Constant Re-infections & IP Blocks

VectorForce · September 6, 2010

Hey There,

For the past month and a half this computer has been constantly alerting to blocked IPs and, despite running the paid version of MBAM, we also keep getting reinfected with things. The full scans, however, never stop the ip block notices. Below is DDS, most recent mbam scan, and today's protection log.

==============================

=========== DDS: START ==========

==============================

DDS (Ver_10-03-17.01) - NTFSx86

Run by Owner at 9:48:38.73 on Mon 09/06/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.991.305 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\xampp\apache\bin\httpd.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\xampp\mysql\bin\mysqld.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\SanDisk\Sansa Updater\SansaSvr.exe

C:\xampp\apache\bin\httpd.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Free Ride Games\GPlayer.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\NETGEAR\WG111v2\WG111v2.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Documents and Settings\Owner\Desktop\Defogger.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:5643

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [cdloader] "c:\documents and settings\owner\application data\mjusbsp\cdloader2.exe" MAGICJACK

uRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup

uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [soundMan] SOUNDMAN.EXE

mRun: [eTrustPPAP] "c:\program files\ca\etrust pestpatrol\PPActiveDetection.exe"

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

dRun: [Exetender] "c:\program files\free ride games\GPlayer.exe /runonstartup"

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v2\WG111v2.exe

IE: &Search

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll

DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {A8683C98-5341-421B-B23C-8514C05354F1} - hxxp://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\tzqc20ug.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp

FF - prefs.js: keyword.URL - hxxp://search.search-star.net/?sid=10101036100&s=

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\owner\application data\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll

FF - plugin: c:\program files\free ride games\npExentCtl.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npstrlnk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - Google

FF - user.js: browser.search.order.1 - Google

FF - user.js: keyword.URL - hxxp://search.search-star.net/?sid=10101036100&s=c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2010-7-22 29416]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2008-12-31 304464]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R2 X4HSX32Ex;X4HSX32Ex;c:\program files\free ride games\X4HSX32Ex.sys [2008-11-4 29856]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-12-31 20952]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-31 38224]

S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2010-6-20 272128]

=============== Created Last 30 ================

2010-09-02 23:24:43 0 d-----w- c:\program files\Ask.com

2010-09-02 23:23:55 0 d-----w- c:\program files\BitTorrent

2010-08-21 01:07:42 221 ----a-w- c:\windows\NCLogConfig.ini

2010-08-18 23:58:58 0 d-----w- c:\program files\MSECache

2010-08-13 05:09:27 183 ----a-w- c:\windows\system32\MRT.INI

2010-08-13 05:09:25 0 d-----w- c:\windows\system32\MpEngineStore

2010-08-11 00:19:32 54156 ---ha-w- c:\windows\QTFont.qfn

2010-08-11 00:19:32 1409 ----a-w- c:\windows\QTFont.for

==================== Find3M ====================

2010-08-17 21:21:57 43596 ----a-w- c:\docume~1\owner\applic~1\wklnhst.dat

2010-07-22 04:13:48 4224 ----a-w- c:\windows\system32\drivers\rdpcdd.sys

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

2008-11-11 06:07:41 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008111120081112\index.dat

