help needed with rootkit.agent removal

nreece · November 24, 2009

Hello,

This is my first post so, hopefully I'm doing this right. I have contracted malware which is causing the following issue with my IBM Lenovo PC running Windows XP: Every 30-60 seconds I get a POP-up message titled: iexplore.exe application error message, which states: "The instruction at 0x901360e1 referenced memory at 0x901360e1. The memory could not be read. Click on OK to terminate the program or click on cancel to debug the program." My Internet Explorer browser and Firefox browsers are both inoperable.

I have managed to rid my system of "some" of the files using the MBAM program but, there are still several files that MB can't delete. I've been reading posts in this forum all day and it seems as if I have a blended "multiple" infection. It appears I still have a Rootkit.agent infecting my system. I tried identifying the files using the "Root repeal" and "GMER" programs but have been unsuccessful. So, I ran an HJT scan at the direction of this forum.

I am copying my MBAM, HJT and GMER log files here in hopes you may be able to assist me. I am attaching the GMER logs because there is an entry which corresponds to one of the files in the MBAM log, Trojan.FakeAlert - Memory module. I've highlighted it in red in the GMER LOG file.

Thank you in advance.

Nate

MBAM LOG File:

Malwarebytes' Anti-Malware 1.41

Database version: 3218

Windows 5.1.2600 Service Pack 2

11/23/2009 2:10:35 PM

mbam-log-2009-11-23 (14-10-35).txt

Scan type: Full Scan (C:\|)

Objects scanned: 203279

Time elapsed: 31 minute(s), 51 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 4

Registry Keys Infected: 0

Registry Values Infected: 3

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINNT\system32\dijuboru.dll (Trojan.FakeAlert) -> Delete on reboot.

C:\WINNT\system32\fgjk4wvb.dll (Spyware.OnlineGames) -> Delete on reboot.

C:\WINNT\system32\ponovisi.dll (Trojan.FakeAlert) -> Delete on reboot.

\\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\calc (Trojan.Downloader) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\calc (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINNT\system32\dijuboru.dll (Trojan.FakeAlert) -> Delete on reboot.

C:\Documents and Settings\nreece\ntuser.dll (Trojan.Agent) -> Delete on reboot.

C:\WINNT\system32\fgjk4wvb.dll (Spyware.OnlineGames) -> Delete on reboot.

C:\WINNT\system32\ponovisi.dll (Trojan.FakeAlert) -> Delete on reboot.

\\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINNT\system32\tdlcmd.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\nreece\Start Menu\Programs\Startup\scandisk.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\nreece\Start Menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\nreece\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.

HJT LOG file:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:39:38 PM, on 11/23/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\ibmpmsvc.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Lenovo\TrackPoint\TP4SERVINST.EXE

C:\WINNT\system32\bgsvcgen.exe

C:\WINNT\system32\cisvc.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\IPSec Client\LucentIKESvc.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\IPSec Client\LucentIKE.exe

C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

C:\WINNT\System32\mnmsrvc.exe

C:\WINNT\system32\rundll32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\timbuktu pro\tb2launch.exe

C:\WINNT\system32\CCM\CcmExec.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

C:\Program Files\timbuktu pro\tb2logon.exe

C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

C:\Program Files\Network Associates\Common Framework\McTray.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINNT\system32\rundll32.exe

C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\timbuktu pro\tb2pro.exe

C:\WINNT\system32\hkcmd.exe

C:\WINNT\system32\igfxpers.exe

C:\WINNT\system32\igfxsrvc.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINNT\system32\rundll32.exe

C:\WINNT\system32\RUNDLL32.EXE

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\IPSec Client\trayicon.exe

C:\Program Files\timbuktu pro\TNOTIFY.EXE

C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINNT\system32\CCM\SMSCliUI.exe

C:\WINNT\system32\cidaemon.exe

C:\Documents and Settings\nreece\Local Settings\Temp\gmer.exe

C:\gmer\gmer.exe

C:\WINNT\system32\rundll32.exe

C:\gmer\gmer.exe

F:\malwarebytes\HJT\HJTInstall.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aww.usa.alcatel.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aww.usa.alcatel.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.proxy.alcatel-lucent.com/proxy.pac

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.lucent.com;*.alcatel.com;*.alcatel-lucent.com;<local>

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [TLogonPath] "C:\Program Files\timbuktu pro\tb2logon.exe"

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray

O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [igfxTray] C:\WINNT\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINNT\system32\igfxpers.exe

O4 - HKLM\..\Run: [TrackPointSrv] C:\Program Files\Lenovo\TrackPoint\tp4serv.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINNT\system32\calc.dll,_IWMPEvents@0

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Malwarebytes' Anti-Malware\fix.exe.exe" /runcleanupscript

O4 - HKLM\..\Run: [ctfmon] RUNDLL32.EXE C:\WINNT\system32\fgjk4wvb.dll,w

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe

O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\nreece\ntuser.dll,_IWMPEvents@0

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINNT\system32\Macromed\Flash\FlashUtil9f.exe

O4 - HKUS\S-1-5-18\..\Run: [calc] rundll32.exe C:\DOCUME~1\NETWOR~1\ntuser.dll,_IWMPEvents@0 (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [jsh87r3huiehf89esiudgd] C:\WINNT\TEMP\n3md6rvf.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [asg984jgkfmgasi8ug98jgkfgfb] C:\WINNT\TEMP\notepad.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [calc] rundll32.exe C:\DOCUME~1\NETWOR~1\ntuser.dll,_IWMPEvents@0 (User 'Default user')

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O4 - Global Startup: IPSecClient Icon.lnk = C:\Program Files\IPSec Client\trayicon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll

O14 - IERESET.INF: START_PAGE_URL=http://aww.usa.alcatel.com

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813

O16 - DPF: {093501ce-d290-11d3-a3d6-00c04fa32518} -

O16 - DPF: {5e2a3510-4371-11d6-b64c-00c04faedb18} (Oracle JInitiator 1.1.8.18) -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1204322318437

O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -

O16 - DPF: {ed54a7b0-6c1c-11d5-b63d-00c04faedb18} -

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = na02.lucent.com

O17 - HKLM\Software\..\Telephony: DomainName = na02.lucent.com

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = na02.lucent.com

O20 - AppInit_DLLs: dijuboru.dll

O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINNT\system32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LucentIKE - Unknown owner - C:\Program Files\IPSec Client\LucentIKESvc.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: OracleOracle8i_localClientCache - Unknown owner - C:\Program Files\oracle8i\BIN\ONRSD.EXE

