GMER failed twice

okieseeker · September 19, 2010

While following the steps in "I'm infected - What do I do now?" I couldn't get GMER to successfully complete a scan and generate results. The first time, GMER's scan got as far as somewhere in the registry (I think) where the path was something like SOFTWARE/Microsoft/Windows/CurrentVersion (if I remember right) and then froze. Sat there for 30 minutes. I tried to invoke the Task Manager to see what was going on, but that just caused all the desktop icons, and the GMER box, and the Task Bar, to disappear. The system was totally unresponsive. Used the button on my PC to reboot. Ran GMER again. This time it got somewhere into the scan (I wasn't watching the path this time) and the entire system suddenly went to the boot-up "Intel" screen, and I had to log back in.

I need to get past this problem so I can complete what I started out to do: Submit the needed information so you folks can help me figure out what item on my PC is trying to dial out and causing Malwarebytes to pop up with messages about blocking access to malicious sites. (By the way no p2p installed.)

Elise · September 19, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the Quick Scan button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

Double-click on RKUnhookerLE to run it
Click the Report tab, then click Scan
Check Drivers, Stealth and uncheck the rest
Click OK
Wait until it's finished and then go to File > Save Report
Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
RKU log

Thanks and again sorry for the delay.

okieseeker · September 19, 2010

If I understand you instructions correctly, I reply here with two results of the OTL scan, then post a second reply with the results of the Rootkit Unhooker scan...

Oops, I got a "post too long" message, so I have zipped and attached both files.

OTL.zip

Extras.zip

Elise · September 19, 2010

No problem.

I'll wait for the RKU log.

okieseeker · September 19, 2010

Hope the site doesn't choke on the text this time ...

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #2

==============================================

>Drivers

==============================================

0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2260992 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2260992 bytes

0x804D7000 RAW 2260992 bytes

0x804D7000 WMIxWDM 2260992 bytes

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xAE964000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\VirusDefs\20100919.003\NAVEX15.SYS 1359872 bytes (Symantec Corporation, AV Engine)

0xB9690000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1302528 bytes (Intel Corporation, Intel Graphics Miniport Driver)

0xB0DAD000 C:\WINDOWS\system32\drivers\ha10kx2k.sys 1089536 bytes (Creative Technology Ltd, Creative EMU10KX HAL (WDM))

0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 925696 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology)

0xB04C0000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20100901.003\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver)

0xB0CB9000 C:\WINDOWS\system32\drivers\ctac32k.sys 638976 bytes (Creative Technology Ltd, Creative AC3 SW Decoder Device Driver (WDM))

0xB0B85000 C:\WINDOWS\System32\drivers\CTSBLFX.SYS 581632 bytes (Creative Technology Ltd, Creative SB FX Plug-in)

0xF7B52000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xB0C13000 C:\WINDOWS\System32\drivers\CTAUDFX.SYS 569344 bytes (Creative Technology Ltd, Creative SB FX Plug-in)

0xB95D8000 C:\WINDOWS\system32\drivers\ctaud2k.sys 524288 bytes (Creative Technology Ltd, Creative WDM Audio Device Driver)

0xB056C000 C:\WINDOWS\system32\drivers\N360\0402000.00C\ccHPx86.sys 520192 bytes (Symantec Corporation, Common Client Hash Provider Driver)

0xB94B4000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)

0xB0666000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xB0608000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)

0xB93BF000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xB0867000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xB0B2E000 C:\WINDOWS\System32\Drivers\N360\0402000.00C\SRTSP.SYS 356352 bytes (Symantec Corporation, Symantec AutoProtect)

0xAFFF1000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)

0xB07EA000 C:\WINDOWS\System32\Drivers\N360\0402000.00C\SYMTDI.SYS 356352 bytes (Symantec Corporation, Network Dispatch Driver)

0xF7424000 SYMDS.SYS 352256 bytes

0xB0795000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20100917.001\IDSxpx86.sys 348160 bytes (Symantec Corporation, IDS Core Driver)

0xB0AC8000 C:\WINDOWS\system32\DRIVERS\wg111v3.sys 290816 bytes (Realtek Semiconductor Corporation , NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter NDIS Driver)

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xAF38A000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xB9475000 C:\WINDOWS\system32\drivers\SRS_DivX_i386.sys 258048 bytes (-, SRS Premium Sound driver)

0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)

0xB955D000 C:\WINDOWS\system32\drivers\ctoss2k.sys 212992 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM))

0xB0EB7000 C:\WINDOWS\system32\drivers\hap17v2k.sys 204800 bytes (Creative Technology Ltd, Creative EMU10KX-P17v HAL (WDM))

