ------w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2004-08-11 06:13 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-25 08:25 . 2004-08-11 06:13 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-24 11:18 . 2004-08-11 06:13 92928 ------w- c:\windows\system32\drivers\ksecdd.sys

2009-06-20 05:52 . 2009-06-20 05:52 1878984 ----a-w- c:\documents and settings\~suicidaL feeLing~\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2009-06-16 14:36 . 2004-08-11 06:14 119808 ------w- c:\windows\system32\t2embed.dll

2009-06-16 14:36 . 2001-08-18 03:36 81920 ------w- c:\windows\system32\fontsub.dll

2009-06-12 12:31 . 2004-08-11 06:14 76288 ------w- c:\windows\system32\telnet.exe

2009-06-10 14:19 . 2004-08-11 06:14 2066432 ------w- c:\windows\system32\mstscax.dll

2009-06-10 14:13 . 2004-08-11 06:15 84992 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 06:14 . 2004-08-11 06:13 132096 ------w- c:\windows\system32\wkssvc.dll

2009-06-05 16:42 . 2008-09-11 20:09 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll

2009-06-05 16:42 . 2008-08-17 21:31 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2004-10-11 16:16 . 2004-10-11 16:16 71 -csha-w- c:\windows\system32\SYSDRVREB.SYS

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

"srmclean"="c:\cpqs\Scom\srmclean.exe" [2001-07-24 36864]

"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2000-07-13 311350]

"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-07-13 28739]

"vptray"="c:\program files\NavNT\vptray.exe" [2002-06-03 73728]

"FineReader7NewsReaderPro"="c:\program files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-12-10 278528]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-08-24 520024]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2002-01-03 4608]

"WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576]

c:\documents and settings\~suicidaL feeLing~\Start Menu\Programs\Startup\

Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2003-12-26 1826885]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-1-27 113664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]

2003-08-25 17:25 139264 ----a-w- c:\program files\Common Files\Stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"NVSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Trillian\\trillian.exe"=

"c:\\Program Files\\Steam\\SteamApps\\theshiznit_15@hotmail.com\\counter-strike\\hl.exe"=

"c:\\Program Files\\Steam\\Steam.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Steam\\SteamApps\\mateo00\\counter-strike\\hl.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\utorrent\\utorrent.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\FrostWire\\FrostWire.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/26/2009 8:29 PM 64160]

R0 SSI;SSI;c:\windows\system32\drivers\ssi.sys [3/7/2006 6:02 AM 78336]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/30/2009 12:50 PM 108289]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/22/2007 3:56 PM 24652]

R2 WUSB54Gv42SVC;WUSB54Gv42SVC;c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe [8/25/2007 1:50 AM 53307]

S3 FBIKB_NT;FBIKB_NT;\??\c:\windows\System32\Drivers\FBIKB_NT.Sys --> c:\windows\System32\Drivers\FBIKB_NT.Sys [?]

S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1029456]

S3 msCMTSrvc;Content Monitoring Tool;c:\windows\system32\msCMTSrvc.exe --> c:\windows\system32\msCMTSrvc.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-09-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 01:36]

2009-08-28 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2002-10-26 c:\windows\Tasks\Registration reminder 1.job

- c:\windows\System32\OOBE\oobebaln.exe [2004-08-11 00:12]

2002-10-31 c:\windows\Tasks\Registration reminder 2.job

- c:\windows\System32\OOBE\oobebaln.exe [2004-08-11 00:12]

2002-11-05 c:\windows\Tasks\Registration reminder 3.job

- c:\windows\System32\OOBE\oobebaln.exe [2004-08-11 00:12]

2002-10-26 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-10-20 14:04]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

HKLM-Run-sysurl - c:\windows\inf\sysurl.exe

HKLM-Run-AutoLogon - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.uiowa.edu/

mSearch Bar = hxxp://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html

uInternet Connection Wizard,ShellNext = hxxp://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&c=2c02&lc=0409

uInternet Settings,ProxyOverride = *.r21.mchsi.com;*.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - hxxp://download.divx.com/player/DivXPlayerInstaller.exe

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FF - ProfilePath - c:\documents and settings\~suicidaL feeLing~\Application Data\Mozilla\Firefox\Profiles\520wdkqh.Default User\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.facebook.com

FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-02 01:33

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3153008980-2486091421-4283021946-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(476)

c:\program files\Common Files\Stardock\mcpstub.dll

c:\windows\system32\WRLogonNTF.dll

c:\windows\System32\NavLogon.dll

- - - - - - - > 'explorer.exe'(3400)

c:\windows\system32\WININET.dll

c:\program files\Stardock\ObjectDock\DockShellHook.dll

c:\windows\system32\ctagent.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\iprepair.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\CTsvcCDA.EXE

c:\program files\NavNT\defwatch.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\NavNT\rtvscan.exe

c:\program files\Webroot\Spy Sweeper\WRSSSDK.exe

c:\windows\system32\wdfmgr.exe

c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe

c:\program files\Common Files\Stardock\sdmcp.exe

c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-09-02 1:44 - machine was rebooted

ComboFix-quarantined-files.txt 2009-09-02 06:44

Pre-Run: 6,566,952,960 bytes free

Post-Run: 6,526,803,968 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

1029 --- E O F --- 2009-08-26 08:01

Link to post
Share on other sites

Hello.

Try running a scan with Malwarebytes now. It should work now.

Download and run MalwareBytes Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link 1

  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware

    [*]Then click Finish.

    [*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

    [*]On the Scanner tab:

    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.

    [*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

    [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

    [*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

    [*]Click OK to close the message box and continue with the removal process.

    [*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

    [*]Make sure that everything is checked, and click Remove Selected.

    [*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

    [*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

    [*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this link

Re-run DDS as well and post back with the logs.

We will remove the rest next post.