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Tb2 Launch (Tb2Launch) - Netopia, Inc. - C:\Program Files\timbuktu pro\tb2launch.exe

O23 - Service: tp4serv - Lenovo Group Limited - C:\Program Files\Lenovo\TrackPoint\TP4SERVINST.EXE

--

End of file - 10810 bytes

GMER LOG file

GMER 1.0.15.15252 - http://www.gmer.net

Rootkit scan 2009-11-23 15:23:24

Windows 5.1.2600 Service Pack 2

Running: 9b2o9jnm.exe; Driver: C:\DOCUME~1\nreece\LOCALS~1\Temp\axtoraow.sys

---- System - GMER 1.0.15 ----

Code 864112A8 ZwEnumerateKey

Code 8640E898 ZwFlushInstructionCache

Code 8641711E IofCallDriver

Code 86418C76 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCallDriver 804EF1A0 5 Bytes JMP 86417123

.text ntkrnlpa.exe!IofCompleteRequest 804EF230 5 Bytes JMP 86418C7B

PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B5642 5 Bytes JMP 8640E89C

PAGE ntkrnlpa.exe!ZwEnumerateKey 80622DE0 5 Bytes JMP 864112AC

init C:\WINNT\NetopiaRC\Tb2Device.sys entry point in "init" section [0xA2BD3000]

? C:\WINNT\system32\drivers\rootrepeal.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINNT\system32\CCM\SMSCliUI.exe[588] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01022A5E; RET

.text C:\WINNT\system32\CCM\SMSCliUI.exe[588] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01021BCE; RET

.text C:\WINNT\system32\CCM\SMSCliUI.exe[588] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01021B9A; RET

.text C:\WINNT\system32\CCM\SMSCliUI.exe[588] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01021B03; RET

.text C:\WINNT\system32\CCM\SMSCliUI.exe[588] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01021B2B; RET

.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2092] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00F92A5E; RET

.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2092] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00F91BCE; RET

.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2092] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00F91B9A; RET

.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2092] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00F91B03; RET

.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2092] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00F91B2B; RET

.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2268] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01002A5E; RET

.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2268] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01001BCE; RET

.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2268] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01001B9A; RET

.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2268] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01001B03; RET

.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2268] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01001B2B; RET

.text C:\Program Files\Digital Line Detect\DLG.exe[2388] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01192A5E; RET

.text C:\Program Files\Digital Line Detect\DLG.exe[2388] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01191BCE; RET

.text C:\Program Files\Digital Line Detect\DLG.exe[2388] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01191B9A; RET

.text C:\Program Files\Digital Line Detect\DLG.exe[2388] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01191B03; RET

.text C:\Program Files\Digital Line Detect\DLG.exe[2388] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01191B2B; RET

.text C:\Program Files\IPSec Client\trayicon.exe[2532] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01352A5E; RET

.text C:\Program Files\IPSec Client\trayicon.exe[2532] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01351BCE; RET

.text C:\Program Files\IPSec Client\trayicon.exe[2532] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01351B9A; RET

.text C:\Program Files\IPSec Client\trayicon.exe[2532] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01351B03; RET

.text C:\Program Files\IPSec Client\trayicon.exe[2532] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01351B2B; RET

.text C:\WINNT\Explorer.EXE[2764] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 02272A5E; RET

.text C:\WINNT\Explorer.EXE[2764] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 02271BCE; RET

.text C:\WINNT\Explorer.EXE[2764] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 02271B9A; RET

.text C:\WINNT\Explorer.EXE[2764] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 02271B03; RET

.text C:\WINNT\Explorer.EXE[2764] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 02271B2B; RET

.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[3184] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01672A5E; RET

.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[3184] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01671BCE; RET

.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[3184] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01671B9A; RET

.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[3184] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01671B03; RET

.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[3184] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01671B2B; RET

.text C:\Program Files\Network Associates\Common Framework\UdaterUI.exe[3192] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01882A5E; RET

.text C:\Program Files\Network Associates\Common Framework\UdaterUI.exe[3192] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01881BCE; RET

.text C:\Program Files\Network Associates\Common Framework\UdaterUI.exe[3192] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01881B9A; RET

.text C:\Program Files\Network Associates\Common Framework\UdaterUI.exe[3192] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01881B03; RET

.text C:\Program Files\Network Associates\Common Framework\UdaterUI.exe[3192] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01881B2B; RET

.text C:\Program Files\timbuktu pro\tb2logon.exe[3200] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00E62A5E; RET

.text C:\Program Files\timbuktu pro\tb2logon.exe[3200] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00E61BCE; RET

.text C:\Program Files\timbuktu pro\tb2logon.exe[3200] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00E61B9A; RET

.text C:\Program Files\timbuktu pro\tb2logon.exe[3200] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00E61B03; RET

.text C:\Program Files\timbuktu pro\tb2logon.exe[3200] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00E61B2B; RET

.text C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe[3208] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01252A5E; RET

.text C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe[3208] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01251BCE; RET

.text C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe[3208] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01251B9A; RET

.text C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe[3208] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01251B03; RET

.text C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe[3208] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01251B2B; RET

.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3224] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00D02A5E; RET

.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3224] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00D01BCE; RET

.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3224] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00D01B9A; RET

.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3224] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00D01B03; RET

.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3224] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00D01B2B; RET

.text C:\Program Files\Analog Devices\Core\smax4pnp.exe[3232] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 013B2A5E; RET

.text C:\Program Files\Analog Devices\Core\smax4pnp.exe[3232] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 013B1BCE; RET

.text C:\Program Files\Analog Devices\Core\smax4pnp.exe[3232] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 013B1B9A; RET

.text C:\Program Files\Analog Devices\Core\smax4pnp.exe[3232] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 013B1B03; RET

.text C:\Program Files\Analog Devices\Core\smax4pnp.exe[3232] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 013B1B2B; RET

.text C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe[3312] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 012A2A5E; RET

.text C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe[3312] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 012A1BCE; RET

.text C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe[3312] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 012A1B9A; RET

.text C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe[3312] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 012A1B03; RET

.text C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe[3312] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 012A1B2B; RET

.text C:\Program Files\Network Associates\Common Framework\McTray.exe[3368] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00F72A5E; RET

.text C:\Program Files\Network Associates\Common Framework\McTray.exe[3368] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00F71BCE; RET

.text C:\Program Files\Network Associates\Common Framework\McTray.exe[3368] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00F71B9A; RET

.text C:\Program Files\Network Associates\Common Framework\McTray.exe[3368] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00F71B03; RET