0xB941D000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xB0D7E000 C:\WINDOWS\system32\drivers\emupia2k.sys 192512 bytes (Creative Technology Ltd, E-mu Plug-in Architecture Driver (WDM))

0xF75A8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xF795A000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF786A000 SYMEFA.SYS 184320 bytes

0xB06FE000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xB0D55000 C:\WINDOWS\system32\drivers\ctsfm2k.sys 167936 bytes (Creative Technology Ltd, SoundFont® Manager (WDM))

0xB076D000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xAFF79000 C:\Program Files\Cakewalk\Shared Dxi\Roland\RVIEg01.sys 163840 bytes (Roland, Roland VSC Synthesizer Engine)

0xF74B2000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)

0xB0841000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xB0957000 C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library)

0xB9539000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 147456 bytes (Intel Corporation, Intel® PRO/100 Adapter NDIS 5.1 driver)

0xB95B4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xB9658000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xB9591000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xB074B000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)

0xB0729000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)

0xF7403000 symsnap.sys 135168 bytes (StorageCraft, StorageCraft Volume Snap-Shot)

0x806FF000 ACPI_HAL 134400 bytes

0x806FF000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF747A000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF74D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xB0B0F000 C:\WINDOWS\system32\drivers\N360\0402000.00C\Ironx86.SYS 126976 bytes (Symantec Corporation, Iron Driver)

0xB05EB000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)

0xB0C9E000 C:\WINDOWS\System32\drivers\COMMONFX.SYS 110592 bytes (Creative Technology Ltd, Creative Common FX Plug-in)

0xF7839000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF749A000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xB04A8000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xF7853000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xB945E000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xAFD5C000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xAE950000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\VirusDefs\20100919.003\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)

0xB9525000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xB967C000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xB08C0000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF7597000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xB944D000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xBA780000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xB9CA3000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xB9CB3000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xB9CD3000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xB9C93000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xAFF11000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF7557000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)

0xF76A7000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)

0xF7637000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF7697000 C:\WINDOWS\system32\DRIVERS\GenericMount.sys 53248 bytes (Symantec Corporation, Symantec Corporation Generic Mount)

0xB9CC3000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xF76B7000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF7617000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xF76D7000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xBA7A0000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF7687000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF7607000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF76C7000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xBA710000 C:\WINDOWS\system32\DRIVERS\EAPPkt.sys 40960 bytes (Realtek, Realtek EAPPkt Protocol Driver)

0xF75F7000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF7577000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF7647000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xF7517000 C:\WINDOWS\system32\drivers\N360\0402000.00C\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect)

0xF76F7000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF7627000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF7527000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xB9CE3000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)

0xAF6FE000 C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)

0xF76E7000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF74F7000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xAEB20000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xB9D03000 C:\WINDOWS\system32\DRIVERS\SMBios.sys 36864 bytes (Intel Corporation, Intel® System Management BIOS Driver)

0xF7507000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF7807000 C:\WINDOWS\system32\drivers\ctprxy2k.sys 32768 bytes (Creative Technology Ltd, Creative Proxy Device Driver (WDM))

0xB9D5B000 C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.)

0xB9D53000 C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.)

0xB9D33000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF7777000 C:\WINDOWS\system32\drivers\sf.sys 32768 bytes (Sonic Focus, Inc, DSP service driver)

0xF77FF000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xB9D6B000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xF7727000 iomdisk.sys 28672 bytes (Iomega Corporation, Iomega Disk Filter Driver)

0xF7707000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF7817000 C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)

0xF780F000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF7717000 MDPMGRNT.sys 24576 bytes (Mediafour Corporation, Mediafour MacDrive Partition Manager)

0xB9D7B000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xF777F000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)

0xF77F7000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0xB9D43000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF77C7000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)

0xB9D3B000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF771F000 ppa.sys 20480 bytes (Microsoft Corporation, PPA Protocol Driver)

0xF7767000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF776F000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF781F000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xF779F000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xB0248000 C:\WINDOWS\system32\drivers\cpuz134_x32.sys 16384 bytes (Windows ® Win 7 DDK provider, CPUID Driver)

0xBA7FC000 C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys 16384 bytes (Logitech, Inc., Logitech PS2 Keyboard Filter Driver.)

0xB03DC000 C:\WINDOWS\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)

0xBA7D4000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xB0370000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xBA7F8000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF7897000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xB9041000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xBA014000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xBA00C000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xBA7EC000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xBA008000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF79E5000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF798D000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xF79F7000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xF79E3000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF798B000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)

0xF7987000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF79E7000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF79AD000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)

0xF79E9000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF79DB000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF79DD000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7989000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF7A9B000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7AB2000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xB9E25000 C:\WINDOWS\System32\Drivers\LBeepKE.sys 4096 bytes (Logitech, Inc., Logitech Consumer Control Filter Driver.)