With Regards,

Extremeboy

Link to post
Share on other sites

Alright, MBAM log:

Malwarebytes' Anti-Malware 1.40

Database version: 2730

Windows 5.1.2600 Service Pack 3

9/2/2009 1:45:55 PM

mbam-log-2009-09-02 (13-45-55).txt

Scan type: Full Scan (C:\|)

Objects scanned: 220170

Time elapsed: 2 hour(s), 10 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\msagent\chars\Reaper.acs (Backdoor.PcClient) -> Quarantined and deleted successfully.

and DDS:

DDS (Ver_09-07-30.01) - NTFSx86

Run by ~suicidaL feeLing~ at 13:49:33.15 on Wed 09/02/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_12

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.158 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\NavNT\defwatch.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NavNT\rtvscan.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

C:\WINDOWS\system32\carpserv.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\NavNT\vptray.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Winamp\winamp.exe

C:\Documents and Settings\~suicidaL feeLing~\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.uiowa.edu/

mSearch Bar = hxxp://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html

uInternet Connection Wizard,ShellNext = hxxp://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&c=2c02&lc=0409

uInternet Settings,ProxyOverride = *.r21.mchsi.com;*.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: MoneySide: {9404901d-06da-4b23-a0ee-3ea4f64ec9b3} - c:\program files\microsoft money\system\mnyviewer.dll

uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [CARPService] carpserv.exe

mRun: [WINDVDPatch] CTHELPER.EXE

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe"

mRun: [srmclean] c:\cpqs\scom\srmclean.exe

mRun: [Microsoft Works Portfolio] c:\program files\microsoft works\WksSb.exe /AllUsers

mRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

mRun: [vptray] c:\program files\navnt\vptray.exe

mRun: [FineReader7NewsReaderPro] "c:\program files\abbyy finereader 7.0 professional edition\AbbyyNewsReader.exe"

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mRunOnce: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

StartupFolder: c:\docume~1\~suici~1\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)

mPolicies-explorer: <NO NAME> =

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper200711281.dll

DPF: {33363249-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/i263_32.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://targetphoto.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - hxxp://download.divx.com/player/DivXPlayerInstaller.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - hxxp://playroom.icq.com/odyssey_web8.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37577.4731597222

DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab

DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - hxxp://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx

Notify: MCPClient - c:\program files\common files\stardock\mcpstub.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

Notify: WRNotifier - WRLogonNTF.dll

SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\program files\common files\stardock\MCPCore.dll

SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - c:\windows\system32\iprepair.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\~suici~1\applic~1\mozilla\firefox\profiles\520wdkqh.default user\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.facebook.com

FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-26 64160]

R0 SSI;SSI;c:\windows\system32\drivers\ssi.sys [2006-3-7 78336]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-30 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-30 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-30 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-30 55656]

R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2002-6-7 17968]

R2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2002-6-3 471040]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-22 24652]

R2 WUSB54Gv42SVC;WUSB54Gv42SVC;c:\program files\linksys wireless-g usb wireless network monitor\WLService.exe [2007-8-25 53307]

S3 FBIKB_NT;FBIKB_NT;\??\c:\windows\system32\drivers\fbikb_nt.sys --> c:\windows\system32\drivers\FBIKB_NT.Sys [?]

S3 iscFlash;iscFlash;\??\c:\windows\system32\drivers\iscflash.sys --> c:\windows\system32\drivers\iscflash.sys [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]

S3 msCMTSrvc;Content Monitoring Tool;c:\windows\system32\mscmtsrvc.exe --> c:\windows\system32\msCMTSrvc.exe [?]

=============== Created Last 30 ================

2009-09-02 13:46 61,440 a------- c:\windows\system32\drivers\eqis.sys

2009-09-02 01:42 <DIR> --d----- c:\windows\system32\dllcache\cache

2009-09-01 15:38 <DIR> a-dshr-- C:\cmdcons

2009-09-01 15:35 229,376 a------- c:\windows\PEV.exe

2009-09-01 15:35 161,792 a------- c:\windows\SWREG.exe

2009-09-01 15:35 98,816 a------- c:\windows\sed.exe

2009-09-01 14:12 <DIR> --d----- c:\docume~1\~suici~1\applic~1\Malwarebytes

2009-08-30 23:19 <DIR> --d----- c:\program files\Trend Micro

2009-08-30 12:50 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-30 12:50 <DIR> --d----- c:\program files\Avira

2009-08-30 12:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira

2009-08-23 21:12 <DIR> --dsh--- c:\documents and settings\~suicidal feeling~\IECompatCache

2009-08-19 03:02 <DIR> --d----- c:\windows\ie8updates

2009-08-18 11:18 <DIR> --d----- c:\windows\system32\Adobe

2009-08-18 10:56 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx

2009-08-18 10:55 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll

2009-08-18 10:55 12,800 -------- c:\windows\system32\dllcache\xpshims.dll

2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

==================== Find3M ====================

2009-09-02 13:46 184 a------- c:\program files\ybwcn.txt

2009-08-23 20:36 15,688 a------- c:\windows\system32\lsdelete.exe

2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll

2009-07-19 08:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll

2009-07-19 08:18 5,937,152 a------- c:\windows\system32\dllcache\cache\mshtml.dll

2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll

2009-07-16 14:59 360,960 a------- c:\windows\system32\0urdomzp.exe

2009-07-12 12:21 4,874,240 a------- c:\windows\system32\dllcache\wmp.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\wmpdxm.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\dllcache\wmpdxm.dll

2009-07-10 08:27 1,315,328 a------- c:\windows\system32\dllcache\msoe.dll

2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll

2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\cache\wininet.dll

2009-07-03 12:09 915,456 -------- c:\windows\system32\wininet.dll

2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll

2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll

2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll

2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll

2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll

2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll

2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll

2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll

2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe

2009-06-29 11:12 133,120 a------- c:\windows\system32\dllcache\extmgr.dll

2009-06-29 06:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe

2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\dllcache\schannel.dll

2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\dllcache\secur32.dll

2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\lsasrv.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll

2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll

2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll

2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll

2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys

2009-06-16 09:36 119,808 -------- c:\windows\system32\t2embed.dll

2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\fontsub.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll

2009-06-12 07:31 76,288 -------- c:\windows\system32\telnet.exe

2009-06-12 07:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\dllcache\mstscax.dll

2009-06-10 09:19 2,066,432 -------- c:\windows\system32\mstscax.dll

2009-06-10 09:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\wkssvc.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll

2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll

2004-06-13 19:27 449 ac------ c:\documents and settings\~suicidal feeling~\UpdateReg.reg

2002-11-12 14:58 3,932 ac------ c:\docume~1\~suici~1\applic~1\LMLayout.dat

2002-11-12 14:58 268 ac------ c:\docume~1\~suici~1\applic~1\LMCPaper.dat

2004-10-11 11:16 71 ac-sh--- c:\windows\system32\SYSDRVREB.SYS

2008-09-14 03:22 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 13:50:49.51 ===============

Link to post
Share on other sites

Hello.