.text C:\Program Files\Network Associates\Common Framework\McTray.exe[3368] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00F71B2B; RET

.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3380] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01682A5E; RET

.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3380] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01681BCE; RET

.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3380] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01681B9A; RET

.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3380] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01681B03; RET

.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3380] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01681B2B; RET

.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 016C2A5E; RET

.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 016C1BCE; RET

.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 016C1B9A; RET

.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 016C1B03; RET

.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 016C1B2B; RET

.text C:\WINNT\system32\rundll32.exe[3428] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00E82A5E; RET

.text C:\WINNT\system32\rundll32.exe[3428] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00E81BCE; RET

.text C:\WINNT\system32\rundll32.exe[3428] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00E81B9A; RET

.text C:\WINNT\system32\rundll32.exe[3428] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00E81B03; RET

.text C:\WINNT\system32\rundll32.exe[3428] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00E81B2B; RET

.text C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe[3464] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00F42A5E; RET

.text C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe[3464] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00F41BCE; RET

.text C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe[3464] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00F41B9A; RET

.text C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe[3464] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00F41B03; RET

.text C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe[3464] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00F41B2B; RET

.text C:\WINNT\system32\hkcmd.exe[3532] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01382A5E; RET

.text C:\WINNT\system32\hkcmd.exe[3532] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01381BCE; RET

.text C:\WINNT\system32\hkcmd.exe[3532] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01381B9A; RET

.text C:\WINNT\system32\hkcmd.exe[3532] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01381B03; RET

.text C:\WINNT\system32\hkcmd.exe[3532] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01381B2B; RET

.text C:\WINNT\system32\igfxpers.exe[3544] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 010A2A5E; RET

.text C:\WINNT\system32\igfxpers.exe[3544] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 010A1BCE; RET

.text C:\WINNT\system32\igfxpers.exe[3544] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 010A1B9A; RET

.text C:\WINNT\system32\igfxpers.exe[3544] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 010A1B03; RET

.text C:\WINNT\system32\igfxpers.exe[3544] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 010A1B2B; RET

.text C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE[3580] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01F62A5E; RET

.text C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE[3580] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01F61BCE; RET

.text C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE[3580] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01F61B9A; RET

.text C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE[3580] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01F61B03; RET

.text C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE[3580] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01F61B2B; RET

.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[3600] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 06C72A5E; RET

.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[3600] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 06C71BCE; RET

.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[3600] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 06C71B9A; RET

.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[3600] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 06C71B03; RET

.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[3600] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 06C71B2B; RET

.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[3636] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01AE2A5E; RET

.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[3636] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01AE1BCE; RET

.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[3636] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01AE1B9A; RET

.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[3636] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01AE1B03; RET

.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[3636] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01AE1B2B; RET

.text C:\WINNT\system32\rundll32.exe[3888] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00BC2A5E; RET

.text C:\WINNT\system32\rundll32.exe[3888] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00BC1BCE; RET

.text C:\WINNT\system32\rundll32.exe[3888] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00BC1B9A; RET

.text C:\WINNT\system32\rundll32.exe[3888] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00BC1B03; RET

.text C:\WINNT\system32\rundll32.exe[3888] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00BC1B2B; RET

.text C:\WINNT\system32\RUNDLL32.EXE[3912] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00CF2A5E; RET

.text C:\WINNT\system32\RUNDLL32.EXE[3912] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00CF1BCE; RET

.text C:\WINNT\system32\RUNDLL32.EXE[3912] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00CF1B9A; RET

.text C:\WINNT\system32\RUNDLL32.EXE[3912] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00CF1B03; RET

.text C:\WINNT\system32\RUNDLL32.EXE[3912] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00CF1B2B; RET

.text C:\WINNT\system32\ctfmon.exe[3928] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 00E52A5E; RET

.text C:\WINNT\system32\ctfmon.exe[3928] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 00E51BCE; RET

.text C:\WINNT\system32\ctfmon.exe[3928] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 00E51B9A; RET

.text C:\WINNT\system32\ctfmon.exe[3928] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 00E51B03; RET

.text C:\WINNT\system32\ctfmon.exe[3928] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 00E51B2B; RET

.text F:\malwarebytes\root repeal\GMER\9b2o9jnm.exe[3976] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01042A5E; RET

.text F:\malwarebytes\root repeal\GMER\9b2o9jnm.exe[3976] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01041BCE; RET

.text F:\malwarebytes\root repeal\GMER\9b2o9jnm.exe[3976] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01041B9A; RET

.text F:\malwarebytes\root repeal\GMER\9b2o9jnm.exe[3976] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01041B03; RET

.text F:\malwarebytes\root repeal\GMER\9b2o9jnm.exe[3976] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01041B2B; RET

.text C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[4084] kernel32.dll!TerminateProcess 7C801E16 6 Bytes PUSH 01602A5E; RET

.text C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[4084] kernel32.dll!FindNextFileW 7C80EF4A 6 Bytes PUSH 01601BCE; RET

.text C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[4084] kernel32.dll!FindNextFileA 7C834EF9 6 Bytes PUSH 01601B9A; RET

.text C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[4084] ADVAPI32.dll!RegDeleteValueA 77DDECC5 6 Bytes PUSH 01601B03; RET

.text C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe[4084] ADVAPI32.dll!RegDeleteValueW 77DDEDD1 6 Bytes PUSH 01601B2B; RET

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Tcpip \Device\Tcp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

Device \Driver\iaStor \Device\Ide\iaStor0 [F731380E] iaStor.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}

Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [F731380E] iaStor.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}

AttachedDevice \Driver\Tcpip \Device\Udp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

AttachedDevice \Driver\Tcpip \Device\RawIp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

---- Modules - GMER 1.0.15 ----

Module \systemroot\system32\drivers\H8SRTorudlkgmpy.sys (*** hidden *** ) A1FDA000-A1FF7000 (118784 bytes)

---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\system32\svchost.exe [1068] 0x011E0000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\system32\svchost.exe [1232] 0x00BA0000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\System32\svchost.exe [1416] 0x00B90000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\system32\svchost.exe [1724] 0x00BA0000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\System32\svchost.exe [1728] 0x00B90000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\System32\svchost.exe [1788] 0x00B90000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\System32\svchost.exe [1868] 0x00BA0000

Library \\?\globalroot\systemroot\system32\H8SRTsthybotuvc.dll (*** hidden *** ) @ C:\WINNT\Explorer.EXE [2764] 0x00E60000

---- Files - GMER 1.0.15 ----

File C:\WINNT\system32\drivers\iaStor.sys suspicious modification

---- EOF - GMER 1.0.15 ----

chamber · November 24, 2009

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

nreece · November 24, 2009

Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

OK, Here is my ComboFix log file. It ran smoothly...no issues.