0xB9F87000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

==============================================

>Stealth

==============================================

WARNING: Virus alike driver modification [mup.sys]

WARNING: Virus alike driver modification [gameenum.sys]

WARNING: Virus alike driver modification [irenum.sys]

WARNING: Virus alike driver modification [tdpipe.sys]

WARNING: Virus alike driver modification [nwlnkflt.sys]

WARNING: Virus alike driver modification [ftdisk.sys]

WARNING: Virus alike driver modification [fltmgr.sys]

WARNING: Virus alike driver modification [rdpwd.sys]

WARNING: Virus alike driver modification [asyncmac.sys]

WARNING: Virus alike driver modification [dmio.sys]

WARNING: Virus alike driver modification [ppa.sys]

WARNING: Virus alike driver modification [ndis.sys]

WARNING: Virus alike driver modification [acpi.sys]

WARNING: Virus alike driver modification [partmgr.sys]

WARNING: Virus alike driver modification [secdrv.sys]

WARNING: Virus alike driver modification [ipinip.sys]

WARNING: Virus alike driver modification [rt2500usb.sys]

WARNING: Virus alike driver modification [pciidex.sys]

WARNING: Virus alike driver modification [LHidFlt2.Sys]

WARNING: Virus alike driver modification [iomDisk.sys]

WARNING: Virus alike driver modification [usbccgp.sys]

WARNING: Virus alike driver modification [nwlnkfwd.sys]

WARNING: Virus alike driver modification [ipfltdrv.sys]

WARNING: Virus alike driver modification [disk.sys]

WARNING: Virus alike driver modification [ip6fw.sys]

WARNING: Virus alike driver modification [isapnp.sys]

WARNING: Virus alike driver modification [mountmgr.sys]

WARNING: Virus alike driver modification [classpnp.sys]

WARNING: Virus alike driver modification [mspqm.sys]

WARNING: Virus alike driver modification [L8042PR2.SYS]

WARNING: Virus alike driver modification [volsnap.sys]

WARNING: Virus alike driver modification [mspclock.sys]

WARNING: Virus alike driver modification [intelide.sys]

WARNING: Virus alike driver modification [ntfs.sys]

WARNING: Virus alike driver modification [dmload.sys]

WARNING: Virus alike driver modification [atmarpc.sys]

WARNING: Virus alike driver modification [usbaudio.sys]

WARNING: Virus alike driver modification [pci.sys]

WARNING: Virus alike driver modification [LMouFlt2.Sys]

WARNING: Virus alike driver modification [sr.sys]

WARNING: Virus alike driver modification [WudfPf.sys]

Elise · September 19, 2010

Hi again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

okieseeker · September 22, 2010

ComboFix 10-09-21.01 - Administrator 09/21/2010 21:56:19.13.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3055.1791 [GMT -5:00]

Running from: d:\installers\NEW after 8-8-2010\ComboFix.exe

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {83E6BDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {83F89054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {844F035C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {845CC054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000246-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84243CF4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8434A4E4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {843B1B64-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844201F4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8446F054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84484504-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844928C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844B8DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844C3DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844CCDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844D23B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844D823C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844E0DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844EA45C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844F3DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844F524C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844F5DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {844F6744-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845012A4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84503554-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845132A4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8451ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8451EBB4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845204C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84528DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84533DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8453B054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8457EB64-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84586644-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845A157C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845B59CC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845C0DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845D8C0C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {845F2DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84632B74-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84636054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8464396C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8467DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8468DDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84694384-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {846A8974-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8471B284-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8471FAA4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84742374-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84B28DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84B7CCE4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {84D9ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {856CABD4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {85C06C24-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86011BE4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8628A6B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86587DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8659D32C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865A773C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865C04DC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865D0C0C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865D2A6C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865DD91C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {865EEDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8661C794-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8661C91C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86658DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8665D27C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86665B24-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86667C94-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8666EDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8667C32C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866833C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866859EC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8668639C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8668ADDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86690A6C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86695DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866963C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86696CA4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8669CA74-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866A1A6C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866A4BAC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866A6394-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866A7664-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866AC2F4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866B1374-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866B6324-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866C3DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866CB7B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {866DB6B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8670C054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8672798C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86728DB4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8673ADB4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8673E40C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8674191C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8674B82C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8675AA3C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8675AC4C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867614FC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86764C04-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867694B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86769DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86772A3C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86775434-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86775DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8677D5B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8677E4AC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8678145C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867814AC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867845A4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867864AC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8678A3C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86796964-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86796DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86798A94-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8679DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867B385C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867BA5AC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867BB35C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867C137C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {867FFCF4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8680F144-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86813C1C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8681633C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8681927C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8682128C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8682A054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8682E374-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8685E9EC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {868677A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8687B524-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8689BBF4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8689DDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {868E2374-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8695F054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86976054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86985DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {869B2054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {869D6DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {869E64C4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A0FA6C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A1CDDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A22DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A4622C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A4642C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A559B4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A5B504-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A5E224-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A5E72C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6154C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A64DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6C7EC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6E51C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6E604-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6EBB4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A6F054-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A703AC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A70DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A7339C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A768F4-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A76DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A77DDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A78194-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A805CC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A8150C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86A90A94-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86AA9BDC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86B5C614-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86B6135C-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {86B874DC-FFA4-00DE-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {BADB0D00-FFA4-00DE-0D24-347CA8A3377C}