Please provide the Attach.txt log as well.

Run another rootkit scan to make sure all is okay.

Download and Run Scan with GMER

We will use GMER to scan for rootkits.

  • Please download GMER from one of the following locations, and save it to your desktop:

    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop. Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.

  • Close any and all open programs, as this process may crash your computer.
  • Double click gmerRandomIcon.png or gmerDesktopIcon.png on your desktop.
  • When you have done this, close all running programs.
    There is a small chance this application may crash your computer so save any work you have open.

  • Double-click on Gmer.exe to start the program. Right-click and select Run As Administrator... if you are using Vista
  • Allow the gmer.sys driver to load if asked.
    If it detects rootkit activity, you will receive a prompt (refer below) to run a full scan. Click NO..
    gmerNoDialog.png

  • In the right panel, you will see several boxes that have been checked. Please UNCHECK the following:
    • Sections
    • IAT/EAT
    • Registry
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show all (Don't miss this one!)

    [*]Click on btnScan.png and wait for the scan to finish.

    [*]If you see a rootkit warning window, click OK.

    [*]Push btnSave.png and save the logfile to your desktop.

    [*]Copy and Paste the contents of that file in your next post.

If GMER doesn't work in Normal Mode try running it in Safe Mode

Note: Do Not run any program while GMER is running

*Note*: Rootkit scans often produce false positives. Do NOT take any actions on "<--- ROOKIT" entries

With Regards,

Extremeboy

Link to post
Share on other sites

K, here is the GMER log

GMER 1.0.15.15077 [c22mcozk.exe] - http://www.gmer.net

Rootkit scan 2009-09-03 10:32:22

Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT F8D6543E ZwCreateKey

SSDT SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com)) ZwCreateProcess [0xF85DA3CE]

SSDT SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com)) ZwCreateProcessEx [0xF85DA56E]

SSDT F8D65434 ZwCreateThread

SSDT F8D65443 ZwDeleteKey

SSDT F8D6544D ZwDeleteValueKey

SSDT F8D65452 ZwLoadKey

SSDT F8D65420 ZwOpenProcess

SSDT F8D65425 ZwOpenThread

SSDT SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com)) ZwRenameKey [0xF85D900A]

SSDT F8D6545C ZwReplaceKey

SSDT F8D65457 ZwRestoreKey

SSDT SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com)) ZwSetInformationKey [0xF85D91DA]

SSDT F8D65448 ZwSetValueKey

SSDT F8D6542F ZwTerminateProcess

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com))

Device \Driver\Tcpip \Device\Tcp SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com))

Device \Driver\Tcpip \Device\Udp SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com))

Device \Driver\Tcpip \Device\RawIp SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com))

Device \Driver\Tcpip \Device\IPMULTICAST SSI.SYS (SpySweeper SSI Driver/Webroot Software (www.webroot.com))

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

Hello.

Please provide the Attach.txt log as well.

Also, please run another scan with RootRepeal.

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.

  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the reportTab.png tab at the bottom.
  • Now press the btnScan.png button.
  • A box will pop up, check the boxes beside All Seven options/scan area
    RR_checkbox.jpg
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. saveReport.png
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