COMBOFIX LOG

ComboFix 09-11-23.05 - nreece 11/24/2009 9:25.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.708 [GMT -8:00]

Running from: f:\malwarebytes\combofix\Renamed\patch.exe

.

The following files were disabled during the run:

c:\winnt\system32\dijuboru.dll

c:\winnt\system32\huvajolu.dll

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\nreece\ntuser.dll

c:\documents and settings\nreece\Start Menu\Programs\Startup\scandisk.dll

c:\documents and settings\nreece\Start Menu\Programs\Startup\scandisk.lnk

c:\recycler\S-1-5-21-1343024091-1202660629-2146872243-500

c:\recycler\S-1-5-21-1495413996-3315217193-3035020991-500

c:\recycler\S-1-5-21-3794707180-550574813-1373618169-500

c:\winnt\AegisP.inf

c:\winnt\run.log

c:\winnt\system32\calc.dll

c:\winnt\system32\config\systemprofile\ntuser.dll

c:\winnt\system32\drivers\H8SRTorudlkgmpy.sys

c:\winnt\system32\fgjk4wvb.dll

c:\winnt\system32\h8srtcfg.dat

c:\winnt\system32\H8SRTlonknabbst.dat

c:\winnt\system32\h8srtmain.dll

c:\winnt\system32\H8SRTmqvomblbpf.db

c:\winnt\system32\H8SRTnelstomudp.dll

c:\winnt\system32\H8SRTsthybotuvc.dll

c:\winnt\system32\H8SRTtrwdvvwcog.dll

c:\winnt\system32\H8SRTxtlgtpsxld.dll

c:\winnt\system32\H8SRTyjnmiaoviu.dll

c:\winnt\system32\ponovisi.dll

c:\winnt\system32\schtml

c:\winnt\system32\schtml\images\i1.gif

c:\winnt\system32\schtml\images\i2.gif

c:\winnt\system32\schtml\images\i3.gif

c:\winnt\system32\schtml\images\j1.gif

c:\winnt\system32\schtml\images\j2.gif

c:\winnt\system32\schtml\images\j3.gif

c:\winnt\system32\schtml\images\jj1.gif

c:\winnt\system32\schtml\images\jj2.gif

c:\winnt\system32\schtml\images\jj3.gif

c:\winnt\system32\schtml\images\l1.gif

c:\winnt\system32\schtml\images\l2.gif

c:\winnt\system32\schtml\images\l3.gif

c:\winnt\system32\schtml\images\pix.gif

c:\winnt\system32\schtml\images\t1.gif

c:\winnt\system32\schtml\images\t2.gif

c:\winnt\system32\schtml\images\up1.gif

c:\winnt\system32\schtml\images\up2.gif

c:\winnt\system32\schtml\images\w1.gif

c:\winnt\system32\schtml\images\w11.gif

c:\winnt\system32\schtml\images\w2.gif

c:\winnt\system32\schtml\images\w3.gif

c:\winnt\system32\schtml\images\w3.jpg

c:\winnt\system32\schtml\images\word.doc

c:\winnt\system32\schtml\images\wt1.gif

c:\winnt\system32\schtml\images\wt2.gif

c:\winnt\system32\schtml\images\wt3.gif

c:\winnt\system32\schtml\wispex.html

c:\winnt\system32\sojerire.dll

c:\winnt\system32\tdlcmd.dll

c:\winnt\system32\zidoyowi.dll

c:\winnt\Tasks\aguqpjtf.job

c:\winnt\Tasks\joouhcuc.job

c:\winnt\zap.exe

----- BITS: Possible infected sites -----

hxxp://USDALSSMS03.NA02.lucent.com:8081

hxxp://USNAVSSMS02.na02.lucent.com:8081

Infected copy of c:\winnt\System32\Drivers\iaStor.sys was found and disinfected

Restored copy from - Kitty ate it

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_H8SRTd.sys

-------\Legacy_H8SRTd.sys

-------\Legacy_6TO4

((((((((((((((((((((((((( Files Created from 2009-10-24 to 2009-11-24 )))))))))))))))))))))))))))))))

.

2009-11-24 00:38 . 2009-11-24 00:38 -------- d-----w- c:\program files\Trend Micro

2009-11-23 22:57 . 2009-11-23 22:57 -------- d-----w- C:\gmer

2009-11-23 22:26 . 2009-11-23 22:26 34816 ----a-w- c:\winnt\system32\drivers\blast.sys

2009-11-23 22:25 . 2009-11-23 22:26 -------- d-----w- C:\root repeal

2009-11-23 18:16 . 2009-11-23 18:16 -------- d-----w- c:\documents and settings\nreece\Application Data\Malwarebytes

2009-11-23 17:40 . 2009-09-10 22:54 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys

2009-11-23 17:40 . 2009-11-23 21:18 -------- d-----w- C:\Malwarebytes' Anti-Malware

2009-11-23 17:40 . 2009-11-23 17:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-23 17:40 . 2009-09-10 22:53 19160 ----a-w- c:\winnt\system32\drivers\mbam.sys

2009-11-23 01:26 . 2009-11-23 01:26 -------- d-----w- C:\QUARANTINE

2009-11-22 23:46 . 2009-11-23 16:58 -------- d-----w- c:\program files\AntiMalware

2009-11-04 15:57 . 2009-11-04 15:57 -------- d-----w- c:\program files\SMS Packages

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-06 17:53 . 2009-10-06 17:53 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-25 05:49 . 2005-02-18 21:19 668672 ----a-w- c:\winnt\system32\wininet.dll

2009-09-25 05:48 . 2005-12-20 19:02 81920 ----a-w- c:\winnt\system32\ieencode.dll

2009-09-11 14:03 . 1980-01-01 00:00 136192 ----a-w- c:\winnt\system32\msv1_0.dll

2009-09-04 20:45 . 1980-01-01 00:00 58880 ----a-w- c:\winnt\system32\msasn1.dll

2009-09-04 17:17 . 2008-07-15 18:01 42480 ----a-w- c:\documents and settings\nreece\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-03-21 14:18 . 1980-01-01 00:00 24064 --sha-w- c:\winnt\system32\config\systemprofile\Start Menu\Programs\Startup\scandisk.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-23 94208]