============= FINISH: 9:49:43.10 ===============

==============================

=========== MBAM: START ==========

==============================

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4554

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

9/6/2010 9:41:22 AM

mbam-log-2010-09-06 (09-41-22).txt

Scan type: Quick scan

Objects scanned: 169731

Time elapsed: 20 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

==============================

=========== PROTECTION: START ====

==============================

00:01:23 Owner IP-BLOCK 221.192.199.48

00:05:20 Owner IP-BLOCK 221.192.199.48

00:11:22 Owner IP-BLOCK 221.192.199.46

00:13:30 Owner IP-BLOCK 221.192.199.48

00:15:35 Owner IP-BLOCK 221.192.199.46

00:17:32 Owner IP-BLOCK 221.192.199.48

00:19:41 Owner IP-BLOCK 221.192.199.46

00:21:36 Owner IP-BLOCK 221.192.199.48

00:25:38 Owner IP-BLOCK 221.192.199.48

00:29:40 Owner IP-BLOCK 221.192.199.48

00:37:43 Owner IP-BLOCK 221.192.199.48

00:41:51 Owner IP-BLOCK 221.192.199.48

00:44:33 Owner IP-BLOCK 221.192.199.46

00:49:57 Owner IP-BLOCK 221.192.199.48

00:54:03 Owner IP-BLOCK 221.192.199.48

00:58:09 Owner IP-BLOCK 221.192.199.48

01:01:01 Owner IP-BLOCK 221.192.199.46

01:02:08 Owner IP-BLOCK 221.192.199.48

01:04:21 Owner IP-BLOCK 59.34.197.214

01:05:03 Owner IP-BLOCK 221.192.199.46

01:11:06 Owner IP-BLOCK 125.45.109.166

01:11:07 Owner IP-BLOCK 125.45.109.166

01:14:14 Owner IP-BLOCK 221.192.199.48

01:29:57 Owner IP-BLOCK 221.192.199.46

01:34:35 Owner IP-BLOCK 221.192.199.48

01:38:41 Owner IP-BLOCK 221.192.199.48

01:42:58 Owner IP-BLOCK 221.192.199.48

01:47:06 Owner IP-BLOCK 221.192.199.48

01:58:44 Owner IP-BLOCK 221.192.199.46

02:02:49 Owner IP-BLOCK 221.192.199.46

02:06:58 Owner IP-BLOCK 221.192.199.46

02:07:24 Owner IP-BLOCK 221.192.199.48

02:19:21 Owner IP-BLOCK 221.192.199.46

02:23:40 Owner IP-BLOCK 221.192.199.48

02:31:51 Owner IP-BLOCK 221.192.199.46

02:36:04 Owner IP-BLOCK 221.192.199.46

02:48:20 Owner IP-BLOCK 221.192.199.46

02:56:37 Owner IP-BLOCK 221.192.199.46

03:00:11 Owner IP-BLOCK 221.192.199.48

03:12:51 Owner IP-BLOCK 221.192.199.48

03:17:01 Owner IP-BLOCK 221.192.199.48

03:21:07 Owner IP-BLOCK 221.192.199.48

03:29:17 Owner IP-BLOCK 221.192.199.48

03:29:25 Owner IP-BLOCK 221.192.199.46

03:41:46 Owner IP-BLOCK 221.192.199.46

03:49:56 Owner IP-BLOCK 221.192.199.48

03:58:25 Owner IP-BLOCK 221.192.199.46

04:10:56 Owner IP-BLOCK 221.192.199.46

04:15:08 Owner IP-BLOCK 221.192.199.46

04:31:37 Owner IP-BLOCK 221.192.199.46

04:35:45 Owner IP-BLOCK 221.192.199.46

04:39:09 Owner IP-BLOCK 66.96.251.11

04:39:52 Owner IP-BLOCK 221.192.199.48

04:48:07 Owner IP-BLOCK 221.192.199.46

04:52:17 Owner IP-BLOCK 221.192.199.46

04:56:18 Owner IP-BLOCK 221.192.199.48

04:56:29 Owner IP-BLOCK 221.192.199.46

05:00:37 Owner IP-BLOCK 221.192.199.46

05:04:30 Owner IP-BLOCK 221.192.199.48

05:20:52 Owner IP-BLOCK 221.192.199.48

05:41:12 Owner IP-BLOCK 221.192.199.48

05:50:04 Owner IP-BLOCK 221.192.199.46

05:53:18 Owner IP-BLOCK 221.192.199.48

05:54:05 Owner IP-BLOCK 221.192.199.46

05:57:23 Owner IP-BLOCK 221.192.199.48

06:05:31 Owner IP-BLOCK 221.192.199.48

06:13:39 Owner IP-BLOCK 221.192.199.48

06:18:49 Owner IP-BLOCK 221.192.199.46

06:21:41 Owner IP-BLOCK 221.192.199.48

06:25:42 Owner IP-BLOCK 221.192.199.48

06:29:44 Owner IP-BLOCK 221.192.199.48

06:33:46 Owner IP-BLOCK 221.192.199.48

06:35:28 Owner IP-BLOCK 221.192.199.46

06:37:50 Owner IP-BLOCK 221.192.199.48

06:58:21 Owner IP-BLOCK 221.192.199.48

07:02:29 Owner IP-BLOCK 221.192.199.48

07:16:42 Owner IP-BLOCK 221.192.199.46

07:22:47 Owner IP-BLOCK 221.192.199.48

07:25:01 Owner IP-BLOCK 221.192.199.46

07:26:53 Owner IP-BLOCK 221.192.199.48

07:45:52 Owner IP-BLOCK 221.192.199.46

07:51:49 Owner IP-BLOCK 221.192.199.48

07:58:20 Owner IP-BLOCK 221.192.199.46

08:04:16 Owner IP-BLOCK 221.192.199.48

08:08:20 Owner IP-BLOCK 221.192.199.48

08:12:26 Owner IP-BLOCK 221.192.199.48

08:19:06 Owner IP-BLOCK 221.192.199.46

08:20:34 Owner IP-BLOCK 221.192.199.48

08:23:12 Owner IP-BLOCK 221.192.199.46

08:24:41 Owner IP-BLOCK 221.192.199.48

08:28:48 Owner IP-BLOCK 221.192.199.48

08:34:59 Owner IP-BLOCK 221.192.199.35

08:35:10 Owner IP-BLOCK 221.192.199.35

08:48:01 Owner IP-BLOCK 221.192.199.46

08:49:12 Owner IP-BLOCK 221.192.199.48

08:56:19 Owner IP-BLOCK 221.192.199.46

09:05:27 Owner IP-BLOCK 221.192.199.48

09:08:51 Owner IP-BLOCK 221.192.199.46

09:09:30 Owner IP-BLOCK 221.192.199.48

09:12:58 Owner IP-BLOCK 221.192.199.46

09:13:38 Owner IP-BLOCK 221.192.199.48

09:17:45 Owner IP-BLOCK 221.192.199.48

Attach.txt

RPMcMurphy · September 7, 2010

Hello and welcome to Malwarebytes. Please follow these guidelines while we work on your PC:

[*]Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I

VectorForce · September 9, 2010

Thanks. Here are the results:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>Drivers

==============================================

0xF683D000 C:\WINDOWS\system32\drivers\ALCXWDM.SYS 3805184 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))

0xBF012000 C:\WINDOWS\System32\SiSGRV.dll 2633728 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)

0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2066816 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2066816 bytes

0x804D7000 RAW 2066816 bytes

0x804D7000 WMIxWDM 2066816 bytes

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xF73C2000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xF3569000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xF676F000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xF3676000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xF2F37000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xF265F000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xF6C29000 C:\WINDOWS\system32\DRIVERS\sisgrp.sys 253952 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)

0xF74F3000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xF307E000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xF7395000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF1716000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xF35D9000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xF364E000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF3543000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xF1C93000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xF6819000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xF67F5000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xF6BDE000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xF362C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x806D0000 ACPI_HAL 131840 bytes

0x806D0000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF748B000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF74C3000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xF737B000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF74AB000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xF348B000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xF1741000 C:\DOCUME~1\Owner\LOCALS~1\Temp\kgtdykob.sys 94208 bytes

0xF7462000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xF67DE000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xF2970000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xF6C01000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xF6C15000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xF36CF000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xF744F000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF7479000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xF2DE5000 C:\WINDOWS\system32\drivers\tmcomm.sys 73728 bytes (Trend Micro Inc., TrendMicro Common Module)

0xF74E2000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xF67CD000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xF76D2000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xF7792000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF7772000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xF77B2000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xF77A2000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xF29CD000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF7852000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF7662000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF6CC7000 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 53248 bytes (HP, IEEE-1284.4-1999 Driver (Windows 2000))

0xF7762000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xF77D2000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF7642000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xF7682000 gagp30kx.sys 49152 bytes (Microsoft Corporation, MS Generic AGPv3.0 Filter for K8/9 Processor Platforms)

0xF77F2000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF6CF7000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF7782000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF7632000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF77E2000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF7622000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF7842000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF7812000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF7652000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF7892000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xF237D000 C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)

0xF7802000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF76B2000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xF20B5000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xF77C2000 C:\WINDOWS\system32\DRIVERS\processr.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)

0xF7672000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xF6CD7000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF24B7000 C:\WINDOWS\system32\drivers\mbamswissarmy.sys 32768 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)

0xF78FA000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF7A02000 C:\WINDOWS\system32\DRIVERS\sisnic.sys 32768 bytes (SiS Corporation, SiS PCI Fast Ethernet Adapter Driver)

0xF7902000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)

0xF79FA000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xF79EA000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xF78E2000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xF78A2000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF7912000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)

0xF790A000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)

0xF791A000 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 24576 bytes (HP, 1284.4<->Usb Datalink Driver (Windows 2000))

0xF79E2000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF7A22000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xF78EA000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF793A000 C:\Program Files\Free Ride Games\X4HSX32Ex.Sys 24576 bytes (Exent Technologies Ltd., X4HSX32Ex Kernel Mode Driver)

0xF7972000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)

0xF7A2A000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xF78F2000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF78AA000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF7A12000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF7A1A000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF7A0A000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xF79F2000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)

0xF792A000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xF2417000 C:\WINDOWS\system32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver)

0xF7AF6000 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 16384 bytes (HP, IEEE-1284.4-1999 Print Class Driver)

0xF343B000 C:\WINDOWS\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)

0xF718C000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xF32DB000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF7B1E000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF7AF2000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)

0xF7A32000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xF3702000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xF7ACE000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xF7AEE000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xF719C000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xF7AD6000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF7ADA000 C:\WINDOWS\system32\DRIVERS\srvkp.sys 12288 bytes (Silicon Integrated Systems Corporation, SiS VGA Driver Manager)

0xF7B70000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF7B7C000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xF7B6E000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF7B22000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF7B72000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF7B74000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF7B68000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF7B6C000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7B24000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF7D0D000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7C94000 C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS 4096 bytes (Sonic Solutions, CDR4 CD and DVD Place Holder Driver (see PxHelp))

0xF7CEF000 C:\WINDOWS\System32\Drivers\Cdralw2k.SYS 4096 bytes (Sonic Solutions, CDRAL Place Holder Driver (see PxHelp))

0xF7D65000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xF7CF0000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xF7BEA000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

==============================================

>Stealth

==============================================

0x04FE0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x86119C30 ] PID: 2916, 507904 bytes

0x04CA0000 Hidden Image-->ESCliWicMDRW.esx [ EPROCESS 0x86119C30 ] PID: 2916, 761856 bytes

==============================================

>Files

==============================================

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tzqc20ug.default\Cache\0BC99A66d01

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tzqc20ug.default\Cache\42BCA7C5d01

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tzqc20ug.default\Cache\625F12B3d01

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tzqc20ug.default\Cache\7C0B4A89d01

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-24

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-25

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-26

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-27

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-28

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-29

!-->[Hidden] C:\Documents and Settings\Owner\Local Settings\Temp\plugtmp-108\plugin-trillian-30

==============================================

>Hooks

==============================================

ntkrnlpa.exe+0x0006AA9A, Type: Inline - RelativeJump 0x80541A9A-->80541AA1 [ntkrnlpa.exe]

[2456]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]

[2456]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]

[2456]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]

[2456]explorer.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]

[2456]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]

[2456]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]

[2456]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->00000000 [shimeng.dll]

[2456]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]

[2676]plugin-container.exe-->user32.dll-->TrackPopupMenu, Type: Inline - RelativeJump 0x7E46531E-->00000000 [xul.dll]

[5400]firefox.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C9163C3-->00000000 [firefox.exe]

RPMcMurphy · September 10, 2010

VectorForce:

P2P - I see you have P2P software (BitTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Please see this post for more information. I recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at MBAM are complete.