~Extremeboy

Link to post
Share on other sites

K, here is th elog and the attach.rar

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/09/03 13:47

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: ACPI.sys

Image Path: ACPI.sys

Address: 0xF861A000 Size: 187776 File Visible: - Signed: -

Status: -

Name: ACPI_HAL

Image Path: \Driver\ACPI_HAL

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: AegisP.sys

Image Path: C:\WINDOWS\system32\DRIVERS\AegisP.sys

Address: 0xF8911000 Size: 18720 File Visible: - Signed: -

Status: -

Name: afd.sys

Image Path: C:\WINDOWS\System32\drivers\afd.sys

Address: 0xF4CFD000 Size: 138496 File Visible: - Signed: -

Status: -

Name: AmosNt.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\AmosNt.SYS

Address: 0xF78AB000 Size: 159744 File Visible: - Signed: -

Status: -

Name: atapi.sys

Image Path: atapi.sys

Address: 0xF858D000 Size: 96512 File Visible: - Signed: -

Status: -

Name: audstub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys

Address: 0xF8C39000 Size: 3072 File Visible: - Signed: -

Status: -

Name: aujasnkj.sys

Image Path: C:\DOCUME~1\~SUICI~1\LOCALS~1\Temp\aujasnkj.sys

Address: 0xEEB3A000 Size: 84352 File Visible: No Signed: -

Status: -

Name: avgio.sys

Image Path: C:\Program Files\Avira\AntiVir Desktop\avgio.sys

Address: 0xF8BDB000 Size: 6144 File Visible: - Signed: -

Status: -

Name: avgntflt.sys

Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys

Address: 0xF3772000 Size: 81920 File Visible: - Signed: -

Status: -

Name: avipbb.sys

Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys

Address: 0xF4BF8000 Size: 114688 File Visible: - Signed: -

Status: -

Name: basic2.sys

Image Path: C:\WINDOWS\System32\DRIVERS\basic2.sys

Address: 0xF795B000 Size: 76096 File Visible: - Signed: -

Status: -

Name: Beep.SYS

Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS

Address: 0xF8BD1000 Size: 4224 File Visible: - Signed: -

Status: -

Name: BOOTVID.dll

Image Path: C:\WINDOWS\system32\BOOTVID.dll

Address: 0xF8A79000 Size: 12288 File Visible: - Signed: -

Status: -

Name: catchme.sys

Image Path: C:\ComboFix\catchme.sys

Address: 0xF89F1000 Size: 31744 File Visible: No Signed: -

Status: -

Name: Cdfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS

Address: 0xF4EBD000 Size: 63744 File Visible: - Signed: -

Status: -

Name: Cdr4_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS

Address: 0xF8D2E000 Size: 2432 File Visible: - Signed: -

Status: -

Name: Cdralw2k.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS

Address: 0xF8D38000 Size: 2560 File Visible: - Signed: -

Status: -

Name: cdrom.sys

Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys

Address: 0xF8889000 Size: 62976 File Visible: - Signed: -

Status: -

Name: cdudf_XP.SYS

Image Path: C:\WINDOWS\System32\Drivers\cdudf_XP.SYS

Address: 0xF4E32000 Size: 240640 File Visible: - Signed: -

Status: -

Name: CLASSPNP.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS

Address: 0xF86A9000 Size: 53248 File Visible: - Signed: -

Status: -

Name: Combo-Fix.sys

Image Path: Combo-Fix.sys

Address: 0xF86D9000 Size: 60416 File Visible: No Signed: -

Status: -

Name: ctac32k.sys

Image Path: C:\WINDOWS\System32\drivers\ctac32k.sys

Address: 0xF5C70000 Size: 85728 File Visible: - Signed: -

Status: -

Name: ctaud2k.sys

Image Path: C:\WINDOWS\system32\drivers\ctaud2k.sys

Address: 0xF79CE000 Size: 488544 File Visible: - Signed: -

Status: -

Name: ctoss2k.sys

Image Path: C:\WINDOWS\system32\drivers\ctoss2k.sys

Address: 0xF796E000 Size: 101792 File Visible: - Signed: -

Status: -

Name: ctprxy2k.sys

Image Path: C:\WINDOWS\System32\drivers\ctprxy2k.sys

Address: 0xF8BA5000 Size: 5632 File Visible: - Signed: -

Status: -

Name: ctsfm2k.sys

Image Path: C:\WINDOWS\System32\drivers\ctsfm2k.sys

Address: 0xF5C38000 Size: 125280 File Visible: - Signed: -

Status: -

Name: disk.sys

Image Path: disk.sys

Address: 0xF8699000 Size: 36352 File Visible: - Signed: -

Status: -

Name: drmk.sys

Image Path: C:\WINDOWS\system32\drivers\drmk.sys

Address: 0xF8849000 Size: 61440 File Visible: - Signed: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xF487F000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8C03000 Size: 8192 File Visible: No Signed: -