"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 136768]

"TLogonPath"="c:\program files\timbuktu pro\tb2logon.exe" [2003-02-06 151552]

"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-12-20 155648]

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 53248]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]

"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2007-08-09 135168]

"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2007-08-09 155648]

"Persistence"="c:\winnt\system32\igfxpers.exe" [2007-08-09 131072]

"TrackPointSrv"="c:\program files\Lenovo\TrackPoint\tp4serv.exe" [2007-11-08 92960]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]

"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]

"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]

"Malwarebytes Anti-Malware (reboot)"="c:\malwarebytes' anti-malware\fix.exe.exe" [2009-09-10 1312080]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\winnt\system32\bthprops.cpl [2004-08-04 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]

Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2006-8-18 561213]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-30 45056]

IPSecClient Icon.lnk - c:\program files\IPSec Client\trayicon.exe [2009-8-27 675840]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Timbuktu Pro]

2003-02-06 18:21 81973 ----a-w- c:\program files\timbuktu pro\HOOK32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]

2005-07-06 05:45 28672 ----a-w- c:\winnt\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2005-12-01 02:16 24576 ----a-w- c:\winnt\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"midi1"=ma_cmidn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-583907252-413027322-1417001333-2604\Scripts\Logoff\0\0]

"Script"=CleanCitrixReg.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-583907252-413027322-1417001333-2604\Scripts\Logon\0\0]

"Script"=BuildCPMIcons.vbs

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\winnt\system32\drivers\mvstdi5x.sys [12/20/2005 10:38 AM 58464]

R1 Odptdi;Odptdi;c:\winnt\system32\drivers\odptdi.sys [8/27/2008 5:30 AM 46744]

R1 Tb2Device;TB2 Remote Control Driver;NetopiaRC\Tb2Device.sys --> NetopiaRC\Tb2Device.sys [?]

R1 Tb2MirrorSys;TB2 Remote Control Mirror Driver;NetopiaRC\Tb2MirrorSys.sys --> NetopiaRC\Tb2MirrorSys.sys [?]

R2 ALSDrvr;Alesis Disk Driver;c:\winnt\system32\drivers\alsdrvr.sys [9/23/2008 8:55 AM 5119]

R2 tp4serv;tp4serv;c:\program files\Lenovo\TrackPoint\tp4servinst.exe [11/8/2007 8:56 AM 35616]

R3 LuIPSec;Alcatel-Lucent VPN Miniport;c:\winnt\system32\drivers\luipsec.sys [8/27/2009 7:13 AM 320768]

S2 LucentIKE;LucentIKE;c:\program files\IPSec Client\lucentikesvc.exe [8/27/2009 7:13 AM 147456]

S3 blast;blast;c:\winnt\system32\drivers\blast.sys [11/23/2009 2:26 PM 34816]

S3 Drvlw;FTP Software IPTrace NDIS Interface;c:\winnt\system32\drivers\drvlw.sys [3/11/2004 2:28 PM 57280]

S3 GTIPCI21;GTIPCI21;c:\winnt\system32\DRIVERS\gtipci21.sys --> c:\winnt\system32\DRIVERS\gtipci21.sys [?]

S3 OracleOracle8i_localClientCache;OracleOracle8i_localClientCache;c:\program files\oracle8i\bin\ONRSD.EXE [3/11/2004 1:11 PM 411244]

S3 Tp4Track;PS/2 TrackPoint Driver;c:\winnt\system32\drivers\tp4track.sys [11/8/2007 8:56 AM 22568]

S3 UKS11LDR;M-Audio USB Keystation Loader;c:\winnt\system32\drivers\uks11ldr.sys [12/22/2008 6:52 AM 20168]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\PATCH_PKI]

regedit /S c:\winnt\INSTALLER\PATCH_PKI\SecurityAlwaysShowButtons.reg

.

------- Supplementary Scan -------

.

uStart Page = hxxp://aww.usa.alcatel.com/

uInternet Settings,ProxyOverride = *.lucent.com;*.alcatel.com;*.alcatel-lucent.com;<local>

IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office10\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm

DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab

DPF: {093501ce-d290-11d3-a3d6-00c04fa32518}

DPF: {5e2a3510-4371-11d6-b64c-00c04faedb18}

DPF: {ed54a7b0-6c1c-11d5-b63d-00c04faedb18}

FF - ProfilePath - c:\documents and settings\nreece\Application Data\Mozilla\Firefox\Profiles\7bsmuwe0.default\

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll

FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\np32dsw.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npacview.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npbeatnk.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdwf.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJava11.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJava12.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJava13.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJava32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJinit-11813.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJinit-11816.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJinit-11819.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJPI141_02.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPOFFICE.DLL

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPSWF32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winnt\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-nuteruhep - c:\winnt\system32\huvajolu.dll

HKU-Default-Run-calc - c:\docume~1\NETWOR~1\ntuser.dll

SharedTaskScheduler-{491163d2-8664-41b9-91ad-5f7e6333bbdc} - c:\winnt\system32\huvajolu.dll

SSODL-mewibujih-{491163d2-8664-41b9-91ad-5f7e6333bbdc} - c:\winnt\system32\huvajolu.dll

Notify-AtiExtEvent - (no file)

AddRemove-Netscape Communicator 4.79 - c:\winnt\cd32.exe 4.79 (en)

AddRemove-OnNet Host Suite V4.0 - c:\program files\UNINSTAL.EXE

AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

AddRemove-Sonar Producer Edition v4.0.2 - c:\progra~1\Cakewalk\SONAR4~1\UNWISE.EXE

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files:

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(800)

c:\winnt\system32\tphklock.dll

- - - - - - - > 'explorer.exe'(2952)

c:\winnt\system32\btmmhook.dll

c:\winnt\system32\WPDShServiceObj.dll

c:\program files\FTP Software\OnNet Host Suite\ftpns.DLL

c:\program files\FTP Software\OnNet Host Suite\Ftpeng.dll

c:\winnt\system32\ftpappc.dll

c:\winnt\system32\FtpSck2.dll

c:\winnt\system32\Ftpnls32.dll

c:\winnt\system32\ftpmx50.dll

c:\winnt\system32\btncopy.dll

c:\winnt\system32\PortableDeviceTypes.dll

c:\winnt\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\winnt\system32\ibmpmsvc.exe

c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\winnt\System32\SCardSvr.exe

c:\winnt\system32\bgsvcgen.exe

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Network Associates\Common Framework\FrameworkService.exe

c:\program files\IPSec Client\LucentIKE.exe

c:\program files\Network Associates\VirusScan\VsTskMgr.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Network Associates\Common Framework\naPrdMgr.exe

c:\program files\timbuktu pro\tb2launch.exe

c:\winnt\system32\CCM\CcmExec.exe

c:\winnt\system32\msiexec.exe

c:\program files\Network Associates\Common Framework\McTray.exe

c:\program files\timbuktu pro\tb2pro.exe

c:\winnt\system32\rundll32.exe

c:\winnt\system32\igfxsrvc.exe

c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE

c:\program files\timbuktu pro\TNOTIFY.EXE

c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe

c:\winnt\system32\CCM\SMSCliUI.exe

.

**************************************************************************

.

Completion time: 2009-11-24 09:41 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-24 17:41

Pre-Run: 13,681,046,528 bytes free

Post-Run: 22,449,073,664 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /usepmtimers /numproc=1

- - End Of File - - AC57D1278B2B5462424302953DA1AC38

chamber · November 24, 2009

Hi,

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

nreece · November 24, 2009

Hi,
Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

OK. Here is the OLT.txt File

OLT LOG

OTL logfile created on: 11/24/2009 11:17:57 AM - Run 1

OTL by OldTimer - Version 3.1.8.0 Folder = C:\Documents and Settings\nreece\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.36 Mb Total Physical Memory | 542.61 Mb Available Physical Memory | 53.49% Memory free

1.65 Gb Paging File | 1.34 Gb Available in Paging File | 81.74% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 55.88 Gb Total Space | 20.94 Gb Free Space | 37.48% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: USREMNC6621

Current User Name: nreece

NOT logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\nreece\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\WINNT\system32\wbem\wmiprvse.exe (Microsoft Corporation)

PRC - C:\WINNT\system32\CCM\CcmExec.exe (Microsoft Corporation)

PRC - C:\WINNT\system32\CCM\SMSCliUI.exe (Microsoft Corporation)

PRC - C:\Program Files\IPSec Client\lucentike.exe (Alcatel-Lucent)

PRC - C:\Program Files\Lenovo\TrackPoint\tp4servinst.exe (Lenovo Group Limited)

PRC - C:\WINNT\system32\hkcmd.exe (Intel Corporation)

PRC - C:\WINNT\system32\igfxpers.exe (Intel Corporation)

PRC - C:\WINNT\system32\igfxsrvc.exe (Intel Corporation)

PRC - C:\WINNT\explorer.exe (Microsoft Corporation)

PRC - C:\WINNT\system32\ibmpmsvc.exe (Lenovo)

PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )

PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)

PRC - C:\Program Files\Network Associates\Common Framework\UdaterUI.exe (McAfee, Inc.)

PRC - C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe (McAfee, Inc.)

PRC - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (McAfee, Inc.)

PRC - C:\Program Files\Network Associates\Common Framework\Mctray.exe (McAfee, Inc.)

PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )

PRC - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

PRC - C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)

PRC - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)

PRC - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)

PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)

PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

PRC - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

PRC - C:\WINNT\system32\bgsvcgen.exe (B.H.A Corporation)

PRC - C:\Program Files\Network Associates\VirusScan\shstat.exe (Network Associates, Inc.)

PRC - C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)

PRC - C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe (Network Associates, Inc.)

PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)

PRC - C:\Program Files\timbuktu pro\tb2pro.exe (Netopia, Inc.)

PRC - C:\Program Files\timbuktu pro\tb2logon.exe (Netopia, Inc.)

PRC - C:\Program Files\timbuktu pro\tb2launch.exe (Netopia, Inc.)

PRC - C:\Program Files\timbuktu pro\TNotify.exe (Netopia, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\nreece\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)

MOD - C:\WINNT\system32\BtMmHook.dll (Broadcom Corporation.)

MOD - C:\Program Files\ThinkPad\Bluetooth Software\BTKeyInd.dll ()

MOD - C:\WINNT\system32\SynTPFcs.dll (Synaptics, Inc.)

MOD - C:\WINNT\system32\wbem\framedyn.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (FontCache3.0.0.0) -- c:\WINNT\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)

SRV - (idsvc) -- C:\WINNT\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)

SRV - (NetTcpPortSharing) -- C:\WINNT\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (aspnet_state) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)

SRV - (CcmExec) -- C:\WINNT\system32\CCM\CcmExec.exe (Microsoft Corporation)

SRV - (smstsmgr) -- C:\WINNT\System32\CCM\TSManager.exe (Microsoft Corporation)

SRV - (LucentIKE) -- C:\Program Files\IPSec Client\lucentikesvc.exe ()

SRV - (tp4serv) -- C:\Program Files\Lenovo\TrackPoint\tp4servinst.exe (Lenovo Group Limited)

SRV - (IBMPMSVC) -- C:\WINNT\system32\ibmpmsvc.exe (Lenovo)

SRV - (EvtEng) Intel® -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)

SRV - (S24EventMonitor) Intel® -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )

SRV - (RegSrvc) Intel® -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)

SRV - (McAfeeFramework) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (McAfee, Inc.)

SRV - (btwdins) -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)

SRV - (McTaskManager) -- C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)

SRV - (McShield) -- C:\Program Files\Network Associates\VirusScan\Mcshield.exe (Network Associates, Inc.)

SRV - (WMConnectCDS) -- C:\Program Files\Windows Media Connect 2\wmccds.exe (Microsoft Corporation)

SRV - (bgsvcgen) -- C:\WINNT\system32\bgsvcgen.exe (B.H.A Corporation)

SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)

SRV - (Irmon) -- C:\WINNT\system32\irmon.dll (Microsoft Corporation)

SRV - (helpsvc) -- C:\WINNT\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)

SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (Tb2Launch) -- C:\Program Files\timbuktu pro\tb2launch.exe (Netopia, Inc.)

SRV - (OracleOracle8i_localClientCache) -- C:\Program Files\oracle8i\bin\ONRSD.EXE ()

========== Driver Services (SafeList) ==========

DRV - (Tb2MirrorSys) -- File not found

DRV - (Tb2Device) -- File not found

DRV - (catchme) -- File not found

DRV - (blast) -- C:\WINNT\system32\drivers\blast.sys ()

DRV - (ALSDrvr) -- C:\WINNT\system32\drivers\alsdrvr.sys ()

DRV - (PxHelp20) -- C:\WINNT\System32\Drivers\PxHelp20.sys (Sonic Solutions)

DRV - (Cdralw2k) -- C:\WINNT\system32\drivers\cdralw2k.sys (Sonic Solutions)

DRV - (Cdr4_xp) -- C:\WINNT\system32\drivers\cdr4_xp.sys (Sonic Solutions)

DRV - (prepdrvr) -- C:\WINNT\system32\CCM\PrepDrv.sys (Microsoft Corporation)

DRV - (smsmdd) -- C:\WINNT\system32\drivers\smsmdm.sys (Microsoft Corporation)

DRV - (AegisP) AEGIS Protocol (IEEE 802.1x) -- C:\WINNT\system32\drivers\AegisP.sys (Cisco Systems, Inc.)

DRV - (LuIPSec) -- C:\WINNT\system32\drivers\luipsec.sys (Alcatel-Lucent)

DRV - (UKS11LDR) -- C:\WINNT\system32\drivers\uks11ldr.sys (MIDIMAN)

DRV - (MA_CMIDI) -- C:\WINNT\system32\drivers\ma_cmidi.sys (M-Audio)

DRV - (Secdrv) -- C:\WINNT\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (Tp4Track) -- C:\WINNT\system32\drivers\tp4track.sys (Lenovo Group Limited)

DRV - (NETw4x32) Intel® -- C:\WINNT\system32\drivers\NETw4x32.sys (Intel Corporation)

DRV - (s24trans) -- C:\WINNT\system32\drivers\s24trans.sys (Intel Corporation)

DRV - (ialm) -- C:\WINNT\system32\drivers\igxpmp32.sys (Intel Corporation)

DRV - (Odptdi) -- C:\WINNT\system32\drivers\odptdi.sys (Aventail Corporation)

DRV - (IBMPMDRV) -- C:\WINNT\system32\drivers\ibmpmdrv.sys (Lenovo.)

DRV - (pmem) -- C:\WINNT\system32\drivers\pmemnt.sys (Microsoft Corporation)

DRV - (HSF_DPV) -- C:\WINNT\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)

DRV - (HSFHWAZL) -- C:\WINNT\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)

DRV - (winachsf) -- C:\WINNT\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)

DRV - (TcUsb) -- C:\WINNT\system32\drivers\tcusb.sys (UPEK Inc.)

DRV - (e1express) Intel® -- C:\WINNT\system32\drivers\e1e5132.sys (Intel Corporation)

DRV - (NETw3x32) Intel® -- C:\WINNT\system32\drivers\NETw3x32.sys (Intel

nreece · November 24, 2009

OK. Here is the OLT.txt File
OLT LOG
OTL logfile created on: 11/24/2009 11:17:57 AM - Run 1
OTL by OldTimer - Version 3.1.8.0 Folder = C:\Documents and Settings\nreece\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1014.36 Mb Total Physical Memory | 542.61 Mb Available Physical Memory | 53.49% Memory free
1.65 Gb Paging File | 1.34 Gb Available in Paging File | 81.74% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 20.94 Gb Free Space | 37.48% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: USREMNC6621
Current User Name: nreece
NOT logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\nreece\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINNT\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\WINNT\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\WINNT\system32\CCM\CcmExec.exe (Microsoft Corporation)
PRC - C:\WINNT\system32\CCM\SMSCliUI.exe (Microsoft Corporation)
PRC - C:\Program Files\IPSec Client\lucentike.exe (Alcatel-Lucent)
PRC - C:\Program Files\Lenovo\TrackPoint\tp4servinst.exe (Lenovo Group Limited)
PRC - C:\WINNT\system32\hkcmd.exe (Intel Corporation)
PRC - C:\WINNT\system32\igfxpers.exe (Intel Corporation)
PRC - C:\WINNT\system32\igfxsrvc.exe (Intel Corporation)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\WINNT\system32\ibmpmsvc.exe (Lenovo)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Network Associates\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\Program Files\Network Associates\Common Framework\Mctray.exe (McAfee, Inc.)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
PRC - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe (Network Associates, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
PRC - C:\WINNT\system32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\Program Files\Network Associates\VirusScan\shstat.exe (Network Associates, Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
PRC - C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe (Network Associates, Inc.)
PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\timbuktu pro\tb2pro.exe (Netopia, Inc.)
PRC - C:\Program Files\timbuktu pro\tb2logon.exe (Netopia, Inc.)
PRC - C:\Program Files\timbuktu pro\tb2launch.exe (Netopia, Inc.)
PRC - C:\Program Files\timbuktu pro\TNotify.exe (Netopia, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\nreece\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINNT\system32\BtMmHook.dll (Broadcom Corporation.)
MOD - C:\Program Files\ThinkPad\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\WINNT\system32\SynTPFcs.dll (Synaptics, Inc.)
MOD - C:\WINNT\system32\wbem\framedyn.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (FontCache3.0.0.0) -- c:\WINNT\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (idsvc) -- C:\WINNT\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\WINNT\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (aspnet_state) -- C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (CcmExec) -- C:\WINNT\system32\CCM\CcmExec.exe (Microsoft Corporation)
SRV - (smstsmgr) -- C:\WINNT\System32\CCM\TSManager.exe (Microsoft Corporation)
SRV - (LucentIKE) -- C:\Program Files\IPSec Client\lucentikesvc.exe ()
SRV - (tp4serv) -- C:\Program Files\Lenovo\TrackPoint\tp4servinst.exe (Lenovo Group Limited)
SRV - (IBMPMSVC) -- C:\WINNT\system32\ibmpmsvc.exe (Lenovo)
SRV - (EvtEng) Intel

chamber · November 25, 2009

Hi,

Is your McAfee up to date?

1) Scan a file

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
- C:\WINNT\System32\drivers\blast.sys
[*]Click on the Upload button
[*]If a pop-up appears saying the file has been scanned already, please select the ReScan button.
[*]Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
[*]Paste the contents of the Clipboard in your next reply.

2) OTL

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O16 - DPF: {093501ce-d290-11d3-a3d6-00c04fa32518} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {5e2a3510-4371-11d6-b64c-00c04faedb18} Reg Error: Value error. (Oracle JInitiator 1.1.8.18)
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} Reg Error: Value error. (Oracle JInitiator 1.1.8.16)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/...8055.6286111111 (Reg Error: Key error.)
O16 - DPF: {ed54a7b0-6c1c-11d5-b63d-00c04faedb18} Reg Error: Value error. (Reg Error: Value error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
[2009/08/24 09:01:28 | 00,092,672 | ---- | C] () -- C:\WINNT\System32\huvajolu.dll
[2009/08/23 09:51:31 | 00,054,272 | ---- | C] () -- C:\WINNT\System32\dijuboru.dll
[2009/08/27 07:13:30 | 00,038,968 | ---- | C] () -- C:\WINNT\System32\luinst.dll

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

3) Malwarebytes

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

In your reply I would like to see copied and pasted,

1) Online scan results

2) OTL scan

3) Malwarebytes log

nreece · November 25, 2009

Hi,
Is your McAfee up to date?
1) Scan a file
Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
C:\WINNT\System32\drivers\blast.sys
[*]Click on the Upload button
[*]If a pop-up appears saying the file has been scanned already, please select the ReScan button.
[*]Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
[*]Paste the contents of the Clipboard in your next reply.
2) OTL
Run OTL
Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
O16 - DPF: {093501ce-d290-11d3-a3d6-00c04fa32518} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {5e2a3510-4371-11d6-b64c-00c04faedb18} Reg Error: Value error. (Oracle JInitiator 1.1.8.18)
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} Reg Error: Value error. (Oracle JInitiator 1.1.8.16)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/...8055.6286111111 (Reg Error: Key error.)
O16 - DPF: {ed54a7b0-6c1c-11d5-b63d-00c04faedb18} Reg Error: Value error. (Reg Error: Value error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
[2009/08/24 09:01:28 | 00,092,672 | ---- | C] () -- C:\WINNT\System32\huvajolu.dll
[2009/08/23 09:51:31 | 00,054,272 | ---- | C] () -- C:\WINNT\System32\dijuboru.dll
[2009/08/27 07:13:30 | 00,038,968 | ---- | C] () -- C:\WINNT\System32\luinst.dll

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
3) Malwarebytes
Please download Malwarebytes' Anti-Malware from Here.
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.
In your reply I would like to see copied and pasted,
1) Online scan results
2) OTL scan
3) Malwarebytes log

Thank you so much...it looks like all malware has now been removed. Yes, my Macafee defs are up to date. they update daily. I'm attaching the logs you requested for confirmation. OTL and MBAM will be in a seperate post.

1) Online scan results

VirSCAN.org Scanned Report :

Scanned time : 2009/11/26 04:34:45 (CST)

Scanner results: Scanners did not find malware!

File Name : blast.sys

File Size : 34816 byte

File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit

MD5 : 60ac082b41e60906171335dfbf8c19c0

SHA1 : 26b0961cc7853afa4746fd0f6467dd2ea824640c

Online report : http://virscan.org/report/c110013c21adea26...a0d89cd849.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result

a-squared 4.5.0.8 20091126033123 2009-11-26 4.00 -

AhnLab V3 2009.11.26.00 2009.11.26 2009-11-26 0.94 -

AntiVir 8.2.1.78 7.10.1.106 2009-11-25 0.06 -

Antiy 2.0.18 20091125.3312390 2009-11-25 0.12 -

Arcavir 2009 200911251307 2009-11-25 0.03 -

Authentium 5.1.1 200911241603 2009-11-24 1.29 -

AVAST! 4.7.4 091125-1 2009-11-25 0.01 -

AVG 8.5.288 270.14.82/2525 2009-11-25 0.32 -

BitDefender 7.81008.4600139 7.29136 2009-11-26 3.92 -

CA (VET) 35.1.0 7141 2009-11-24 7.56 -

ClamAV 0.95.2 10070 2009-11-26 0.01 -

Comodo 3.12 3034 2009-11-25 0.72 -

CP Secure 1.3.0.5 2009.11.26 2009-11-26 0.05 -

Dr.Web 4.44.0.9170 2009.11.25 2009-11-25 7.19 -

F-Prot 4.4.4.56 20091124 2009-11-24 1.28 -

F-Secure 7.02.73807 2009.11.25.13 2009-11-25 0.23 -

Fortinet 11.93- 11.93 2009-11-25 0.14 -

GData 19.8998/19.585 20091125 2009-11-25 5.55 -

ViRobot 20091125 2009.11.25 2009-11-25 0.41 -

Ikarus T3.1.01.74 2009.11.25.74593 2009-11-25 4.12 -

JiangMin 11.0.800 2009.11.25 2009-11-25 4.11 -

Kaspersky 5.5.10 2009.11.25 2009-11-25 0.11 -

KingSoft 2009.2.5.15 2009.11.25.20 2009-11-25 0.51 -

McAfee 5.3.00 5813 2009-11-25 3.44 -

Microsoft 1.5302 2009.11.24 2009-11-24 6.07 -

Norman 6.01.09 6.01.00 2009-11-25 4.01 -

Panda 9.05.01 2009.11.25 2009-11-25 1.74 -

Trend Micro 9.000-1003 6.652.02 2009-11-25 0.03 -

Quick Heal 10.00 2009.11.25 2009-11-25 1.24 -

Rising 20.0 22.23.02.09 2009-11-25 0.98 -

Sophos 3.01.0 4.47 2009-11-26 3.02 -

Sunbelt 5518 5518 2009-11-18 1.84 -

Symantec 1.3.0.24 20091125.004 2009-11-25 0.22 -

nProtect 20091125.01 6330100 2009-11-25 3.55 -

The Hacker 6.5.0.2 v00076 2009-11-23 0.76 -

VBA32 3.12.12.0 20091124.2139 2009-11-24 2.14 -

VirusBuster 4.5.11.10 10.113.29/2005008 2009-11-25 2.37 -

nreece · November 25, 2009

2) OTL scan

OTL logfile created on: 11/25/2009 1:07:37 PM - Run 2

OTL by OldTimer - Version 3.1.8.0 Folder = C:\Documents and Settings\nreece\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.36 Mb Total Physical Memory | 631.71 Mb Available Physical Memory | 62.28% Memory free

1.65 Gb Paging File | 1.38 Gb Available in Paging File | 83.64% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files

Drive C: | 55.88 Gb Total Space | 21.19 Gb Free Space | 37.92% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

Drive F: | 7.46 Gb Total Space | 3.39 Gb Free Space | 45.39% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: USREMNC6621

Current User Name: nreece

NOT logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 14 Days

Output = Minimal

Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\nreece\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\WINNT\system32\wbem\wmiprvse.exe (Microsoft Corporation)

PRC - C:\WINNT\system32\CCM\CcmExec.exe (Microsoft Corporation)

PRC - C:\Program Files\IPSec Client\lucentike.exe (Alcatel-Lucent)

PRC - C:\Program Files\IPSec Client\lucentikesvc.exe ()

PRC - C:\Program Files\IPSec Client\trayicon.exe (Alcatel-Lucent)