Download Combofix from either of the links below, and save it to your desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your desktop**

Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DDS::

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5643
uInternet Settings,ProxyOverride = <local>

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

VectorForce · September 10, 2010

Here are the contents of log.txt, which popped up after completion:

ComboFix 10-09-09.04 - Owner 09/10/2010 16:08:34.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.991.310 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Owner\LOCALS~1\Temp\tmp2.tmp

c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk

c:\program files\Mozilla Firefox\searchplugins\google_search.xml

C:\Thumbs.db

c:\windows\1002s9eaz1985.ocx

c:\windows\10129noz-a-viru5d.dll

c:\windows\1052zno9-a-virus609.exe

c:\windows\106z1v5rus49.exe

c:\windows\11359noz-a-virus97e.dll

c:\windows\1155backd9or1390z.dll

c:\windows\11571t9oj15fz.bin

c:\windows\1159tzreat21092.dll

c:\windows\11997szamb9t597.bin

c:\windows\12596vzrus267.bin

c:\windows\13352troj9z2.bin

c:\windows\13955noz-a-virus937.exe

c:\windows\14177ha9ktzol75a.exe

c:\windows\14832not-9-vzrus3de5.dll

c:\windows\14cad9wa5e1074z.dll

c:\windows\15189s9563z.exe

c:\windows\1547zpa59e1113.ocx

c:\windows\156f9hrezt25056.bin

c:\windows\15794tzojf5.cpl

c:\windows\15835z9oj2a5.exe

c:\windows\1590spy52z9.exe

c:\windows\15e1spa9ze2773.dll

c:\windows\15f95zarse1659.ocx

c:\windows\1629spywa5ez258.dll

c:\windows\16472not-a-v95us405z.ocx

c:\windows\16514worz9fb.bin

c:\windows\1679a5d9are56z.bin

c:\windows\168119py4z15.cpl

c:\windows\1697459oj3z1.dll

c:\windows\16z43sp9775.dll

c:\windows\16z82h59ktoold4.cpl

c:\windows\17119szyc5.dll

c:\windows\17373not-a-ziru9452.ocx

c:\windows\1738back5oor2922z.bin

c:\windows\1747adz5are1194.dll

c:\windows\17529trz51ae.dll

c:\windows\1773hzcktool915.exe

c:\windows\177z8n5t-a-vir9s79d.cpl

c:\windows\18950tzojc9.cpl

c:\windows\18990vi95z1b.bin

c:\windows\1917dow9lzader2529.dll

c:\windows\19219zt-a-virus154.cpl

c:\windows\19243szambot7c5.dll

c:\windows\19291z5ambot9e.cpl

c:\windows\19355spa95ot5z6.dll

c:\windows\19756sp9mbot15az.bin

c:\windows\1979vi5us79fz.cpl

c:\windows\19899hac5tool1az.cpl

c:\windows\1993th5eat326z.cpl

c:\windows\19972spambo92f5z.dll

c:\windows\1997z9o5-a-virus5e1.dll

c:\windows\199faddzare5644.exe

c:\windows\199z3s5y6a9.bin

c:\windows\19z4steal2509.exe

c:\windows\19z59hack5ool529.exe

c:\windows\1a7c59zeat21508.exe

c:\windows\1dzespyw9re1573.ocx

c:\windows\1dzfste9l27775.ocx

c:\windows\1ebezownl5ade9951.cpl

c:\windows\1ee1stea9564z.cpl

c:\windows\1f5zsp9ware2292.dll

c:\windows\1z446s5ambot359.ocx

c:\windows\1z6c5ir2919.exe

c:\windows\1z8a9t5al2374.dll

c:\windows\1zc0vi59086.cpl

c:\windows\20329worm95z.exe

c:\windows\2049s5yz19.cpl

c:\windows\20591spam9ot1z3.bin

c:\windows\205z5w5rm6a9.cpl

c:\windows\20z75n9t-a-virus290.exe

c:\windows\2167z5o9m48b.dll

c:\windows\21775s9zmbot2ba.exe

c:\windows\2198tzi5f2315.dll

c:\windows\23715z9rus4f4.ocx

c:\windows\23ad5pywar926z1.bin

c:\windows\24059hacktzo9533.cpl

c:\windows\2434v5zus1049.dll

c:\windows\245135orm9e7z.dll

c:\windows\24563worm7cz9.dll

c:\windows\24885noz-a-virus945.bin

c:\windows\24z6s9yware528.dll

c:\windows\2549not-azviru5770.cpl

c:\windows\255465azkt9ol659.bin

c:\windows\25587spzmb9t660.exe

c:\windows\256959p55ze.ocx

c:\windows\25a9thzeat28656.dll

c:\windows\25d5bazkdoor3196.exe

c:\windows\260zt59ef2917.ocx

c:\windows\26185not-azvirus9c1.bin

c:\windows\26819tzoj6f5.dll

c:\windows\26925zroj385.dll

c:\windows\26957no5-a-virzs2c9.ocx

c:\windows\27451t9ojbcz.cpl

c:\windows\2786wzrm5e9.cpl

c:\windows\278a5parse9z0.cpl

c:\windows\28005hac9tozl94.exe

c:\windows\2831ztro56eb9.ocx

c:\windows\285z65py189.ocx

c:\windows\287z9wor95d.exe

c:\windows\28z30hack95ol4d0.dll

c:\windows\29034viru528z.exe

c:\windows\2935spambot56fz.exe

c:\windows\2941st5az1973.exe

c:\windows\2955s5arsez098.exe

c:\windows\29779trojz965.dll

c:\windows\297zac5tool4c4.ocx

c:\windows\29821spa5bot9fz.bin

c:\windows\298es5ywarez337.cpl

c:\windows\299z5h9cktool419.ocx

c:\windows\2a9as5zrse721.bin

c:\windows\2d9fthizf854.exe

c:\windows\30568not-a-9irusz46.ocx

c:\windows\3065ztroj9ad.cpl

c:\windows\3074n9t-a-zi5us385.exe

c:\windows\30965zirus327.exe

c:\windows\31323not-a-vzru5319.bin

c:\windows\31547hzcktool798.bin

c:\windows\31785spambo926z.ocx

c:\windows\31908zir5s75f.dll

c:\windows\322z8v9r5s4f5.ocx

c:\windows\329athie59z04.dll

c:\windows\3360n9t-5-vzrus247.exe

c:\windows\3412hazk5ool109.bin

c:\windows\35011worm349z.cpl

c:\windows\351fszeal5689.bin

c:\windows\3555zacktooldf9.dll

c:\windows\3590ztroj6a8.cpl

c:\windows\38785zoj4d59.bin

c:\windows\387zbackdoo511379.bin

c:\windows\3899viz3205.dll

c:\windows\39015virus7cz.bin

c:\windows\39125t9al24z9.dll

c:\windows\3928stea53z43.exe

c:\windows\3955steal9256z.ocx

c:\windows\3974th5ez648.exe

c:\windows\39z75worm78.ocx

c:\windows\3a3ddownl5ader1961z.cpl

c:\windows\3czast5al2829.bin

c:\windows\3e06doznl9ader32085.ocx

c:\windows\3e61add9zre1951.exe

c:\windows\3eadspar9e157z.cpl

c:\windows\3z195ac9tool473.bin

c:\windows\3z5995orm4a.exe

c:\windows\3z891spamb95db.cpl

c:\windows\3z9sparse16075.bin

c:\windows\3ze59hi5f568.dll

c:\windows\403659ambot1z.ocx

c:\windows\4046s5zrse79.cpl

c:\windows\410es9yware170z5.ocx

c:\windows\4182zp5wa9e3004.dll

c:\windows\4235tzi9f411.exe

c:\windows\42cfszy9are5257.exe

c:\windows\44775zr24209.bin