Status: -

Name: Dxapi.sys

Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys

Address: 0xF4CCA000 Size: 12288 File Visible: - Signed: -

Status: -

Name: dxg.sys

Image Path: C:\WINDOWS\System32\drivers\dxg.sys

Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: -

Status: -

Name: dxgthk.sys

Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys

Address: 0xF8C4B000 Size: 4096 File Visible: - Signed: -

Status: -

Name: eaps2kbd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\eaps2kbd.sys

Address: 0xF8A11000 Size: 23232 File Visible: - Signed: -

Status: -

Name: EAWDMFD.sys

Image Path: C:\WINDOWS\system32\drivers\EAWDMFD.sys

Address: 0xF8AFD000 Size: 14048 File Visible: - Signed: -

Status: -

Name: emupia2k.sys

Image Path: C:\WINDOWS\System32\drivers\emupia2k.sys

Address: 0xF5C57000 Size: 98720 File Visible: - Signed: -

Status: -

Name: fallback.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fallback.sys

Address: 0xF2C58000 Size: 281920 File Visible: - Signed: -

Status: -

Name: Fastfat.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS

Address: 0xF037A000 Size: 143744 File Visible: - Signed: -

Status: -

Name: faxnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\faxnt.sys

Address: 0xF2A6A000 Size: 195360 File Visible: - Signed: -

Status: -

Name: fdc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys

Address: 0xF8A21000 Size: 27392 File Visible: - Signed: -

Status: -

Name: Fips.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS

Address: 0xF8779000 Size: 44544 File Visible: - Signed: -

Status: -

Name: flpydisk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys

Address: 0xF8A61000 Size: 20480 File Visible: - Signed: -

Status: -

Name: fltmgr.sys

Image Path: fltmgr.sys

Address: 0xF856D000 Size: 129792 File Visible: - Signed: -

Status: -

Name: Fs_Rec.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

Address: 0xF8BCF000 Size: 7936 File Visible: - Signed: -

Status: -

Name: fsksnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\fsksnt.sys

Address: 0xF2C3C000 Size: 113024 File Visible: - Signed: -

Status: -

Name: ftdisk.sys

Image Path: ftdisk.sys

Address: 0xF85EA000 Size: 125056 File Visible: - Signed: -

Status: -

Name: gameenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys

Address: 0xF8469000 Size: 10624 File Visible: - Signed: -

Status: -

Name: GEARAspiWDM.sys

Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys

Address: 0xF88A9000 Size: 40960 File Visible: - Signed: -

Status: -

Name: GTNDIS5.SYS

Image Path: C:\WINDOWS\system32\GTNDIS5.SYS

Address: 0xF3722000 Size: 15872 File Visible: - Signed: -

Status: -

Name: ha10kx2k.sys

Image Path: C:\WINDOWS\system32\drivers\ha10kx2k.sys

Address: 0xF5C85000 Size: 675872 File Visible: - Signed: -

Status: -

Name: hal.dll

Image Path: C:\WINDOWS\system32\hal.dll

Address: 0x806EE000 Size: 131840 File Visible: - Signed: -

Status: -

Name: HIDCLASS.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS

Address: 0xF8749000 Size: 36864 File Visible: - Signed: -

Status: -

Name: HIDPARSE.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS

Address: 0xF8929000 Size: 28672 File Visible: - Signed: -

Status: -

Name: hidusb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\hidusb.sys

Address: 0xF7A7E000 Size: 10368 File Visible: - Signed: -

Status: -

Name: HSF_CNXT.sys

Image Path: C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys

Address: 0xF78D2000 Size: 558304 File Visible: - Signed: -

Status: -

Name: HTTP.sys

Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys

Address: 0xF1B0C000 Size: 264832 File Visible: - Signed: -

Status: -

Name: i8042prt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys

Address: 0xF8819000 Size: 52480 File Visible: - Signed: -

Status: -

Name: Imapi.sys

Image Path: C:\WINDOWS\system32\drivers\Imapi.sys

Address: 0xF88B9000 Size: 42112 File Visible: - Signed: -

Status: -

Name: ipnat.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys

Address: 0xF4C14000 Size: 152832 File Visible: - Signed: -

Status: -

Name: ipsec.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys

Address: 0xF4DA0000 Size: 75264 File Visible: - Signed: -

Status: -

Name: isapnp.sys

Image Path: isapnp.sys

Address: 0xF8669000 Size: 37248 File Visible: - Signed: -

Status: -

Name: k56nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\k56nt.sys

Address: 0xF2BB4000 Size: 392992 File Visible: - Signed: -

Status: -

Name: kbdclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys

Address: 0xF8A19000 Size: 24576 File Visible: - Signed: -

Status: -

Name: KDCOM.DLL

Image Path: C:\WINDOWS\system32\KDCOM.DLL

Address: 0xF8B69000 Size: 8192 File Visible: - Signed: -

Status: -

Name: kmixer.sys

Image Path: C:\WINDOWS\system32\drivers\kmixer.sys

Address: 0xEEA44000 Size: 172416 File Visible: - Signed: -

Status: -

Name: ks.sys

Image Path: C:\WINDOWS\system32\drivers\ks.sys

Address: 0xF7987000 Size: 143360 File Visible: - Signed: -

Status: -

Name: KSecDD.sys

Image Path: KSecDD.sys

Address: 0xF8544000 Size: 92928 File Visible: - Signed: -

Status: -

Name: Lbd.sys

Image Path: Lbd.sys

Address: 0xF86B9000 Size: 57472 File Visible: - Signed: -

Status: -

Name: LVPrcMon.sys

Image Path: C:\WINDOWS\system32\drivers\LVPrcMon.sys

Address: 0xF4A0A000 Size: 16768 File Visible: - Signed: -

Status: -

Name: mdmxsdk.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys

Address: 0xF2D7D000 Size: 8896 File Visible: - Signed: -

Status: -

Name: mmc_2K.SYS

Image Path: C:\WINDOWS\System32\Drivers\mmc_2K.SYS

Address: 0xF8A51000 Size: 22464 File Visible: - Signed: -

Status: -

Name: mnmdd.SYS

Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS

Address: 0xF8BD3000 Size: 4224 File Visible: - Signed: -

Status: -

Name: Modem.SYS

Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS

Address: 0xF8A31000 Size: 30080 File Visible: - Signed: -

Status: -

Name: mouclass.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys

Address: 0xF8A09000 Size: 23040 File Visible: - Signed: -

Status: -

Name: mouhid.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys

Address: 0xF8B39000 Size: 12160 File Visible: - Signed: -

Status: -

Name: MountMgr.sys

Image Path: MountMgr.sys

Address: 0xF8679000 Size: 42368 File Visible: - Signed: -

Status: -

Name: mrxdav.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys

Address: 0xF2DB5000 Size: 180608 File Visible: - Signed: -

Status: -

Name: mrxsmb.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

Address: 0xF4C3A000 Size: 455296 File Visible: - Signed: -

Status: -

Name: Msfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS

Address: 0xF8939000 Size: 19072 File Visible: - Signed: -

Status: -

Name: msgpc.sys

Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys

Address: 0xF7C39000 Size: 35072 File Visible: - Signed: -

Status: -

Name: mssmbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys

Address: 0xF8455000 Size: 15488 File Visible: - Signed: -

Status: -

Name: Mup.sys

Image Path: Mup.sys

Address: 0xF849D000 Size: 105344 File Visible: - Signed: -

Status: -

Name: NAVAPEL.SYS

Image Path: C:\Program Files\NavNT\NAVAPEL.SYS

Address: 0xF4A2A000 Size: 17056 File Visible: - Signed: -

Status: -

Name: NDIS.SYS

Image Path: C:\WINDOWS\system32\Drivers\NDIS.SYS

Address: 0xF85A5000 Size: 182656 File Visible: - Signed: -

Status: -

Name: ndistapi.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys

Address: 0xF8459000 Size: 10112 File Visible: - Signed: -

Status: -

Name: ndisuio.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndisuio.sys

Address: 0xF37B6000 Size: 14592 File Visible: - Signed: -

Status: -

Name: ndiswan.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys

Address: 0xF6F22000 Size: 91520 File Visible: - Signed: -

Status: -

Name: NDProxy.SYS

Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS

Address: 0xF7C19000 Size: 40576 File Visible: - Signed: -

Status: -

Name: netbios.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys

Address: 0xF8759000 Size: 34688 File Visible: - Signed: -

Status: -

Name: netbt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys

Address: 0xF4D1F000 Size: 162816 File Visible: - Signed: -

Status: -

Name: Npfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS

Address: 0xF8941000 Size: 30848 File Visible: - Signed: -

Status: -

Name: Ntfs.sys

Image Path: Ntfs.sys