AV: Norton 360 Premier Edition *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton 360 Premier Edition *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))

.

2010-09-22 02:16 . 2010-09-22 02:16 -------- d-----w- c:\program files\Font Xplorer

2010-09-21 03:51 . 2010-09-21 03:51 -------- d-----w- c:\program files\ZipGenius 6

2010-09-15 01:55 . 2010-07-09 18:18 20328 ----a-w- c:\windows\system32\drivers\cpuz134_x32.sys

2010-09-15 01:55 . 2010-09-15 01:55 -------- d-----w- c:\program files\CPUID

2010-09-14 17:55 . 2010-09-14 17:55 5272616 ----a-w- c:\documents and settings\Administrator\Application Data\Uniblue\RegistryBooster\_temp\ub.exe

2010-09-12 20:24 . 2003-06-25 21:05 266360 ----a-w- c:\windows\system32\TweakUI.exe

2010-09-11 01:50 . 2010-09-11 01:50 92280 ----a-w- c:\documents and settings\Administrator\Application Data\SystemRequirementsLab\srlproxy_intel_4.3.1.0A.dll

2010-09-10 04:53 . 2010-09-10 04:53 25992 ----a-w- c:\windows\system32\pgdfgsvc.exe

2010-09-10 04:47 . 2010-09-10 04:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\JAM Software

2010-09-10 04:31 . 2010-09-10 04:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\eSupport.com

2010-09-10 04:31 . 2010-09-10 04:31 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys

2010-09-10 04:28 . 2010-09-10 04:28 -------- d-----w- c:\program files\LopeSoft

2010-09-10 04:26 . 2010-09-10 04:26 -------- d-----w- c:\program files\JAM Software

2010-09-06 05:28 . 2005-09-20 15:31 135168 ----a-w- c:\windows\system32\igfxres.dll

2010-09-06 05:00 . 2010-09-06 05:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc

2010-09-04 11:56 . 2010-09-04 11:56 -------- d-----w- c:\documents and settings\Guest\Application Data\Uniblue

2010-09-04 03:44 . 2010-09-04 03:45 -------- d-----w- c:\program files\iTunes

2010-09-04 03:41 . 2010-04-20 01:47 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-09-04 03:41 . 2010-04-20 01:47 3062048 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-09-04 03:41 . 2010-09-04 03:41 -------- d-----w- c:\program files\Bonjour

2010-09-04 03:33 . 2010-09-04 03:34 -------- d-----w- c:\program files\SpywareBlaster

2010-09-04 02:22 . 2010-09-21 03:36 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip

2010-09-04 00:30 . 2010-09-04 00:30 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-09-03 23:36 . 2010-09-11 01:51 -------- d-----w- c:\program files\SystemRequirementsLab

2010-09-03 23:35 . 2010-09-03 23:35 84480 ----a-w- c:\documents and settings\Administrator\Application Data\SystemRequirementsLab\srlproxy_intel_4.1.66.0A.dll

2010-09-03 23:35 . 2010-09-11 01:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\SystemRequirementsLab

2010-09-01 14:12 . 2010-09-01 14:12 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe

2010-08-31 04:52 . 2010-09-01 03:05 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\NOS

2010-08-31 02:24 . 2010-08-31 02:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira

2010-08-31 02:09 . 2010-08-31 02:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\ColorCop

2010-08-31 02:09 . 2010-08-31 02:12 -------- d-----w- c:\program files\Color_Cop

2010-08-30 02:07 . 2010-08-30 02:07 -------- d-----w- c:\program files\ESET

2010-08-27 23:11 . 2010-08-27 23:08 185640 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\finishPlugin.dll

2010-08-27 23:11 . 2010-08-27 23:11 56765 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-08-27 23:11 . 2010-08-27 23:11 56997 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-08-27 23:11 . 2010-08-27 23:11 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe

2010-08-27 23:11 . 2010-08-27 23:11 57691 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe

2010-08-27 23:10 . 2010-08-27 23:10 84063 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe

2010-08-27 23:10 . 2010-08-27 23:10 54153 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe

2010-08-27 23:07 . 2010-08-27 23:07 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe

2010-08-27 21:33 . 2010-08-27 21:33 72688 ----a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-08-27 13:18 . 2010-08-27 13:18 -------- d-----w- c:\documents and settings\Guest\Application Data\ProgSense

2010-08-24 12:45 . 2010-08-24 12:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\ProgSense

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-22 02:14 . 2008-02-16 17:33 -------- d-----w- c:\documents and settings\Administrator\Application Data\Orbit

2010-09-20 03:44 . 2005-02-12 05:32 71800 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-09-20 03:43 . 2010-08-22 11:17 -------- d-----w- c:\documents and settings\Guest\Application Data\Orbit

2010-09-20 03:36 . 2010-08-22 11:16 -------- d-----w- c:\documents and settings\Guest\Application Data\Apple Computer

2010-09-18 20:16 . 2009-07-12 22:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Winamp

2010-09-18 15:10 . 2009-07-08 03:59 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-09-18 02:51 . 2010-07-31 19:16 -------- d-----w- c:\program files\Uniblue

2010-09-17 23:11 . 2008-06-04 01:54 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-09-17 22:38 . 2009-01-14 04:19 -------- d-----w- c:\program files\BitTorrent

2010-09-17 06:14 . 2008-04-16 01:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\BitTorrent

2010-09-15 23:17 . 2007-10-27 04:53 -------- d-----w- c:\program files\u-he

2010-09-15 02:34 . 2010-08-10 04:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\gnupg

2010-09-15 01:07 . 2010-04-30 07:38 63488 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll

2010-09-15 01:07 . 2010-04-26 03:38 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2010-09-12 00:46 . 2010-07-31 19:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue

2010-09-11 21:49 . 2010-07-31 22:07 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-09-11 21:49 . 2010-07-31 22:07 53632 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-09-09 04:25 . 2005-02-10 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-09-09 04:19 . 2007-05-10 01:10 -------- d-----w- c:\program files\CCleaner

2010-09-06 04:56 . 2010-08-14 22:00 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-09-04 20:54 . 2005-02-10 14:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-09-04 19:50 . 2008-02-08 03:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-09-04 11:52 . 2010-08-27 21:29 664 ----a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d9caps.tmp

2010-09-04 03:44 . 2005-02-12 04:34 -------- d-----w- c:\program files\iPod

2010-09-04 03:44 . 2007-09-03 14:50 -------- d-----w- c:\program files\Common Files\Apple

2010-09-04 03:35 . 2005-02-26 01:21 -------- d-----w- c:\program files\Java

2010-09-03 01:22 . 2007-09-09 00:35 -------- d-----w- c:\program files\MidiPlayer

2010-09-03 00:59 . 2009-01-06 03:06 -------- d-----w- c:\program files\Audible

2010-08-31 02:07 . 2005-02-26 01:19 -------- d-----w- c:\program files\ScreenRuler

2010-08-30 04:36 . 2010-07-31 22:32 -------- d-----w- c:\documents and settings\All Users\Application Data\regid.1986-12.com.adobe

2010-08-30 04:04 . 2005-02-11 03:52 -------- d-----w- c:\program files\Common Files\Adobe

2010-08-29 13:39 . 2007-07-24 03:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\Audacity

2010-08-28 03:43 . 2007-06-03 04:47 -------- d-----w- c:\program files\Finale 2006

2010-08-27 23:17 . 2010-07-26 03:24 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-08-27 23:11 . 2010-07-26 03:18 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX

2010-08-27 23:11 . 2005-03-04 06:59 -------- d-----w- c:\program files\DivX

2010-08-27 23:07 . 2010-07-26 03:24 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll

2010-08-27 23:07 . 2010-07-26 03:24 850200 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe

2010-08-25 01:57 . 2007-05-10 01:21 -------- d-----w- c:\program files\Notation

2010-08-25 01:44 . 2010-05-02 23:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\FileZilla

2010-08-25 01:25 . 2007-03-11 01:54 -------- d-----w- c:\program files\Free Audio Pack

2010-08-25 01:06 . 2007-09-09 00:33 -------- d-----w- c:\program files\Anvil Studio

2010-08-25 01:05 . 2006-11-27 05:56 -------- d-----w- c:\program files\AmazingMIDI

2010-08-24 12:45 . 2009-01-12 02:49 -------- d-----w- c:\program files\Orbitdownloader