c:\windows\4579zhreat10979.cpl

c:\windows\4599zirus55.bin

c:\windows\459ethief42z.bin

c:\windows\45f5zteal2559.cpl

c:\windows\464zt9ief405.bin

c:\windows\46z3wor59c9.cpl

c:\windows\4720sp5mbzt259.exe

c:\windows\474es9yware10z65.bin

c:\windows\4879addwar589z.dll

c:\windows\490edow5loadez1603.ocx

c:\windows\4912hacktoo510z.bin

c:\windows\4a45ad5war942z.ocx

c:\windows\4c125zdwar91258.exe

c:\windows\4dc9z5r996.bin

c:\windows\4dcdbac9d5oz2562.bin

c:\windows\4df5szea59956.cpl

c:\windows\5081spz149.cpl

c:\windows\50d49ddwz5e1376.cpl

c:\windows\5139spars5z591.cpl

c:\windows\51690not-azvirus1c8.ocx

c:\windows\5225zir1429.ocx

c:\windows\52495ddware90z.dll

c:\windows\5250z9yware82.cpl

c:\windows\5262v9rusz72.bin

c:\windows\5265downloader965z.cpl

c:\windows\52b4downl9aderz529.cpl

c:\windows\52z5addware24299.ocx

c:\windows\53163zpy9c.bin

c:\windows\53467wzrm992.dll

c:\windows\54adba9zdoor34.bin

c:\windows\5519thief92z5.exe

c:\windows\555c9ownloader6z2.exe

c:\windows\555estzal9653.ocx

c:\windows\5563downlozder32669.dll

c:\windows\557notza-v9rus24d5.bin

c:\windows\55803zackt9ol626.exe

c:\windows\5580zro943a5.exe

c:\windows\55z3virus595.exe

c:\windows\56329v9rzs185.bin

c:\windows\5750zo9-a-virus58c.bin

c:\windows\57995spy19z.dll

c:\windows\585thizf1490.dll

c:\windows\587cszeal2499.exe

c:\windows\58953virusbz.bin

c:\windows\5895bzck5oor3196.ocx

c:\windows\58b9ad9ware3596z.bin

c:\windows\59549worz1af9.ocx

c:\windows\5957tro59az.exe

c:\windows\5959th5ef2z80.ocx

c:\windows\5959troj5z2.ocx

c:\windows\5970wozmb9.ocx

c:\windows\59a9thzeat6802.dll

c:\windows\59e1s9ywarez385.bin

c:\windows\59z45pyware2891.bin

c:\windows\5b9szar5e18169.cpl

c:\windows\5ba59zckdoor2436.exe

c:\windows\5bdbackdooz25949.bin

c:\windows\5cb8sparze5199.cpl

c:\windows\5d06zo95loader924.bin

c:\windows\5d509tealz669.bin

c:\windows\5d67t9iefz554.cpl

c:\windows\5d7csp9ware35z6.dll

c:\windows\5d975hr9at1952z.dll

c:\windows\5e31b9c5zoor1221.bin

c:\windows\5e71spywar928z7.dll

c:\windows\5f43thze92568.bin

c:\windows\5f59zte5l1831.bin

c:\windows\5fe9spa95ez2.cpl

c:\windows\5z4et9ie52736.ocx

c:\windows\5zcthreat302019.ocx

c:\windows\6059baczdoor798.bin

c:\windows\60z69te5l2374.bin

c:\windows\6156z5ambot559.cpl

c:\windows\615aaddwz9e250.bin

c:\windows\635dadzw9r53080.bin

c:\windows\6393zor5469.ocx

c:\windows\639z5orm5c9.bin

c:\windows\640cstezl1975.dll

c:\windows\659zs5eal2876.ocx

c:\windows\65zdadd9are2947.exe

c:\windows\6616w5rmz09.cpl

c:\windows\6791virusf5z.dll

c:\windows\68z7v9r2575.dll

c:\windows\6958down9oadez1876.ocx

c:\windows\69bbtzi9f10385.dll

c:\windows\6a9dback5oor13z9.dll

c:\windows\6b63zackdoo52698.exe

c:\windows\6b8zspars91553.ocx

c:\windows\6czdvi59959.bin

c:\windows\6d9bzhi5f2687.ocx

c:\windows\6de9t5izf123.ocx

c:\windows\6decth5eat11897z.exe

c:\windows\6e82szarse9519.bin

c:\windows\6e89st5al2z93.dll

c:\windows\6z0fthr9at15112.bin

c:\windows\6z2bsp5rse9207.ocx

c:\windows\6z5bs5ywar92721.bin

c:\windows\715at9reat276z2.dll

c:\windows\71c5downloade519z5.cpl

c:\windows\749bt5reaz11932.dll

c:\windows\74d3thzef559.cpl

c:\windows\7535spa9bot646z.ocx

c:\windows\75bethz9at17540.exe

c:\windows\761bst5a924z7.dll

c:\windows\7651troj6z39.ocx

c:\windows\769d5wnloader3z35.exe

c:\windows\76f89ddw5ze613.bin

c:\windows\77bzs5arse1696.cpl

c:\windows\77dzsteal1695.bin

c:\windows\780zdownloa5er2977.dll

c:\windows\7859bazkdoor30295.ocx

c:\windows\789baczdoo9535.ocx

c:\windows\78a5v9r11z1.ocx

c:\windows\7986sz9mbot75c.exe

c:\windows\79zdspars52569.ocx

c:\windows\7a6zspar9e5108.cpl

c:\windows\7b9zthief2857.dll

c:\windows\7cesza5se25599.bin

c:\windows\7d20zown5oad9r318.cpl

c:\windows\7d4ds9arsz675.cpl

c:\windows\7d96thz5f2451.bin

c:\windows\7e03zhr9at15591.dll

c:\windows\7z9hacktoo515d.dll

c:\windows\7zd29teal5192.bin

c:\windows\8014s5amzo95dd.dll

c:\windows\86359irus5dz.cpl

c:\windows\875back59or8z0.cpl

c:\windows\897zwor53e9.dll

c:\windows\9022s5arse3z60.ocx

c:\windows\9055zvirus3d.bin

c:\windows\9150s5zrse1453.bin

c:\windows\922bsparsz353.exe

c:\windows\9272szeal615.bin

c:\windows\92795zoj41e.cpl

c:\windows\929695rm393z.bin

c:\windows\9345virus1z4.bin

c:\windows\9393a5dzare2727.dll

c:\windows\9463noz5a-viru9567.exe

c:\windows\947troz5f5.ocx

c:\windows\9529szy4f5.bin

c:\windows\959sparse1779z.ocx

c:\windows\96z9viru57db.ocx

c:\windows\972z2not-a-vi5us5b7.exe

c:\windows\97z27worm25b.exe

c:\windows\9845spambot5z0.exe

c:\windows\9895irz207.cpl

c:\windows\98c9tzreat1573.dll

c:\windows\996no5-a-vi9us67z.bin

c:\windows\9a69thief756z.exe

c:\windows\9a95st5al9z.exe

c:\windows\9c08stezl12105.ocx

c:\windows\9d38v5r26z6.cpl

c:\windows\9d9s5arse242z.cpl

c:\windows\9ef3doz5loader2280.exe

c:\windows\9f965aczdoor1688.ocx

c:\windows\9z33troj325.dll

c:\windows\9z590tro5479.exe

c:\windows\9z9thief2520.dll

c:\windows\a1e5pazse1599.ocx

c:\windows\b59spzrs5902.cpl

c:\windows\b6e5pywa9ez68.ocx

c:\windows\b96vi5599z.dll

c:\windows\be59ir1734z.exe

c:\windows\c53st9al6z3.dll

c:\windows\c9fdzwnloa5er3179.dll

c:\windows\e9zsp5ware2254.dll

c:\windows\ea1stea519z1.bin

c:\windows\f5bzir27279.cpl

c:\windows\f95stezl2340.bin

c:\windows\fzfthief95085.ocx

c:\windows\system32\10459viruz6c5.cpl

c:\windows\system32\10658no9-azv5rus608.ocx

c:\windows\system32\10964spambotzef5.exe

c:\windows\system32\10z645orm796.ocx

c:\windows\system32\1175zvirus7559.ocx

c:\windows\system32\12440viruz659.ocx

c:\windows\system32\12a0threzt236059.cpl

c:\windows\system32\12z53tro975b.bin

c:\windows\system32\12z57vir9sac.dll