Address: 0xF84B7000 Size: 574976 File Visible: - Signed: -

Status: -

Name: ntoskrnl.exe

Image Path: C:\WINDOWS\system32\ntoskrnl.exe

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: Null.SYS

Image Path: C:\WINDOWS\System32\Drivers\Null.SYS

Address: 0xF8D39000 Size: 2944 File Visible: - Signed: -

Status: -

Name: nv4_disp.dll

Image Path: C:\WINDOWS\System32\nv4_disp.dll

Address: 0xBF9D5000 Size: 4247552 File Visible: - Signed: -

Status: -

Name: nv4_mini.sys

Image Path: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys

Address: 0xF7717000 Size: 1465312 File Visible: - Signed: -

Status: -

Name: nv_agp.sys

Image Path: nv_agp.sys

Address: 0xF8A7D000 Size: 12160 File Visible: - Signed: -

Status: -

Name: parport.sys

Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys

Address: 0xF7A6A000 Size: 80128 File Visible: - Signed: -

Status: -

Name: PartMgr.sys

Image Path: PartMgr.sys

Address: 0xF88F1000 Size: 19712 File Visible: - Signed: -

Status: -

Name: ParVdm.SYS

Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS

Address: 0xF8B79000 Size: 6784 File Visible: - Signed: -

Status: -

Name: pci.sys

Image Path: pci.sys

Address: 0xF8609000 Size: 68224 File Visible: - Signed: -

Status: -

Name: pciide.sys

Image Path: pciide.sys

Address: 0xF8C31000 Size: 3328 File Visible: - Signed: -

Status: -

Name: PCIIDEX.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS

Address: 0xF88E9000 Size: 28672 File Visible: - Signed: -

Status: -

Name: pfc.sys

Image Path: C:\WINDOWS\system32\drivers\pfc.sys

Address: 0xF8465000 Size: 9856 File Visible: - Signed: -

Status: -

Name: PfModNT.sys

Image Path: C:\WINDOWS\System32\PfModNT.sys

Address: 0xF8BA1000 Size: 4352 File Visible: - Signed: -

Status: -

Name: PnpManager

Image Path: \Driver\PnpManager

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: portcls.sys

Image Path: C:\WINDOWS\system32\drivers\portcls.sys

Address: 0xF79AA000 Size: 147456 File Visible: - Signed: -

Status: -

Name: PROCEXP90.SYS

Image Path: C:\WINDOWS\system32\Drivers\PROCEXP90.SYS

Address: 0xF8B85000 Size: 6464 File Visible: No Signed: -

Status: -

Name: psched.sys

Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys

Address: 0xF6F11000 Size: 69120 File Visible: - Signed: -

Status: -

Name: ptilink.sys

Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys

Address: 0xF8A41000 Size: 17792 File Visible: - Signed: -

Status: -

Name: pwd_2K.SYS

Image Path: C:\WINDOWS\System32\Drivers\pwd_2K.SYS

Address: 0xF787D000 Size: 117536 File Visible: - Signed: -

Status: -

Name: PxHelp20.sys

Image Path: PxHelp20.sys

Address: 0xF86C9000 Size: 35648 File Visible: - Signed: -

Status: -

Name: rasacd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys

Address: 0xF8B19000 Size: 8832 File Visible: - Signed: -

Status: -

Name: rasl2tp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys

Address: 0xF7C69000 Size: 51328 File Visible: - Signed: -

Status: -

Name: raspppoe.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys

Address: 0xF7C59000 Size: 41472 File Visible: - Signed: -

Status: -

Name: raspptp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys

Address: 0xF7C49000 Size: 48384 File Visible: - Signed: -

Status: -

Name: raspti.sys

Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys

Address: 0xF8A49000 Size: 16512 File Visible: - Signed: -

Status: -

Name: RAW

Image Path: \FileSystem\RAW

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Name: rdbss.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys

Address: 0xF4CD2000 Size: 175744 File Visible: - Signed: -

Status: -

Name: RDPCDD.sys

Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

Address: 0xF8BD5000 Size: 4224 File Visible: - Signed: -

Status: -

Name: redbook.sys

Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys

Address: 0xF8899000 Size: 57600 File Visible: - Signed: -

Status: -

Name: rksample.sys

Image Path: C:\WINDOWS\System32\DRIVERS\rksample.sys

Address: 0xF8879000 Size: 54688 File Visible: - Signed: -

Status: -

Name: rootrepeal2.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal2.sys

Address: 0xF493F000 Size: 49152 File Visible: No Signed: -

Status: -

Name: serenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys

Address: 0xF846D000 Size: 15744 File Visible: - Signed: -

Status: -

Name: serial.sys

Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys

Address: 0xF8829000 Size: 64512 File Visible: - Signed: -

Status: -

Name: SOAR.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\SOAR.SYS

Address: 0xF8869000 Size: 61440 File Visible: - Signed: -

Status: -

Name: sr.sys

Image Path: sr.sys

Address: 0xF855B000 Size: 73472 File Visible: - Signed: -

Status: -

Name: srv.sys

Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys

Address: 0xF2B62000 Size: 333952 File Visible: - Signed: -

Status: -

Name: SSI.SYS

Image Path: SSI.SYS

Address: 0xF85D2000 Size: 98304 File Visible: No Signed: -

Status: -

Name: ssmdrv.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

Address: 0xF8949000 Size: 23040 File Visible: - Signed: -

Status: -

Name: strmdisp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\strmdisp.sys

Address: 0xF4A22000 Size: 18880 File Visible: - Signed: -

Status: -

Name: swenum.sys

Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys

Address: 0xF8BC1000 Size: 4352 File Visible: - Signed: -

Status: -

Name: sysaudio.sys

Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys

Address: 0xF2890000 Size: 60800 File Visible: - Signed: -

Status: -

Name: tcpip.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys

Address: 0xF4D47000 Size: 361600 File Visible: - Signed: -

Status: -

Name: TDI.SYS

Image Path: C:\WINDOWS\system32\Drivers\TDI.SYS

Address: 0xF88F9000 Size: 20480 File Visible: - Signed: -

Status: -

Name: termdd.sys

Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys

Address: 0xF7C29000 Size: 40704 File Visible: - Signed: -

Status: -

Name: tonesnt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\tonesnt.sys

Address: 0xF2B42000 Size: 53792 File Visible: - Signed: -

Status: -

Name: UdfReadr_xp.SYS

Image Path: C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS

Address: 0xF4DC5000 Size: 206464 File Visible: - Signed: -

Status: -

Name: update.sys

Image Path: C:\WINDOWS\System32\DRIVERS\update.sys

Address: 0xF6EB3000 Size: 384768 File Visible: - Signed: -

Status: -

Name: USBD.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS

Address: 0xF8BCD000 Size: 8192 File Visible: - Signed: -

Status: -

Name: usbhub.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys

Address: 0xF8719000 Size: 59520 File Visible: - Signed: -

Status: -

Name: usbohci.sys

Image Path: C:\WINDOWS\System32\DRIVERS\usbohci.sys

Address: 0xF8A29000 Size: 17152 File Visible: - Signed: -

Status: -

Name: USBPORT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS

Address: 0xF7A46000 Size: 147456 File Visible: - Signed: -

Status: -

Name: v124nt.sys

Image Path: C:\WINDOWS\System32\DRIVERS\v124nt.sys

Address: 0xF28D8000 Size: 497312 File Visible: - Signed: -

Status: -

Name: vga.sys

Image Path: C:\WINDOWS\System32\drivers\vga.sys

Address: 0xF8931000 Size: 20992 File Visible: - Signed: -

Status: -

Name: VIDEOPRT.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS

Address: 0xF7703000 Size: 81920 File Visible: - Signed: -

Status: -

Name: VolSnap.sys

Image Path: VolSnap.sys

Address: 0xF8689000 Size: 52352 File Visible: - Signed: -

Status: -

Name: wanarp.sys

Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys

Address: 0xF8789000 Size: 34560 File Visible: - Signed: -

Status: -

Name: watchdog.sys

Image Path: C:\WINDOWS\System32\watchdog.sys

Address: 0xF89F9000 Size: 20480 File Visible: - Signed: -

Status: -

Name: wdmaud.sys

Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys

Address: 0xF26E3000 Size: 83072 File Visible: - Signed: -

Status: -

Name: Win32k

Image Path: \Driver\Win32k

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

Name: win32k.sys

Image Path: C:\WINDOWS\System32\win32k.sys

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

Name: WMILIB.SYS

Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS

Address: 0xF8B6B000 Size: 8192 File Visible: - Signed: -

Status: -

Name: WMIxWDM

Image Path: \Driver\WMIxWDM

Address: 0x804D7000 Size: 2189056 File Visible: - Signed: -

Status: -

Attach.rar

Link to post
Share on other sites

Thanks for those logs.