2010-08-23 02:13 . 2005-04-27 02:13 -------- d-----w- c:\program files\SONY

2010-08-22 11:31 . 2010-08-22 11:31 -------- d-----w- c:\documents and settings\Guest\Application Data\Thunderbird

2010-08-22 11:29 . 2010-08-22 11:29 -------- d-----w- c:\documents and settings\Guest\Application Data\Ipswitch

2010-08-22 11:23 . 2010-08-22 11:23 61440 ----a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-21234bee-n\decora-sse.dll

2010-08-22 11:23 . 2010-08-22 11:23 503808 ----a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-438c847d-n\msvcp71.dll

2010-08-22 11:23 . 2010-08-22 11:23 499712 ----a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-438c847d-n\jmc.dll

2010-08-22 11:23 . 2010-08-22 11:23 348160 ----a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-438c847d-n\msvcr71.dll

2010-08-22 11:23 . 2010-08-22 11:23 12800 ----a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-21234bee-n\decora-d3d.dll

2010-08-22 11:18 . 2010-08-22 11:18 -------- d-----w- c:\documents and settings\Guest\Application Data\Windows Desktop Search

2010-08-22 11:18 . 2010-08-22 11:18 -------- d-----w- c:\documents and settings\Guest\Application Data\Logitech

2010-08-22 11:05 . 2010-08-04 13:13 98842 ----a-w- c:\windows\system32\drivers\ialmkchw.sys

2010-08-21 17:32 . 2005-02-11 00:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-08-21 14:30 . 2010-08-21 13:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVS4YOU

2010-08-21 13:08 . 2010-08-21 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU

2010-08-21 13:08 . 2010-08-21 13:06 -------- d-----w- c:\program files\Common Files\AVSMedia

2010-08-21 13:08 . 2010-08-21 13:06 -------- d-----w- c:\program files\AVS4YOU

2010-08-21 01:51 . 2010-08-15 02:40 -------- d-----w- c:\program files\Microsoft Bootvis

2010-08-20 04:23 . 2005-02-13 00:48 -------- d-----w- c:\program files\Macromedia

2010-08-20 04:09 . 2010-08-20 04:09 -------- d-----w- c:\program files\VS Revo Group

2010-08-20 02:36 . 2008-04-16 01:27 -------- d-----w- c:\documents and settings\Administrator\Application Data\DNA

2010-08-19 23:26 . 2005-02-10 14:55 -------- d-----w- c:\program files\Common Files\InstallShield

2010-08-18 13:36 . 2008-04-16 01:27 -------- d-----w- c:\program files\DNA

2010-08-18 13:03 . 2008-09-16 00:18 -------- d-----w- c:\program files\QuickTime

2010-08-17 13:17 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-17 04:11 . 2007-09-23 06:32 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)

2010-08-17 03:48 . 2008-12-04 04:14 -------- d-----w- c:\program files\Mp3tag

2010-08-17 03:00 . 2009-03-25 00:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-16 23:42 . 2008-06-29 23:42 -------- d-----w- c:\program files\Audacity

2010-08-16 01:28 . 2010-08-16 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY

2010-08-16 01:25 . 2010-08-16 01:25 -------- d-----w- c:\program files\HP

2010-08-15 22:12 . 2008-12-04 02:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Symantec

2010-08-15 13:54 . 2009-08-21 03:08 -------- d-----w- c:\program files\Symantec

2010-08-15 13:54 . 2005-02-11 00:38 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-08-15 13:53 . 2010-08-15 13:53 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_GenericMount_01009.Wdf

2010-08-15 13:53 . 2010-08-15 13:53 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

2010-08-15 13:52 . 2010-08-15 13:52 -------- d-----w- c:\program files\Norton Ghost

2010-08-15 13:52 . 2010-08-15 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3}

2010-08-15 02:40 . 2010-08-15 02:40 1078 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_4ae13d6c.exe

2010-08-15 02:40 . 2010-08-15 02:40 1078 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_2cd672ae.exe

2010-08-15 02:40 . 2010-08-15 02:40 1078 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_294823.exe

2010-08-15 02:40 . 2010-08-15 02:40 1078 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0F9196C6-58B4-445B-B56E-B1200FECC151}\_18be6784.exe

2010-08-14 14:52 . 2010-08-14 14:52 -------- d-----w- c:\documents and settings\Administrator\Application Data\Tific

2010-08-14 04:45 . 2005-03-23 02:19 -------- d-----w- c:\program files\Yahoo!

2010-08-14 04:02 . 2010-08-14 04:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\EMCO

2010-08-14 04:02 . 2010-08-14 04:02 80099 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{59DD18C1-377F-4895-9AE6-3DD0E9CBE602}\i2010.07.30.exe

2010-08-14 04:02 . 2010-08-14 04:02 -------- d-----w- c:\program files\EMCO

2010-08-13 23:28 . 2008-07-17 03:59 -------- d-----w- c:\program files\Mobysaurus Thesaurus

2010-08-13 23:25 . 2007-04-01 02:07 -------- d-----w- c:\program files\TallStick

2010-08-13 23:22 . 2005-02-12 08:28 -------- d-----w- c:\program files\Transcribe!

2010-08-13 02:11 . 2007-12-25 01:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Yahoo!

2010-08-13 02:10 . 2007-12-23 01:43 -------- d--h--r- c:\documents and settings\All Users\Application Data\yahoo!

2010-08-12 05:52 . 2010-08-12 05:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia

2010-08-12 05:48 . 2010-08-12 05:48 -------- d-----w- c:\program files\DIFX

2010-08-12 05:48 . 2010-08-12 05:48 -------- d-----w- c:\program files\PC Connectivity Solution

2010-08-12 05:46 . 2010-08-12 05:46 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4ECA710C-B818-4751-A3B8-42C2D93922A8}\Installer\CommonCustomActions\Sleep.exe

2010-08-12 05:46 . 2010-08-12 05:46 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4ECA710C-B818-4751-A3B8-42C2D93922A8}\Installer\CommonCustomActions\msxml6Exec.exe

2009-04-01 03:47 . 2009-03-31 02:54 324976 -c--a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]

"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 19968]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2010-06-20 38840]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-06-19 640440]

"CTHelper"="CTHELPER.EXE" [2010-03-19 19456]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-25 198160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-5-6 813584]

NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2008-7-1 2326528]

Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-1-11 1835069]

WOW HD DivX Edition.lnk - c:\windows\Installer\{6451C1EB-0DF2-4F96-9F7C-5F7DA9C4E4AE}\NewShortcut2_3CDD5AA270824DF4A30D02AE3DC4D6F5.exe [2010-8-4 156952]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2009-07-20 17:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\DNA\\btdna.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=

"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6346:TCP"= 6346:TCP:Shareaza

"6346:UDP"= 6346:UDP:Shareaza

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

"3728:TCP"= 3728:TCP:Gigatribe

"1050:TCP"= 1050:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 MDPMGRNT;MDPMGRNT;c:\windows\system32\drivers\MDPMGRNT.SYS [10/29/2001 7:19 PM 23120]

R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\system32\drivers\ppa.sys [4/28/2005 4:35 PM 17792]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [9/21/2010 4:10 PM 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [9/21/2010 4:10 PM 173104]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20100901.003\BHDrvx86.sys [8/31/2010 5:57 PM 692272]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [9/21/2010 4:10 PM 501888]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 1:25 PM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 1:41 PM 67656]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [9/21/2010 4:10 PM 116784]

R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [9/14/2010 8:55 PM 20328]

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [10/9/2007 1:13 PM 38144]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [5/6/2009 6:34 PM 10384]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/24/2009 7:05 PM 304464]

R2 N360;Norton 360;c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\ccsvchst.exe [9/21/2010 4:09 PM 126392]

R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [3/18/2010 8:39 PM 99416]

R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [3/18/2010 8:39 PM 555096]

R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [3/18/2010 8:39 PM 566360]

R3 GenericMount;Generic Mount Driver;c:\windows\system32\drivers\GenericMount.sys [2/12/2010 7:10 AM 57840]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20100920.001\IDSXpx86.sys [9/21/2010 2:07 AM 331640]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/24/2009 7:05 PM 20952]

R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [12/28/2007 3:02 PM 287232]

R3 SRS_WOWHD_DivX_Service;WOW HD DivX Edition;c:\windows\system32\drivers\SRS_DivX_i386.sys [8/4/2010 11:01 PM 246000]

R3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2/11/2010 2:34 AM 1964528]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S2 Powert;Powertweak NT helper; [x]

S3 CamdDriverV32;CamdDriverV32;c:\windows\system32\drivers\CamdDriverV32.sys [4/30/2008 10:24 PM 508544]

S3 CamdVideo32;CamdVideo32;c:\windows\system32\drivers\CamdVideo32.sys [4/30/2008 10:24 PM 3768]

S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [3/18/2010 8:39 PM 99416]

S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 10:58 AM 11336]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [8/11/2010 10:19 PM 79360]

S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [3/18/2010 8:39 PM 555096]

S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [3/18/2010 8:39 PM 100952]

S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [3/18/2010 8:39 PM 100952]

S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [3/18/2010 8:39 PM 566360]

S3 Dnpiesam;Dnpiesam; [x]

S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [9/9/2010 11:31 PM 23456]

S3 GenericMount Helper Service;GenericMount Helper Service;c:\program files\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [2/12/2010 7:09 AM 1574408]

S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\ICDUSB2.sys [4/26/2005 9:13 PM 39048]

S3 MDFSYSNT;MDFSYSNT;c:\windows\system32\drivers\MDFSYSNT.SYS [11/13/2001 4:53 PM 214192]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [8/19/2010 11:09 PM 27064]

S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [8/4/2004 7:00 AM 5120]

S3 tbcspud;Santa Cruz Driver;c:\windows\system32\drivers\tbcspud.sys --> c:\windows\system32\drivers\tbcspud.sys [?]

S3 tbcwdm;Santa Cruz WDM Driver;c:\windows\system32\drivers\tbcwdm.sys --> c:\windows\system32\drivers\tbcwdm.sys [?]

S3 TfNetMon;TfNetMon; [x]

--- Other Services/Drivers In Memory ---

*Deregistered* - EraserUtilDrv11010

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]

2008-02-25 16:55 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe

.

Contents of the 'Scheduled Tasks' folder

2010-09-21 c:\windows\Tasks\AdobeAAMUpdater-1.0-PC-Administrator.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-08-30 08:44]

2010-09-15 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]

2009-04-11 c:\windows\Tasks\NSSstub.job

- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-02-22 03:08]

2010-09-20 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2010-09-18 13:25]

2006-03-04 c:\windows\Tasks\TASKMAN.job

- c:\windows\TASKMAN.EXE [2005-02-09 12:00]

2010-09-21 c:\windows\Tasks\User_Feed_Synchronization-{BA7CB6CD-0601-49EF-B37B-19A3F2AFBBB5}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]

2010-09-20 c:\windows\Tasks\Windows Codec Update Service.job

- c:\program files\Essentials Codec Pack\WECPUpdate.exe [2010-05-30 13:17]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/advanced_search?hl=en

uInternet Settings,ProxyServer = 192.168.2.1:80

uInternet Settings,ProxyOverride = *.local

IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204

IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202

Trusted Zone: hp.com\www

Trusted Zone: intel.com\www

Trusted Zone: microsoft.com\update

TCP: {83A0B5BD-B723-4A46-94D4-5C9AA4EA17A9} = 208.67.220.220,208.67.222.222

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7ky188m3.default\

FF - prefs.js: browser.search.selectedEngine - JobSearch - Dice.com

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/advanced_search?hl=en

FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\coFFPlgn\components\coFFPlgn.dll

FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\IPSFFPlgn\components\IPSFFPl.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdrmv2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdsplay.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwmsdrm.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-ares - c:\program files\Ares\Ares.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-21 22:06

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CTHelper = CTHELPER.EXE?

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\N360]

"ImagePath"="\"c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\Iomega Activity Disk2]

"ImagePath"="\"\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-1604221776-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c9,33,da,92,7e,f0,a6,49,91,ac,4c,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c9,33,da,92,7e,f0,a6,49,91,ac,4c,\

[HKEY_USERS\S-1-5-21-1614895754-1604221776-725345543-500\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(5944)

c:\windows\system32\WININET.dll

c:\program files\Logitech\SetPoint\lgscroll.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-09-21 22:11:39

ComboFix-quarantined-files.txt 2010-09-22 03:11

ComboFix2.txt 2010-08-29 19:22

Pre-Run: 8,266,211,328 bytes free

Post-Run: 7,610,093,568 bytes free

- - End Of File - - CC4BE2470DD00125A129955229E6624D

Elise · September 22, 2010

Hi, I see no active malware here that could cause IP blocks, but I see you are using a proxy. Looks like you direct all traffic to your router through port 80 (HTTP port). Any reason for this? Because it is not very secure to do and it is well possible this is the cause for the blocks.

okieseeker · September 23, 2010

I don't remember how that setting was configured, whether I did it or it was some kind of software default. Can you advise me the best way to change it? Any advice appreciated.

Elise · September 23, 2010

The simplest solution would be to reset your router. It should have a button for that that can be pushed with a small object like a pen. You need to hold it for about 10 seconds when the router is turned off on most models.

okieseeker · September 24, 2010

The router is controlled by the guy who own this house. As a renter, part of my deal with him is that I have Internet connectivity via a wireless connection to the router. If I understand this situation correctly, there's nothing I can do about the port problem short of persuading him to reconfigure the router.

Elise · September 24, 2010

Yes, that is true. What you can ask, is if there are other computers using the same connection that are having similar problems. If that is the case, its clearly the router. You can try to explain that.

Maurice Naggar · October 6, 2010

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

GMER failed twice

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information