c:\windows\system32\13037s5a9botz3a.exe

c:\windows\system32\13464s9zf5.bin

c:\windows\system32\13573n5t-a9viruz400.dll

c:\windows\system32\136zackdo9r2905.bin

c:\windows\system32\13790hacktoolz5e9.dll

c:\windows\system32\13955zpambot1bf.dll

c:\windows\system32\13b7azd95re2245.ocx

c:\windows\system32\13eeadd95re3z.bin

c:\windows\system32\145385zrm95.cpl

c:\windows\system32\145spzware2993.dll

c:\windows\system32\14728hzcktool5d99.ocx

c:\windows\system32\1474not-a5viru9z4a.ocx

c:\windows\system32\14829tz5j734.cpl

c:\windows\system32\15095vzru9553.ocx

c:\windows\system32\15202zp9654.dll

c:\windows\system32\1536zvirus5929.cpl

c:\windows\system32\153885zam9ot5ec.cpl

c:\windows\system32\15649troz61e.cpl

c:\windows\system32\1570z5irus90a.ocx

c:\windows\system32\15935not-a-virus511z.dll

c:\windows\system32\15952zroj255.bin

c:\windows\system32\1597sparze9172.ocx

c:\windows\system32\15bfbzckdoo91852.cpl

c:\windows\system32\15z05not-a-95rus41a.cpl

c:\windows\system32\1602hac5tz9l346.exe

c:\windows\system32\16541wormz59.exe

c:\windows\system32\16570szy4095.bin

c:\windows\system32\16658hackto9l3z6.ocx

c:\windows\system32\167adownloa9zr1578.bin

c:\windows\system32\16965viruszc95.exe

c:\windows\system32\17695sp5mbzt5d8.dll

c:\windows\system32\18444zpam9ot35b.bin

c:\windows\system32\1868vir59z.ocx

c:\windows\system32\1882zspy795.cpl

c:\windows\system32\188445zoj3799.ocx

c:\windows\system32\189285ackzool7fc.exe

c:\windows\system32\18937no5-azvi9us579.bin

c:\windows\system32\190529zy6d5.ocx

c:\windows\system32\19145hacktooz2079.ocx

c:\windows\system32\19455wozm465.exe

c:\windows\system32\1950zspy38.exe

c:\windows\system32\1958595cktozl72e.ocx

c:\windows\system32\19655oz-a-virus493.dll

c:\windows\system32\1969stealz253.bin

c:\windows\system32\198z65orm56b.exe

c:\windows\system32\19960spamb5t91dz.ocx

c:\windows\system32\19c7a5dware2480z.cpl

c:\windows\system32\19d1do5nloader28z8.exe

c:\windows\system32\19z56hacktool7c59.bin

c:\windows\system32\1az95h9ef2783.dll

c:\windows\system32\1b57zte5l2980.bin

c:\windows\system32\1cd4t5iez193.cpl

c:\windows\system32\1d69addwaz95452.exe

c:\windows\system32\1z550worm6089.cpl

c:\windows\system32\20785pazse519.bin

c:\windows\system32\20898spzm9ot652.cpl

c:\windows\system32\209z4vir5s189.cpl

c:\windows\system32\2169b5ckzoor2940.bin

c:\windows\system32\22085not-a-virzs399.cpl

c:\windows\system32\22264zot-59virus4e6.dll

c:\windows\system32\22539zpy6de.dll

c:\windows\system32\22897hackt9olze65.cpl

c:\windows\system32\22z89o5m1ae.dll

c:\windows\system32\2334zorm7b59.bin

c:\windows\system32\23405vir597z5.exe

c:\windows\system32\2345zackdoor1209.cpl

c:\windows\system32\23597zack9ool527.exe

c:\windows\system32\235z2vir9s5dc.cpl

c:\windows\system32\2379h5cktool7az.bin

c:\windows\system32\23adthr9at5233z.ocx

c:\windows\system32\2454azdware18759.dll

c:\windows\system32\2455zirus5349.dll

c:\windows\system32\245z0wo9m5ee.dll

c:\windows\system32\246z6hac95ool216.ocx

c:\windows\system32\2515stz9l1709.ocx

c:\windows\system32\251z6ha5ktoo92ce.exe

c:\windows\system32\25291sz9m5ot72.ocx

c:\windows\system32\25292hac59zol545.ocx

c:\windows\system32\25579spazbot7ab.ocx

c:\windows\system32\2562szy9are1325.ocx

c:\windows\system32\25797sp93ze.dll

c:\windows\system32\25894s5ambot4cz9.cpl

c:\windows\system32\25957spambot7e9z.cpl

c:\windows\system32\25989hacktool2z7.dll

c:\windows\system32\2598zir5983.exe

c:\windows\system32\25d29ackdzor2799.ocx

c:\windows\system32\25d5ba9kdoor1z79.cpl

c:\windows\system32\25z88not-a-vir9s16.dll

c:\windows\system32\265175pz3ed9.exe

c:\windows\system32\26559s5zmb9t5e3.exe

c:\windows\system32\266w5zm6c99.dll

c:\windows\system32\26749noz-5-virus4f5.exe

c:\windows\system32\26915hackt5ol4fz.bin

c:\windows\system32\26933hackzoolc85.dll

c:\windows\system32\273z359ambot51e.bin

c:\windows\system32\27537hac5too9671z.dll

c:\windows\system32\277059pzmbot573.cpl

c:\windows\system32\27736not-a-viruz569.dll

c:\windows\system32\2831no5-a-vi9zs54c.bin

c:\windows\system32\287z3s9yb5.ocx

c:\windows\system32\28852not-azvi5u94fb.dll

c:\windows\system32\289bdown5oader3z00.exe

c:\windows\system32\29169not-a-9i5us2bdz.cpl

c:\windows\system32\29220hazktool7ca5.dll

c:\windows\system32\29326sz5419.cpl

c:\windows\system32\295579pambzt316.ocx

c:\windows\system32\29599spyz385.bin

c:\windows\system32\2959t5z97ba.exe

c:\windows\system32\29625hackt5ol632z.exe

c:\windows\system32\2984thi5f29z7.exe

c:\windows\system32\29911noz-5-virus785.dll

c:\windows\system32\29z2vir2995.exe

c:\windows\system32\29z59h5ef7.cpl

c:\windows\system32\2b2095yware2z53.ocx

c:\windows\system32\2d52backdoor2319z.exe

c:\windows\system32\2de0z95ware2654.bin

c:\windows\system32\2e5zdownload9r765.dll

c:\windows\system32\2e97b5ckdozr2713.dll

c:\windows\system32\2eacbac5doorz690.ocx

c:\windows\system32\2z384wor93b45.bin

c:\windows\system32\2z556troj95.exe

c:\windows\system32\2z56thre9t15110.ocx

c:\windows\system32\2z93spyw9re135.bin

c:\windows\system32\2z954worm356.cpl

c:\windows\system32\3017z9py650.cpl

c:\windows\system32\30507n9t-azvi5us3b.ocx

c:\windows\system32\30635no5-z-virus29f.bin

c:\windows\system32\30730not-a-v9ru53zc.bin

c:\windows\system32\30829rzj1b95.exe

c:\windows\system32\30fzspywa95166.ocx

c:\windows\system32\30z22viru965e.ocx

c:\windows\system32\31349spy425z.bin

c:\windows\system32\31774vi59sz2.dll

c:\windows\system32\3189zvirus7549.bin

c:\windows\system32\319ezhief2579.cpl

c:\windows\system32\32333hazk95ol243.cpl

c:\windows\system32\32z14not-a-viru5491.dll