Let's update Java and run an online scan.

Update Java to Version 6 Update 16

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 16.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u16-windows-i586.exe to install the newest version.

-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.

-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.

-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Run Scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Open the Kaspersky WebScanner
    page.
  • Click on the kaspersky_scan_now.gif button on the main page.
  • The program will launch and fill in the Information section on the left.
  • Read the "Requirements and Limitations" then press the Kasaccept.png button.
  • The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.
  • Once the files have been downloaded, click on the KasperskySettings.png ...button.
    In the scan settings make sure the following are selected:
    • Detect malicious programs of the following categories:
      Viruses, Worms, Trojan Horses, Rootkits
      Spyware, Adware, Dialers and other potentially dangerous programs
    • Scan compound files (doesn't apply to the File scan area):
      Archives
      Mail databases
      By default the above items should already be checked.
    • Click the Kassave.png button, if you made any changes.

    [*]Now under the Scan section on the left:

    Select My Computer

    [*]The program will now start and scan your system. This will run for a while, be patient and let it finish.

    [*]Once the scan is complete, click on View scan report

    [*]Now, click on the Save Report as button.

    [*]Save the file to your desktop.

    [*]Copy and paste that information in your next post.

You can refer to this animation by sundavis if needed.

Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.

Thanks.

With Regards,

Extremeboy

Link to post
Share on other sites

Hey, I deleted all versions of Java, and installed the new version. When I tried to run the Kapersky scanner, even with my anti-virus off, i get this message:

Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program.

You must be online to update the Kaspersky Online Scanner 7 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7. [ERROR: Key is expired]

Link to post
Share on other sites

Hello.

That's a common error. Run ESET instead...

Run ESET Online Scan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

      You can refer to this animation by neomage if needed.
      Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.Thanks.
      With Regards,
      Extremeboy
Link to post
Share on other sites

Alright here are the logs

ESET scan:

C:\Documents and Settings\~suicidaL feeLing~\Desktop\smitRem\Process.exe Win32/PrcView application cleaned by deleting - quarantined

C:\Program Files\AIM\Sysfiles\WxBug.EXE Win32/Adware.WBug.A application deleted - quarantined

C:\Qoobox\Quarantine\C\autorun.inf.vir INF/Autorun.gen trojan cleaned by deleting - quarantined

C:\WINDOWS\inf\lrusys.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined

C:\WINDOWS\system32\0urdomzp.exe a variant of Win32/Kryptik.AAY trojan cleaned by deleting - quarantined

DDS:

DDS (Ver_09-07-30.01) - NTFSx86

Run by ~suicidaL feeLing~ at 0:04:59.98 on Sat 09/05/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.199 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\carpserv.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Documents and Settings\~suicidaL feeLing~\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.uiowa.edu/

mSearch Bar = hxxp://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html

uInternet Connection Wizard,ShellNext = hxxp://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&c=2c02&lc=0409

uInternet Settings,ProxyOverride = *.r21.mchsi.com;*.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: MoneySide: {9404901d-06da-4b23-a0ee-3ea4f64ec9b3} - c:\program files\microsoft money\system\mnyviewer.dll

uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [CARPService] carpserv.exe

mRun: [WINDVDPatch] CTHELPER.EXE

mRun: [updReg] c:\windows\UpdReg.EXE

mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe"

mRun: [srmclean] c:\cpqs\scom\srmclean.exe

mRun: [Microsoft Works Portfolio] c:\program files\microsoft works\WksSb.exe /AllUsers

mRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

mRun: [FineReader7NewsReaderPro] "c:\program files\abbyy finereader 7.0 professional edition\AbbyyNewsReader.exe"

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

StartupFolder: c:\docume~1\~suici~1\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)

mPolicies-explorer: <NO NAME> =

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper200711281.dll

DPF: {33363249-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/i263_32.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://targetphoto.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - hxxp://download.divx.com/player/DivXPlayerInstaller.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - hxxp://playroom.icq.com/odyssey_web8.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37577.4731597222

DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab

DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - hxxp://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx

Notify: MCPClient - c:\program files\common files\stardock\mcpstub.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

Notify: WRNotifier - WRLogonNTF.dll

SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\program files\common files\stardock\MCPCore.dll

SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - c:\windows\system32\iprepair.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\~suici~1\applic~1\mozilla\firefox\profiles\520wdkqh.default user\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.facebook.com

FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-26 64160]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-30 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-30 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-30 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-30 55656]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-12-22 24652]

R2 WUSB54Gv42SVC;WUSB54Gv42SVC;c:\program files\linksys wireless-g usb wireless network monitor\WLService.exe [2007-8-25 53307]

S3 FBIKB_NT;FBIKB_NT;\??\c:\windows\system32\drivers\fbikb_nt.sys --> c:\windows\system32\drivers\FBIKB_NT.Sys [?]

S3 iscFlash;iscFlash;\??\c:\windows\system32\drivers\iscflash.sys --> c:\windows\system32\drivers\iscflash.sys [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]

S3 msCMTSrvc;Content Monitoring Tool;c:\windows\system32\mscmtsrvc.exe --> c:\windows\system32\msCMTSrvc.exe [?]