c:\windows\system32\33c2zownl5ad9r151.ocx

c:\windows\system32\34c2zackdo5r2499.exe

c:\windows\system32\35193not-a-virus253z.ocx

c:\windows\system32\35508wozm11f9.dll

c:\windows\system32\35eethiefz59.cpl

c:\windows\system32\35z4t9ief655.exe

c:\windows\system32\3653vi5us9f5z.exe

c:\windows\system32\36599orz4995.exe

c:\windows\system32\3772t95efz73.ocx

c:\windows\system32\381edo5nlzader2009.ocx

c:\windows\system32\38655zru93b9.bin

c:\windows\system32\39376hacztool512.cpl

c:\windows\system32\394szeal9655.ocx

c:\windows\system32\395zsparse1836.exe

c:\windows\system32\3987vir5z.exe

c:\windows\system32\3995v5r262z.cpl

c:\windows\system32\39z21troj75.exe

c:\windows\system32\39z66tro52a9.bin

c:\windows\system32\3b86dzwnl5a9er423.dll

c:\windows\system32\3c64v59311z.cpl

c:\windows\system32\3d7f9zeal2565.dll

c:\windows\system32\3db7b5ckdoor907z.cpl

c:\windows\system32\4048d9znlo5der2808.exe

c:\windows\system32\4050addw59e404z.bin

c:\windows\system32\415caddw5rz1975.dll

c:\windows\system32\4162sza5s9146.bin

c:\windows\system32\41z7s9y504.cpl

c:\windows\system32\41z9t5reat22399.exe

c:\windows\system32\42d5viz2119.cpl

c:\windows\system32\443ev5r9z71.dll

c:\windows\system32\4455spambo95a5z.cpl

c:\windows\system32\44f69aczdoor1075.exe

c:\windows\system32\4511s9z2a65.dll

c:\windows\system32\4538ba9kdzor513.dll

c:\windows\system32\4659spz3d5.bin

c:\windows\system32\46zdsp95se904.dll

c:\windows\system32\4749n5z-a-vi9us5f0.exe

c:\windows\system32\4795trzj901.exe

c:\windows\system32\4859worm9cz.ocx

c:\windows\system32\487baddw5re1945z.bin

c:\windows\system32\489z5arse1612.exe

c:\windows\system32\4974vir951z.bin

c:\windows\system32\4aef9pa5se1z49.bin

c:\windows\system32\4cc9ir20z95.exe

c:\windows\system32\4d79spar5ez698.dll

c:\windows\system32\4e75back5oor2z79.cpl

c:\windows\system32\4ecav9rz8845.exe

c:\windows\system32\4zd1sp9ware527.bin

c:\windows\system32\4ze3ba5kd9or1283.bin

c:\windows\system32\50162troj498z.cpl

c:\windows\system32\50790hacktooz2cd.bin

c:\windows\system32\5099spambot41fz.ocx

c:\windows\system32\50et9ief4z5.ocx

c:\windows\system32\5197zworm585.bin

c:\windows\system32\52169v9rus4az.dll

c:\windows\system32\521adow5load9r45z.cpl

c:\windows\system32\5235viruz4955.dll

c:\windows\system32\5259tzief846.dll

c:\windows\system32\53082hac9tool6a4z.exe

c:\windows\system32\5325dzwnloader2995.bin

c:\windows\system32\5351ste9l5214z.ocx

c:\windows\system32\54301troz394.bin

c:\windows\system32\5474sparz92589.ocx

c:\windows\system32\5492thiz53019.exe

c:\windows\system32\5495ojzdb.bin

c:\windows\system32\549fdownlzader2099.exe

c:\windows\system32\5500hzck9ool527.dll

c:\windows\system32\5539sparsez839.bin

c:\windows\system32\5549viruz613.cpl

c:\windows\system32\555zspywa5e2029.dll

c:\windows\system32\55650virz92e2.cpl

c:\windows\system32\5569bzckdoor698.ocx

c:\windows\system32\5583hacktzo967a.bin

c:\windows\system32\5595sparze380.cpl

c:\windows\system32\55f9thie598z5.dll

c:\windows\system32\56dca9dwarz5129.cpl

c:\windows\system32\5704s9eaz2143.exe

c:\windows\system32\571dz5wnl9ader1619.bin

c:\windows\system32\57479iruz5da.ocx

c:\windows\system32\5753notza9viru57bf.bin

c:\windows\system32\5755v9r1z88.bin

c:\windows\system32\5826v9rz19.dll

c:\windows\system32\5832spy95ze1363.cpl

c:\windows\system32\5852h9cktoolz0a.ocx

c:\windows\system32\5869zac9tool5cb.exe

c:\windows\system32\5895zir2695.bin

c:\windows\system32\58acspyw9re2159z.dll

c:\windows\system32\59310virzs436.exe

c:\windows\system32\5953viz583.ocx

c:\windows\system32\5964zpars52917.ocx

c:\windows\system32\59655iz1157.cpl

c:\windows\system32\596asp5wa9e2703z.bin

c:\windows\system32\597spyw5rez855.ocx

c:\windows\system32\59aatzief8565.ocx

c:\windows\system32\59b1thie59645z.dll

c:\windows\system32\59d0vi5z266.exe

c:\windows\system32\59z5spyware191.cpl

c:\windows\system32\59z6bac9door1818.cpl

c:\windows\system32\5a99stz9l562.exe

c:\windows\system32\5ad5s9ywzre2868.dll

c:\windows\system32\5b55do5nloa9zr2703.ocx

c:\windows\system32\5b97spyw9ze2650.bin

c:\windows\system32\5c01th95z1656.bin

c:\windows\system32\5c9zpa9se5864.ocx

c:\windows\system32\5e93s5eal3z99.dll

c:\windows\system32\5e9backdoor76z.exe

c:\windows\system32\5eezadd5are26839.bin

c:\windows\system32\5z39s5yware2994.bin

c:\windows\system32\5z544tr9j76e.dll

c:\windows\system32\5z5vir922.bin

c:\windows\system32\605e9hrezt31730.cpl

c:\windows\system32\60f7spzwar52199.cpl

c:\windows\system32\639avi5243z.ocx

c:\windows\system32\64695hreaz9336.dll

c:\windows\system32\64z0thie92665.exe

c:\windows\system32\6554azdw9r52511.cpl

c:\windows\system32\6564vi918z5.dll

c:\windows\system32\65d1backzoo91080.dll

c:\windows\system32\6695sp5zbot190.cpl

c:\windows\system32\66b9downlo5dzr2029.exe

c:\windows\system32\6835spy9z1.ocx

c:\windows\system32\6846sp59bot3fz.ocx

c:\windows\system32\68f9b9ckdoo564z.exe

c:\windows\system32\6925virz029.dll

c:\windows\system32\6958tzreat26852.ocx

c:\windows\system32\69azspyware7885.dll

c:\windows\system32\69d9dowzload5r20.exe

c:\windows\system32\6c58downloader15z9.dll

c:\windows\system32\6c59th5e9t85z4.dll

c:\windows\system32\6dz2add9are4195.cpl

c:\windows\system32\6efdzteal359.ocx

c:\windows\system32\6z54vir2869.exe

c:\windows\system32\6zced5wn9oader1005.cpl

c:\windows\system32\703zs9arse1795.cpl

c:\windows\system32\7350zpambot690.cpl

c:\windows\system32\743do5zloader30249.ocx

c:\windows\system32\7458th9ef720z.dll

c:\windows\system32\746virz95.ocx

c:\windows\system32\7490v5r9s238z.ocx

c:\windows\system32\758doznloa9e52866.ocx