=============== Created Last 30 ================

2009-09-04 13:28 <DIR> --d----- c:\program files\ESET

2009-09-03 23:25 73,728 a------- c:\windows\system32\javacpl.cpl

2009-09-02 01:42 <DIR> --d----- c:\windows\system32\dllcache\cache

2009-09-01 15:38 <DIR> a-dshr-- C:\cmdcons

2009-09-01 15:35 229,376 a------- c:\windows\PEV.exe

2009-09-01 15:35 161,792 a------- c:\windows\SWREG.exe

2009-09-01 15:35 98,816 a------- c:\windows\sed.exe

2009-09-01 14:12 <DIR> --d----- c:\docume~1\~suici~1\applic~1\Malwarebytes

2009-08-30 23:19 <DIR> --d----- c:\program files\Trend Micro

2009-08-30 12:50 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-30 12:50 <DIR> --d----- c:\program files\Avira

2009-08-30 12:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira

2009-08-23 21:12 <DIR> --dsh--- c:\documents and settings\~suicidal feeling~\IECompatCache

2009-08-19 03:02 <DIR> --d----- c:\windows\ie8updates

2009-08-18 11:18 <DIR> --d----- c:\windows\system32\Adobe

2009-08-18 10:56 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx

2009-08-18 10:55 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll

2009-08-18 10:55 12,800 -------- c:\windows\system32\dllcache\xpshims.dll

==================== Find3M ====================

2009-09-03 23:25 411,368 a------- c:\windows\system32\deploytk.dll

2009-08-23 20:36 15,688 a------- c:\windows\system32\lsdelete.exe

2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll

2009-07-19 08:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll

2009-07-19 08:18 5,937,152 a------- c:\windows\system32\dllcache\cache\mshtml.dll

2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll

2009-07-12 12:21 4,874,240 a------- c:\windows\system32\dllcache\wmp.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\wmpdxm.dll

2009-07-12 12:21 233,472 a------- c:\windows\system32\dllcache\wmpdxm.dll

2009-07-10 08:27 1,315,328 a------- c:\windows\system32\dllcache\msoe.dll

2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll

2009-07-03 12:09 915,456 a------- c:\windows\system32\dllcache\cache\wininet.dll

2009-07-03 12:09 915,456 -------- c:\windows\system32\wininet.dll

2009-07-03 12:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll

2009-07-03 12:09 206,848 a------- c:\windows\system32\dllcache\occache.dll

2009-07-03 12:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll

2009-07-03 12:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll

2009-07-03 12:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll

2009-07-03 12:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll

2009-07-03 12:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll

2009-07-03 12:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll

2009-07-03 06:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe

2009-06-29 11:12 133,120 a------- c:\windows\system32\dllcache\extmgr.dll

2009-06-29 06:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe

2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 03:25 147,456 a------- c:\windows\system32\dllcache\schannel.dll

2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 03:25 56,832 a------- c:\windows\system32\dllcache\secur32.dll

2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\lsasrv.dll

2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll

2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll

2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll

2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll

2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys

2009-06-16 09:36 119,808 -------- c:\windows\system32\t2embed.dll

2009-06-16 09:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\fontsub.dll

2009-06-16 09:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll

2009-06-12 07:31 76,288 -------- c:\windows\system32\telnet.exe

2009-06-12 07:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\dllcache\mstscax.dll

2009-06-10 09:19 2,066,432 -------- c:\windows\system32\mstscax.dll

2009-06-10 09:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\wkssvc.dll

2009-06-10 01:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll

2004-06-13 19:27 449 ac------ c:\documents and settings\~suicidal feeling~\UpdateReg.reg

2002-11-12 14:58 3,932 ac------ c:\docume~1\~suici~1\applic~1\LMLayout.dat

2002-11-12 14:58 268 ac------ c:\docume~1\~suici~1\applic~1\LMCPaper.dat

2004-10-11 11:16 71 ac-sh--- c:\windows\system32\SYSDRVREB.SYS

2008-09-14 03:22 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

============= FINISH: 0:05:48.26 ===============

Attach.rar

Link to post
Share on other sites

Hello.

That looks pretty good. ;)

Please answer/respond to this question please...

Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.

A bit late, but regarding P2P programs:

Peer-to-Peer Programs Warning

Your log shows that you are using so called peer-to-peer or file-sharing programs (in your case UTorrent). These programs allow to share files between users as the name(s) suggest. In today's world cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organizations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."

It is your decision whether or not you wish to keep your program(s) but I suggest you remove it via add/remove. However, please refrain from using them until your computer has been declared clean.

With Regards,

Extremeboy

Link to post
Share on other sites

Hey, thanks for the help, computer is running much better without freezes, google searches are no longer hijacked/re-directed, and my boot cleaner doesn't initialize on startup. I was curious, is there any programs you'd reccommend that I install, or should i run the ESET scan monthly as well as malwarebytes/any other preventative measures I should take aside from not using torrent clients?

Again Thanks A Lot for Your Help

-steens15

Link to post
Share on other sites

Hello.

We'll get to the prevention tips in a sec... Let's remove the tools we have used beneath that is some prevention tips.

Regarding installments, I think you are fine. Avira is a great anti-virus software that I also use myself. Malwarebytes is a great anti-malware software in general. SuperAnti-Spyware is another great anti-spyware program if you wish to install you can. Regarding online scans (ESET) they take quite a lot of time, so if things look good on what your anti-virus and anti-malware softwares has found, meaning there isn't much infections then online scan isn't needed. You can however, run an online scan say every 3 months or so. More if you wish. Anti-virus scans/Anti-malware scans should be run at least once a month. However, I don't find scanning the most important thing. Good surfing habits and be aware of what you do is the best protection you can get. I have Avira and Malwarebytes installed for quite a while now, but I haven't scanned them for almost 2 years. I do scan occasionally, with individual files but other than that I don't usually scan with them. However, scanning them every month or so is a good idea for you.

Please follow/read the steps below to remove the tools we used and for some more information. :D

Uninstall ComboFix

Remove Combofix now that we're done with it.

  • Click on your Start Menu, then Run....
  • Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
    CF_Cleanup.png
  • You will then recieve a message letting you know that Combofix was uninstalled Successfully.

This will remove files/folders assoicated with combofix and uninstall it.

Download and Run OTC

We will now remove the tools we used during this fix using OTC.

  • Download OTC by OldTimer and save it to your desktop.
  • Double click OTC_Icon.jpg icon to start the program. If you are using Vista, please right-click and choose run as administrator
  • Then Click the big CleanUp.jpg button.
  • You will get a prompt saying "Being Cleanup Process". Please select Yes.
  • Restart your computer when prompted.

System A bit Slow? Try StartupLight

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.

Congratulations! You now appear clean! ;)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

[*]Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a sm

Link to post
Share on other sites

Hello.

Since the problem appears to be resolved, this topic is now Closed. Glad we could help :huh:

If you need this topic reopened, pleaseSend Me a Message. In your message please include the address of this thread in your request.

This applies only to the original topic starter

Everyone else please start a new topic in the Hijackthis-Malware Removal Forum.

With Regards,

Extremeboy

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.