c:\windows\system32\759a9pyware21z65.ocx

c:\windows\system32\75azt59eat28117.cpl

c:\windows\system32\7752not-a-v59us60z.cpl

c:\windows\system32\77c7s9ywar59z8.exe

c:\windows\system32\7919zhief2554.cpl

c:\windows\system32\792bvi51847z.dll

c:\windows\system32\799dt9zef5835.cpl

c:\windows\system32\79fzvir24815.bin

c:\windows\system32\7d63z5dware9785.bin

c:\windows\system32\7f54addwzre3299.dll

c:\windows\system32\7fabac9door3z45.dll

c:\windows\system32\7z35thief597.bin

c:\windows\system32\7z995r9j4a2.cpl

c:\windows\system32\7zees9eal3045.dll

c:\windows\system32\82z75ot-a-9irus4a0.bin

c:\windows\system32\8433sz59d5.bin

c:\windows\system32\85595izu9104.dll

c:\windows\system32\89555py59z.cpl

c:\windows\system32\8z615ot-a-9irus.exe

c:\windows\system32\9059vir894z.bin

c:\windows\system32\912z2vi5us3af.cpl

c:\windows\system32\92935or9zd.ocx

c:\windows\system32\93321sp5mbotzb5.cpl

c:\windows\system32\9362wo5m1d9z.dll

c:\windows\system32\93755z9j509.exe

c:\windows\system32\93858spy6z6.cpl

c:\windows\system32\93z8hacktoo513c9.exe

c:\windows\system32\943thzea525069.bin

c:\windows\system32\9530troj26z.cpl

c:\windows\system32\9552zownloader3266.bin

c:\windows\system32\9595tzo55d6.ocx

c:\windows\system32\959v5r1943z.exe

c:\windows\system32\95zesteal383.cpl

c:\windows\system32\96zbsparse5485.bin

c:\windows\system32\97019spyzf5.cpl

c:\windows\system32\9735zyware2987.dll

c:\windows\system32\984159z66.bin

c:\windows\system32\99515worm5cz.dll

c:\windows\system32\9c71dow5zoader2185.dll

c:\windows\system32\9d0es5eal3z36.cpl

c:\windows\system32\9dc5zhreat19588.cpl

c:\windows\system32\9e39hief5z42.bin

c:\windows\system32\9fbfz5ief1090.cpl

c:\windows\system32\9z56spars52259.ocx

c:\windows\system32\a2fzackd5or3298.cpl

c:\windows\system32\a59sparse1259z.ocx

c:\windows\system32\a5at9rzat31845.ocx

c:\windows\system32\a6759r7z2.bin

c:\windows\system32\b969tz5l3103.dll

c:\windows\system32\c0at9izf12165.cpl

c:\windows\system32\cffzackd5o91634.cpl

c:\windows\system32\d3a95yzare197.exe

c:\windows\system32\d77ba9zdoor3575.ocx

c:\windows\system32\e2fzd9ware695.dll

c:\windows\system32\e89a5dwarez93.cpl

c:\windows\system32\ed9threat245z3.ocx

c:\windows\system32\ee9th5ef1z02.ocx

c:\windows\system32\f93viz5564.bin

c:\windows\system32\spool\prtprocs\w32x86\31g93aA9.dll

c:\windows\system32\sysogg.dll

c:\windows\system32\z066459rm62f.bin

c:\windows\system32\z089thie52805.dll

c:\windows\system32\z17125py339.bin

c:\windows\system32\z1739parse1569.ocx

c:\windows\system32\z1833tro925e.exe

c:\windows\system32\z187d9wnloader2605.cpl

c:\windows\system32\z1939viru559d.exe

c:\windows\system32\z3aedownloa9e534.ocx

c:\windows\system32\z46thr9a512301.dll

c:\windows\system32\z47s5yware2915.exe

c:\windows\system32\z534n9t-a-virus6d5.exe

c:\windows\system32\z594wo9m23e5.ocx

c:\windows\system32\z5a9addware3072.bin

c:\windows\system32\z5d9threat35545.dll

c:\windows\system32\z6558spy195.bin

c:\windows\system32\z75s5arse199.ocx

c:\windows\system32\z79615p9509.cpl

c:\windows\system32\z8051t95j5a6.bin

c:\windows\system32\z943ad5wa9e1037.cpl

c:\windows\system32\z955spa9bot7b7.ocx

c:\windows\system32\z959thief2726.ocx

c:\windows\system32\z965hreat6313.cpl

c:\windows\system32\z981n5t-a9viruscf.exe

c:\windows\system32\z99faddware2599.dll

c:\windows\system32\z9dabackdoor1590.cpl

c:\windows\system32\zabfba5kdoo91323.exe

c:\windows\system32\zb0av9r1058.exe

c:\windows\system32\zb6thre5t1495.dll

c:\windows\system32\zbfaddwa5e903.ocx

c:\windows\z0695troj3fc.ocx

c:\windows\z114v5rus99.bin

c:\windows\z14dste5l21469.ocx

c:\windows\z1569virus40d.bin

c:\windows\z1909sp55c29.exe

c:\windows\z2472s9y15e.cpl

c:\windows\z3085pa9se2438.bin

c:\windows\z3442w59m595.ocx

c:\windows\z44et59ef1360.exe

c:\windows\z482bac9door1465.exe

c:\windows\z5291vi5us148.dll

c:\windows\z52959roj178.cpl

c:\windows\z55csparse2959.bin

c:\windows\z5799tro91c75.dll

c:\windows\z6535hackt9ol526.bin

c:\windows\z725spywar9369.exe

c:\windows\z7859s952e8.ocx

c:\windows\z7edv95968.exe

c:\windows\z90ddownloade51346.cpl

c:\windows\z9902spy650.cpl

c:\windows\zbf2spyware2595.exe

c:\windows\zc5dvir3509.exe

c:\windows\ze97addwar51067.bin

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_USNJSVC

-------\Service_usnjsvc

((((((((((((((((((((((((( Files Created from 2010-08-10 to 2010-09-10 )))))))))))))))))))))))))))))))

.

2010-09-10 20:51 . 2010-09-10 20:52 -------- d-----w- c:\documents and settings\Owner\Application Data\BitTorrent

2010-09-02 23:24 . 2010-09-02 23:25 -------- d-----w- c:\program files\Ask.com

2010-09-02 23:23 . 2010-09-02 23:23 -------- d-----w- c:\program files\BitTorrent

2010-09-02 23:23 . 2010-09-03 00:26 -------- d-----w- c:\documents and settings\Mother Dearest\Application Data\BitTorrent

2010-08-31 21:27 . 2010-08-31 21:27 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\PCHealth

2010-08-31 21:24 . 2010-08-31 21:24 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\Mozilla

2010-08-31 21:22 . 2007-07-03 20:40 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\ApplicationHistory

2010-08-31 21:22 . 2007-07-03 20:35 -------- d-----w- c:\documents and settings\Mother Dearest\autopatcher

2010-08-31 21:22 . 2007-07-03 20:10 -------- d-----w- c:\documents and settings\Mother Dearest\WINDOWS

2010-08-31 21:22 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest

2010-08-18 23:58 . 2010-08-18 23:58 -------- d-----w- c:\program files\MSECache

2010-08-13 05:09 . 2010-08-13 05:09 -------- d-----w- c:\windows\system32\MpEngineStore

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-31 21:23 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest\Application Data\ArcSoft

2010-08-31 21:23 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest\Application Data\Skinux

2010-08-31 21:23 . 2010-08-31 21:23 74952 ----a-w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-08-31 21:23 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest\Application Data\Malwarebytes

2010-08-21 01:07 . 2006-09-02 16:08 -------- d-----w- c:\documents and settings\Owner\Application Data\HP

2010-08-19 20:13 . 2006-09-02 16:08 74952 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-08-17 21:21 . 2006-09-03 13:16 43596 ----a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat

2010-08-17 20:47 . 2009-10-25 21:07 -------- d-----w- c:\documents and settings\Owner\Application Data\Walgreens

2010-08-09 01:50 . 2010-07-23 17:14 -------- d-----w- c:\program files\Trillian

2010-07-26 00:40 . 2008-07-13 23:06 -------- d-----w- c:\documents and settings\Owner\Application Data\mjusbsp

2010-07-26 00:38 . 2007-07-28 19:30 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-07-23 17:15 . 2010-07-23 17:14 -------- d-----w- c:\documents and settings\Owner\Application Data\Trillian

2010-07-22 14:29 . 2010-07-22 14:29 -------- d-----w- c:\program files\Spybot - Search & Destroy2

2010-07-22 14:10 . 2008-12-23 18:23 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)

2010-07-22 14:10 . 2010-07-22 14:10 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)

2010-07-22 04:13 . 2007-07-03 19:52 4224 ----a-w- c:\windows\system32\drivers\rdpcdd.sys

2010-07-22 02:45 . 2008-12-31 19:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-21 22:29 . 2010-07-21 22:29 120 ----a-w- c:\windows\Oyeboza.dat

2010-07-21 22:29 . 2010-07-21 22:29 0 ----a-w- c:\windows\Nbefoduye.bin

2010-06-30 12:31 . 2007-07-03 19:52 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22 . 2007-07-03 19:52 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2007-07-03 19:52 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2007-07-03 19:52 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-20 18:37 . 2010-06-20 18:37 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys

2010-06-17 14:03 . 2007-07-03 19:52 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2007-07-03 20:04 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-14 07:41 . 2007-07-03 19:52 1172480 ----a-w- c:\windows\system32\msxml3.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-05-26 20:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"cdloader"="c:\documents and settings\Owner\Application Data\mjusbsp\cdloader2.exe" [2010-02-26 50520]

"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2008-06-17 2057728]

"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-23 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2005-11-11 90112]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-01 149280]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Exetender"="c:\program files\Free Ride Games\GPlayer.exe" [2008-06-17 2057728]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624]

NETGEAR WG111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v2\WG111v2.exe [2010-6-20 1261568]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Documents and Settings\\Owner\\Application Data\\mjusbsp\\magicJack.exe"=

"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=

R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [7/22/2010 10:18 AM 29416]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/31/2008 2:02 PM 304464]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

R2 X4HSX32Ex;X4HSX32Ex;c:\program files\Free Ride Games\X4HSX32Ex.sys [11/4/2008 6:55 PM 29856]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/31/2008 2:02 PM 20952]

S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [6/20/2010 1:37 PM 272128]

.

Contents of the 'Scheduled Tasks' folder

2010-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3334224619-2260272856-3883188569-1003Core.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-23 20:10]

2010-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3334224619-2260272856-3883188569-1003UA.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-23 20:10]

2010-09-10 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-09-10 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 20:23]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\tzqc20ug.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=4&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp

FF - prefs.js: keyword.URL - hxxp://search.search-star.net/?sid=10101036100&s=

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\Owner\Application Data\Facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll

FF - plugin: c:\program files\Free Ride Games\npExentCtl.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npstrlnk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - Google

FF - user.js: browser.search.order.1 - Google

FF - user.js: keyword.URL - hxxp://search.search-star.net/?sid=10101036100&s=c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-eTrustPPAP - c:\program files\CA\eTrust PestPatrol\PPActiveDetection.exe

SafeBoot-klmdb.sys

AddRemove-HijackThis - c:\documents and settings\Owner\Desktop\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-10 16:25

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2568)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\SCardSvr.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\xampp\mysql\bin\mysqld.exe

c:\windows\system32\HPZipm12.exe

c:\program files\SanDisk\Sansa Updater\SansaSvr.exe

c:\windows\SOUNDMAN.EXE

c:\windows\system32\wscntfy.exe

c:\program files\Java\jre6\bin\jucheck.exe

.

**************************************************************************

.

Completion time: 2010-09-10 16:39:12 - machine was rebooted

ComboFix-quarantined-files.txt 2010-09-10 21:39

Pre-Run: 11,873,644,544 bytes free

Post-Run: 13,220,335,616 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - ED98C717A159D8A522E99423675112EE

RPMcMurphy · September 11, 2010

VectorForce:

Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.malwarebytes.org/index.php?showtopic=62134
Collect::
c:\windows\Oyeboza.dat
File::
c:\windows\Nbefoduye.bin

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:

ComboFix log
MBAM log

VectorForce · September 12, 2010

********* COMBOFIX ***********

ComboFix 10-09-11.02 - Owner 09/11/2010 17:04:36.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.991.590 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

FILE ::

"c:\windows\Nbefoduye.bin"

file zipped: c:\windows\Oyeboza.dat

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Owner\Local Settings\Application Data\{0E235CB5-4FC9-49D3-8072-5C25EF6EAA90}

c:\documents and settings\Owner\Local Settings\Application Data\{0E235CB5-4FC9-49D3-8072-5C25EF6EAA90}\chrome\content\_cfg.js

c:\documents and settings\Owner\Local Settings\Application Data\{0E235CB5-4FC9-49D3-8072-5C25EF6EAA90}\chrome\content\overlay.xul

c:\documents and settings\Owner\Local Settings\Application Data\{0E235CB5-4FC9-49D3-8072-5C25EF6EAA90}\install.rdf

c:\windows\Nbefoduye.bin

c:\windows\Oyeboza.dat

.

((((((((((((((((((((((((( Files Created from 2010-08-11 to 2010-09-11 )))))))))))))))))))))))))))))))

.

2010-09-10 20:51 . 2010-09-10 20:52 -------- d-----w- c:\documents and settings\Owner\Application Data\BitTorrent

2010-09-02 23:24 . 2010-09-02 23:25 -------- d-----w- c:\program files\Ask.com

2010-09-02 23:23 . 2010-09-02 23:23 -------- d-----w- c:\program files\BitTorrent

2010-09-02 23:23 . 2010-09-03 00:26 -------- d-----w- c:\documents and settings\Mother Dearest\Application Data\BitTorrent

2010-08-31 21:27 . 2010-08-31 21:27 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\PCHealth

2010-08-31 21:24 . 2010-08-31 21:24 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\Mozilla

2010-08-31 21:23 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\ArcSoft

2010-08-31 21:22 . 2007-07-03 20:40 -------- d-----w- c:\documents and settings\Mother Dearest\Local Settings\Application Data\ApplicationHistory

2010-08-31 21:22 . 2007-07-03 20:35 -------- d-----w- c:\documents and settings\Mother Dearest\autopatcher

2010-08-31 21:22 . 2007-07-03 20:10 -------- d-----w- c:\documents and settings\Mother Dearest\WINDOWS

2010-08-31 21:22 . 2010-08-31 21:23 -------- d-----w- c:\documents and settings\Mother Dearest

2010-08-18 23:58 . 2010-08-18 23:58 -------- d-----w- c:\program files\MSECache

2010-08-13 05:09 . 2010-08-13 05:09 -------- d-----w- c:\windows\system32\MpEngineStore

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-10 21:25 . 2009-03-07 15:50 720 ----a-w- c:\documents and settings\All Users\Application Data\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll