chumpstar Posted December 17, 2010 ID:362351 Share Posted December 17, 2010 Just notified by pc that I have the lovely Alureon.h virus. Followed instructions for removal by Windows Defender and it said it was partially removed and then told me to restart. When I restarted, nothing further happened, no notices from WD, and nothing from my Norton (which never told me about the virus in the first place, thanks Norton!) So far, I haven't noticed anything actually wrong with my machine and wouldn't have even know I was infected until I got the prompt to scan but I would like to get a head start on this nasty if possible, thanks!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:05:58 AM, on 12/17/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exeC:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exeC:\WINDOWS\LTMSG.exeC:\windows\system\hpsysdrv.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\hphmon05.exeC:\Program Files\Logitech\MouseWare\system\em_exec.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\drivers\WDelMgr20.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepageR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\IPSBHO.DLLO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)O4 - HKLM\..\Run: [ViewMgr] "C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe"O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.ExeO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: RaptisoftGameLoader - http://www.arcadetown.com/swf/hamsterball/...tgameloader.cabO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cabO16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} (GameTap Player) - http://archives.gametap.com/static/cab_hea...apWebPlayer.cabO16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...k.cab102118.cabO16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://archives.gametap.com/static/cab_hea...pWebUpdater.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cabO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exeO23 - Service: WDelMgr20 - Unknown owner - C:\WINDOWS\system32\drivers\WDelMgr20.exe--End of file - 5778 bytes Link to post Share on other sites More sharing options...
negster22 Posted December 17, 2010 ID:362430 Share Posted December 17, 2010 Download DDS and save it to your desktop from >Here<Disable any script blocking programs you may have installed (such as Norton script blocking), and then double-click dss.scr to run the tool.When done, DDS will open two (2) logs:DDS.txtAttach.txt[*]Save both reports to your desktop[*]Please copy and paste dds.txt into your next reply (do NOT attach and hold on to attach.txt for now).-------Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage:http://www.gmer.net/download.phpDisable the active protection component of your antivirus and antispyware programs by following the directions that apply here:http://www.bleepingcomputer.com/forums/topic114351.html</a>Next, please perform a rootkit scan:Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to run the program. When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.When the scan is finished (a few seconds, Save the scan log to the Windows clipboard)Open Notepad or a similar text editor Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl VExit the ProgramSave the Scan log as ARKQ.txt and post it in your next reply. If the log is very long attach it please.-------Download Microsoft's Malicious Software Removal Tool (MSRT) to your desktop:http://www.microsoft.com/downloads/en/deta...;displaylang=enSave and Rename it as You download it to iexplore.exeDouble-click iexplore.exe on your Desktop to run itIn the "Scan Type" window, select Full Scan Perform a scan and the Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply:1) Click on Start, Run2) Type or Copy/Paste the following command to the "Run Line" and Press Enternotepad c:\windows\debug\mrt.logPlease copy/paste the following into your next reply:1. DDS.txt2. ARKQ.txt3. mrt.log Link to post Share on other sites More sharing options...
chumpstar Posted December 17, 2010 Author ID:362458 Share Posted December 17, 2010 I ran the DDS scan but when I tried to run the randomly named file in the ARK folder my pc crashed to blue screen critical error. Here is the DDS txt and just so you know, I removed about 20k lines of code from GameTap's YummyPlayer because there is so much of it that i would have to cut and paste 3 separate entries just to fit it all in here. To give you an idea of what I'm talking about, imagine 3 reply posts of just this - /* GAMETAP */FF - user.js: capability.principal.codebase.YummyPlayer_GTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_GTUS.id - hxxp://www.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_SGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_SGTUS.id - hxxps://www.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_IGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_IGTUS.id - hxxp://integ.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_ISGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_ISGTUS.id - hxxps://integ.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_IIGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_IIGTUS.id - hxxp://gtus.int.metaboli.fr/FF - user.js: capability.principal.codebase.YummyPlayer_IISGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_IISGTUS.id - hxxps://gtus.int.metaboli.fr/FF - user.js: capability.principal.codebase.YummyPlayer_PPGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_PPGTUS.id - hxxp://preprod.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_PPSGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_PPSGTUS.id - hxxps://preprod.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_PPPSGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_PPPSGTUS.id - hxxp://unlimited-preprod.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_SPPPSGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_SPPPSGTUS.id - hxxps://unlimited-preprod.gametap.com/FF - user.js: capability.principal.codebase.YummyPlayer_PPPSGTUS.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_PPPSGTUS.id - hxxp://retro-preprod.gametap.com/Here is the short version of the DDS.txtDDS (Ver_10-12-12.02) - NTFSx86 Run by Owner at 14:41:21.85 on Fri 12/17/2010Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_21Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.477 [GMT -8:00]AV: Norton AntiVirus Online *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupsvchost.exesvchost.exeC:\WINDOWS\system32\spoolsv.exesvchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exeC:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exeC:\WINDOWS\LTMSG.exeC:\windows\system\hpsysdrv.exeC:\WINDOWS\System32\svchost.exe -k imgsvcC:\WINDOWS\System32\hphmon05.exeC:\Program Files\Logitech\MouseWare\system\em_exec.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\drivers\WDelMgr20.exeC:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exeC:\Program Files\PurePlay\Poker\PurePlayPoker.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Owner\My Documents\Downloads\dds.scr============== Pseudo HJT Report ===============uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepagemStart Page = hxxp://my.yahoo.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = <local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sBHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No FileBHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dllBHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dllBHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\engine\17.8.0.5\IPSBHO.DLLBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No FileTB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No FileTB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No FileEB: {32683183-48a0-441b-a342-7c2a440a9478} - No FileuRun: [ctfmon.exe] c:\windows\system32\ctfmon.exemRun: [ViewMgr] "c:\program files\viewpoint\viewpoint manager\ViewMgr.exe"mRun: [Recguard] c:\windows\sminst\RECGUARD.EXEmRun: [LTMSG] LTMSG.exe 7mRun: [Logitech Utility] Logi_MwX.ExemRun: [hpsysdrv] c:\windows\system\hpsysdrv.exemRun: [HPHmon05] c:\windows\system32\hphmon05.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartupmRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInitmRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dllTrusted Zone: gametap.com\wwwTrusted Zone: musicmatch.com\onlineDPF: Microsoft XML Parser for JavaDPF: RaptisoftGameLoader - hxxp://www.arcadetown.com/swf/hamsterball/raptisoftgameloader.cabDPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cabDPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cabDPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} - hxxp://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabDPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cabDPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebUpdater.cabDPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabNotify: igfxcui - igfxsrvc.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll================= FIREFOX ===================FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\gxgc9m86.default\FF - prefs.js: browser.startup.homepage - hxxp://www.gametap.com/FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\ipsffplgn\components\IPSFFPl.dllFF - component: c:\program files\mozilla firefox\extensions\yplayer@yummy.net\components\FYPlayer.dllFF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxgc9m86.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dllFF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxgc9m86.default\extensions\gametapplayer@gametap.com\plugins\npGameTapWebPlayer.dllFF - plugin: c:\documents and settings\owner\local settings\application data\unity\webplayer\loader\npUnity3D32.dllFF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}FF - Ext: Yummy Games Player: YPlayer@yummy.net - c:\program files\mozilla firefox\extensions\YPlayer@yummy.netFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtensionFF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\IPSFFPlgnFF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ffFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}FF - Ext: GameTap: GameTapPlayer@gametap.com - %profile%\extensions\GameTapPlayer@gametap.comFF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}============= SERVICES / DRIVERS ===============R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1108000.005\symds.sys [2010-9-23 328752]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1108000.005\symefa.sys [2010-9-23 173104]R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\bashdefs\20101123.003\BHDrvx86.sys [2010-11-22 691248]R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nav\1108000.005\cchpx86.sys [2010-9-23 501888]R1 NtFsLdf20;NtFsLdf20;c:\windows\system32\drivers\NtFsLdf20.sys [2004-11-7 31660]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1108000.005\ironx86.sys [2010-9-23 116784]R2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\17.8.0.5\ccsvchst.exe [2010-9-23 126392]R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2004-6-14 2368]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-27 102448]R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\ipsdefs\20101215.001\IDSXpx86.sys [2010-12-16 341944]R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\virusdefs\20101217.002\NAVENG.SYS [2010-12-17 86008]R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_17.0.0.136\definitions\virusdefs\20101217.002\NAVEX15.SYS [2010-12-17 1360760]S1 uidzpipc;uidzpipc;\??\c:\windows\system32\drivers\uidzpipc.sys --> c:\windows\system32\drivers\uidzpipc.sys [?]=============== Created Last 30 ==================================== Find3M ====================2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll2010-11-05 05:05:36 667136 ----a-w- c:\windows\system32\wininet.dll2010-11-05 05:05:36 61952 ----a-w- c:\windows\system32\tdc.ocx2010-11-05 05:05:35 81920 ----a-w- c:\windows\system32\ieencode.dll2010-11-03 12:59:07 369664 ----a-w- c:\windows\system32\html.iec2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys2007-12-13 05:26:24 50688 -c--a-w- c:\program files\ATF-Cleaner.exe============= FINISH: 14:44:41.48 =============== Link to post Share on other sites More sharing options...
negster22 Posted December 17, 2010 ID:362465 Share Posted December 17, 2010 I appreciate you removing the glut of game entries.Download TFC to your desktophttp://oldtimer.geekstogo.com/TFC.exe Close any open windows.Double click the TFC icon to run the programTFC will close all open programs itself in order to run,Click the Start button to begin the process.Allow TFC to run uninterrupted.The program should not take long to finish it's jobOnce its finished it should automatically reboot your machine,if it doesn't, manually reboot to ensure a complete cleanIt's normal after running TFC cleaner that the PC will be slower to boot the first time.Please download exeHelper to your desktop.Double-click on exeHelper.com to run the fix.A black window should pop up, press any key to close once the fix is completed.Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)Let's try another ARK since the other one BSOD'ed!Please download Rootkit Unhooker and save it on your desktop.http://www.kernelmode.info/ARKs/RkU3.8.388.590.rarIf your unzipping program doesn't unzip RAR files, then you can download and install 7-Zip to accomplish that.http://www.7-zip.org/Just right click the RAR file you downloaded to your desktop, and choose the 7-Zip -> "Extract here" option from the context menu. Temporarily disable your antivirus and antimalware real-time protection before performing a scan by following the directions that apply HERE Double-click RkU3.8.388.590.exe to run the program Click the Report tab, then click Scan Check Drivers, and Stealth Code Uncheck the rest, then click OK When prompted to Select Disks for Scan, make sure C:\ is checked and click OK Wait till the scanner has finished then go File > Save Report Save the report somewhere you can find it. Click Close Re-enable your security programs Copy the entire contents of the report and paste it in your next reply.Note - If You get this warning it is ok, just ignore it: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?"===============| Reboot | ===============Rerun exeHelper by Double-clicking on exeHelper.comA black window should pop up, press any key to close once the fix is completed.Do NOT reboot before this next step.Please Run ComboFix by following the steps provided in exactly this sequence:(since I am advising You to rename the Combofix EXE to iexplore.exe as You will see, you should run the MSRT first, and then delete that installer that You renamed iexplore.exe previously)Here is a tutorial that describes how to download, install and run Combofix. Please thoroughly review it beofre proceeding:http://www.bleepingcomputer.com/combofix/how-to-use-combofixVery Important! BEFORE downloading Combofix, temporarily disable your antivirus and antimalware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix and even remove onboard components so it is rendered ineffective:http://www.bleepingcomputer.com/forums/topic114351.htmlNote: The above tutorial does not tell you to rename Combofix as I am about to instruct you to do in the following instructions, so make sure you complete the renaming step before launching Combofix.Using ComboFix ->Please download Combofix from one of these locations:HERE or HERE I want you to rename Combofix.exe as you download it to iexplore.exeNotes:It is very important that save the newly renamed EXE file to your desktop.You must rename Combofixe.exe as you download it and not after it is on your computer.You may have to modify your browser settings if you use Firefox, so you can rename Combofix.exe as you download it. To do that:Open FirefoxClick Tools -> Options -> MainUnder the downloads section check the button that says "Always ask me where to save files".Click OK[*]For Internet Explorer:Choose to save, not open the fileWhen prompted - save the file to your desktop, and rename it anything with an .exe extension on the end.Running CombofixIn the event you already have Combofix, please delete it as this is a new version.Close any open browsers and programs.Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.If You are running Windows XP, and Combofix asks to install the Recovery Console, please allow it to do so or it WILL NOT perform it's normal malware removal capabilities. This is for your safety !! 1. To Launch Combofix Click Start --> Run, and enter this command exactly as shown:"%userprofile%\desktop\iexplore.exe" /killall 2. When finished, it will produce a logfile located at C:\ComboFix.txt 3. Post the contents of that log in your next reply.Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang. Please copy/paste the following into your next reply:1. RKU Log2. c:\windows\debug\mrt.log3. C:\Combofix.txt Link to post Share on other sites More sharing options...
chumpstar Posted December 18, 2010 Author ID:362531 Share Posted December 18, 2010 RKU log RkU Version: 3.8.388.590, Type LE (SR2)==============================================OS Name: Windows XPVersion 5.1.2600 (Service Pack 3)Number of processors #1==============================================>Drivers==============================================0xF4F4A000 C:\WINDOWS\system32\drivers\ALCXWDM.SYS 4128768 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))0xBD012000 C:\WINDOWS\System32\vtdisp.dll 3448832 bytes (VIA/S3 Graphics Co, Ltd., VIA/S3G Graphics Driver)0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System)0x804D7000 PnpManager 2189952 bytes0x804D7000 RAW 2189952 bytes0x804D7000 WMIxWDM 2189952 bytes0xBF800000 Win32k 1855488 bytes0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)0xF38B4000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20101123.003\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver)0xF7249000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)0xF3960000 C:\WINDOWS\system32\drivers\NAV\1108000.005\ccHPx86.sys 520192 bytes (Symantec Corporation, Common Client Hash Provider Driver)0xF3A5A000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)0xF39FC000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)0xF4E8C000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)0xF3D20000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)0xF3B86000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20101215.001\IDSxpx86.sys 360448 bytes (Symantec Corporation, IDS Core Driver)0xEEB50000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)0xF3C29000 C:\WINDOWS\System32\Drivers\NAV\1108000.005\SYMTDI.SYS 356352 bytes (Symantec Corporation, Network Dispatch Driver)0xF733F000 SYMDS.SYS 352256 bytes0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)0xEEBD0000 C:\WINDOWS\system32\DRIVERS\atksgt.sys 274432 bytes0xEE442000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)0xF7438000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)0xEECB3000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)0xF721C000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)0xF7300000 SYMEFA.SYS 184320 bytes0xEE0CF000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)0xF3ACA000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)0xF541C000 C:\WINDOWS\System32\DRIVERS\vtmini.sys 176128 bytes (Copyright © VIA/S3 Graphics Co, Ltd., VIA/S3G Miniport Driver)0xF3B5E000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)0xF3C03000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)0xF3BDE000 C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library)0xF3890000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)0xF4F26000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))0xF533A000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)0xF73CD000 fasttx2k.sys 143360 bytes (Promise Technology, Inc., Promise FastTrak Series Driver for WindowsXP)0xF5385000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)0xF3B3C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)0x806EE000 ACPI_HAL 131840 bytes0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)0xF7395000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)0xF7408000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)0xF3B1D000 C:\WINDOWS\system32\drivers\NAV\1108000.005\Ironx86.SYS 126976 bytes (Symantec Corporation, Iron Driver)0xF39DF000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)0xF71F1000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)0xF73F0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)0xF3878000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes0xF73B5000 C:\WINDOWS\System32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)0xF72E9000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)0xF4EFB000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))0xEE9D3000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)0xF4F12000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)0xF5408000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)0xF3D79000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)0xF72D6000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)0xF732D000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)0xF7427000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)0xF4EEA000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)0xF720B000 sfdrv01.sys 69632 bytes (Protection Technology, StarForce Protection Environment Driver)0xEE71B000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)0xF75D7000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)0xF69F4000 C:\WINDOWS\System32\Drivers\LMouFlt2.sys 65536 bytes (Logitech, Inc., Logitech Filter Driver for Mouse Class.)0xF7557000 C:\WINDOWS\System32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)0xF7507000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)0xF74F7000 prohlp02.sys 65536 bytes (Protection Technology, StarForce Protection Helper Driver)0xF7657000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)0xF6A14000 C:\WINDOWS\System32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)0xF7637000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)0xF75E7000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)0xEED80000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)0xF76D7000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)0xF7517000 C:\WINDOWS\System32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)0xF74C7000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)0xF7667000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)0xF69A4000 C:\WINDOWS\System32\drivers\prodrv06.sys 53248 bytes (Protection Technology, StarForce Protection Environment Driver)0xF7677000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)0xF74A7000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)0xF7697000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)0xF7527000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)0xF7647000 C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys 45056 bytes (VIA Technologies, Inc. , NDIS 5.0 miniport driver)0xF7567000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)0xF75B7000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)0xF7497000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)0xF7687000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)0xF7597000 C:\WINDOWS\System32\DRIVERS\amdk7.sys 40960 bytes (Microsoft Corporation, Processor Device Driver)0xF7487000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)0xF76C7000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)0xF37C0000 C:\WINDOWS\System32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)0xF69D4000 C:\WINDOWS\system32\drivers\NAV\1108000.005\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect)0xF76B7000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)0xF75C7000 C:\WINDOWS\System32\Drivers\AFS2K.SYS 36864 bytes (Oak Technology Inc., Audio File System)0xF74B7000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)0xF6A24000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)0xF76A7000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)0xF6A04000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)0xEEB18000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)0xF74D7000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)0xF74E7000 SISAGPX.sys 36864 bytes (Silicon Integrated Systems Corporation, SiS AGPv3.5 Filter)0xF6A34000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)0xF7777000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)0xF787F000 C:\WINDOWS\System32\Drivers\NtFsLdf20.SYS 32768 bytes (Windows ® 2000 DDK provider, File detection driver)0xF7727000 sfhlp02.sys 32768 bytes (Protection Technology, StarForce Protection Helper Driver)0xF77A7000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)0xF777F000 C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CD/DVD Class Filter Driver)0xF7787000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)0xF7707000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)0xF771F000 viaagp1.sys 28672 bytes (VIA Technologies, Inc., VIA NT AGP Filter)0xF77F7000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)0xF77BF000 C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys 24576 bytes (Logitech, Inc., Logitech HID Filter Driver.)0xF783F000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)0xF772F000 nv_agp.sys 24576 bytes0xF77EF000 C:\WINDOWS\System32\DRIVERS\PS2.sys 24576 bytes (Hewlett-Packard Company, PS2 SYS)0xF7717000 sfsync02.sys 24576 bytes (Protection Technology, StarForce Protection Synchronization Driver)0xF7797000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)0xF7887000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)0xF784F000 C:\Program Files\GameTap Web Player\bin\release\X4HSX32.Sys 24576 bytes (Exent Technologies Ltd., X4HSX32 Kernel Mode Driver)0xF77E7000 C:\WINDOWS\system32\DRIVERS\lirsgt.sys 20480 bytes0xF7767000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)0xF7827000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)0xF7837000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)0xF7817000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)0xF7847000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)0xF7917000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)0xEEF20000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)0xF719F000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)0xF7897000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)0xF3DBC000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)0xF71AB000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)0xF7197000 C:\WINDOWS\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)0xF7193000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)0xF7963000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)0xF4E88000 C:\WINDOWS\System32\DRIVERS\srvkp.sys 12288 bytes (Silicon Integrated Systems Corporation, SiS VGA Driver Manager)0xF71A3000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)0xF79F3000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)0xF7A21000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes0xF79E7000 C:\WINDOWS\System32\drivers\enodpl.sys 8192 bytes0xF79EF000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)0xF7987000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)0xF79F7000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)0xF79E1000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)0xF798F000 prosync1.sys 8192 bytes (Protection Technology, StarForce Protection Synchronization Driver)0xF79FB000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)0xF798D000 sfhlp01.sys 8192 bytes (Protection Technology, StarForce Protection Helper Driver)0xF79E3000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)0xF79FF000 C:\WINDOWS\System32\drivers\tandpl.sys 8192 bytes0xF79E9000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)0xF798B000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)0xF7989000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)0xF7ADD000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)0xF7AA9000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)0xF7B14000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)0xF7BBD000 C:\WINDOWS\System32\SVKP.sys 4096 bytes (AntiCracking, SVKP driver for NT)0xE1953828 unknown_irp_handler 2008 bytes0xE18388A8 unknown_irp_handler 1880 bytes==============================================>Stealth==============================================WARNING: Virus alike driver modification [hsfdpsp2.sys]WARNING: Virus alike driver modification [atinrvxx.sys]WARNING: Virus alike driver modification [a308.sys]WARNING: Virus alike driver modification [a314.sys]WARNING: Virus alike driver modification [emDevice.sys]WARNING: Virus alike driver modification [wadv08nt.sys]WARNING: Virus alike driver modification [a302.sys]WARNING: Virus alike driver modification [ialmsbw.sys]WARNING: Virus alike driver modification [ati1mdxx.sys]WARNING: Virus alike driver modification [acpiec.sys]WARNING: Virus alike driver modification [cpqdap01.sys]WARNING: Virus alike driver modification [wadv07nt.sys]WARNING: Virus alike driver modification [a305.sys]WARNING: Virus alike driver modification [mdmxsdk.sys]WARNING: Virus alike driver modification [wadv09nt.sys]WARNING: Virus alike driver modification [wadv11nt.sys]WARNING: Virus alike driver modification [nikedrv.sys]WARNING: Virus alike driver modification [rio8drv.sys]WARNING: Virus alike driver modification [riodrv.sys]WARNING: Virus alike driver modification [ws2ifsl.sys]WARNING: Virus alike driver modification [ati1pdxx.sys]WARNING: Virus alike driver modification [fsvga.sys]WARNING: Virus alike driver modification [nwlnkflt.sys]WARNING: Virus alike driver modification [ftdisk.sys]WARNING: Virus alike driver modification [mtlmnt5.sys]WARNING: Virus alike driver modification [slnt7554.sys]WARNING: Virus alike driver modification [mtlstrm.sys]WARNING: Virus alike driver modification [slwdmsup.sys]WARNING: Virus alike driver modification [recagent.sys]WARNING: Virus alike driver modification [atinmdxx.sys]WARNING: Virus alike driver modification [atinttxx.sys]WARNING: Virus alike driver modification [cbidf2k.sys]WARNING: Virus alike driver modification [Fasttx2k.sys]WARNING: Virus alike driver modification [LCCFLTR.SYS]WARNING: Virus alike driver modification [atinpdxx.sys]WARNING: Virus alike driver modification [smclib.sys]WARNING: Virus alike driver modification [a306.sys]WARNING: Virus alike driver modification [HPZipr12.sys]WARNING: Virus alike driver modification [s3gnbm.sys]WARNING: Virus alike driver modification [vtmini.sys]WARNING: Virus alike driver modification [ntmtlfax.sys]WARNING: Virus alike driver modification [emFilter.sys]WARNING: Virus alike driver modification [vch.sys]WARNING: Virus alike driver modification [sfsync02.sys]WARNING: Virus alike driver modification [rtl8139.sys]WARNING: Virus alike driver modification [ati1ttxx.sys]WARNING: Virus alike driver modification [tsbvcap.sys]WARNING: Virus alike driver modification [HPZius12.sys]WARNING: Virus alike driver modification [a307.sys]WARNING: Virus alike driver modification [hsfbs2s2.sys]WARNING: Virus alike driver modification [watv06nt.sys]WARNING: Virus alike driver modification [PnkBstrK.sys]WARNING: Virus alike driver modification [emStream.sys]WARNING: Virus alike driver modification [watv10nt.sys]WARNING: Virus alike driver modification [a309.sys]WARNING: Virus alike driver modification [cinemst2.sys]WARNING: Virus alike driver modification [ati1snxx.sys]WARNING: Virus alike driver modification [VIAAGP1.SYS]WARNING: Virus alike driver modification [atinsnxx.sys]WARNING: Virus alike driver modification [a303.sys]WARNING: Virus alike driver modification [ati1xbxx.sys]WARNING: Virus alike driver modification [ati1raxx.sys]WARNING: Virus alike driver modification [atmepvc.sys]WARNING: Virus alike driver modification [atinxbxx.sys]WARNING: Virus alike driver modification [nwlnkfwd.sys]WARNING: Virus alike driver modification [ati2mtaa.sys]WARNING: Virus alike driver modification [a311.sys]WARNING: Virus alike driver modification [a310.sys]WARNING: Virus alike driver modification [wa301a.sys]WARNING: Virus alike driver modification [wa301b.sys]WARNING: Virus alike driver modification [rawwan.sys]WARNING: Virus alike driver modification [ati1xsxx.sys]WARNING: Virus alike driver modification [atmuni.sys]WARNING: Virus alike driver modification [ati1tuxx.sys]WARNING: Virus alike driver modification [sISAGPX.SYS]WARNING: Virus alike driver modification [a313.sys]WARNING: Virus alike driver modification [LHIDUSB.SYS]WARNING: Virus alike driver modification [wpdusb.sys]WARNING: Virus alike driver modification [ALCXSENS.SYS]WARNING: Virus alike driver modification [sisgrp.sys]WARNING: Virus alike driver modification [slntamr.sys]WARNING: Virus alike driver modification [fetnd5b.sys]WARNING: Virus alike driver modification [mtxparhm.sys]WARNING: Virus alike driver modification [a304.sys]WARNING: Virus alike driver modification [R8139n51.sys]WARNING: Virus alike driver modification [sfdrv01.sys]WARNING: Virus alike driver modification [sfhlp01.sys]WARNING: Virus alike driver modification [emScan.sys]WARNING: Virus alike driver modification [hpzid412.sys]WARNING: Virus alike driver modification [tosdvd.sys]WARNING: Virus alike driver modification [L8042PR2.SYS]WARNING: Virus alike driver modification [atinraxx.sys]WARNING: Virus alike driver modification [nwlnkspx.sys]WARNING: Virus alike driver modification [ati1btxx.sys]WARNING: Virus alike driver modification [atinbtxx.sys]WARNING: Virus alike driver modification [vdmindvd.sys]WARNING: Virus alike driver modification [dmload.sys]WARNING: Virus alike driver modification [rootmdm.sys]WARNING: Virus alike driver modification [prohlp02.sys]WARNING: Virus alike driver modification [nwlnknb.sys]WARNING: Virus alike driver modification [atinxsxx.sys]WARNING: Virus alike driver modification [ati1rvxx.sys]WARNING: Virus alike driver modification [enum1394.sys]WARNING: Virus alike driver modification [ltmdmnt.sys]WARNING: Virus alike driver modification [sfhlp02.sys]WARNING: Virus alike driver modification [hsfcxts2.sys]WARNING: Virus alike driver modification [prosync1.sys]WARNING: Virus alike driver modification [ati2mtag.sys]WARNING: Virus alike driver modification [atintuxx.sys]WARNING: Virus alike driver modification [mcd.sys]WARNING: Virus alike driver modification [WudfPf.sys]WARNING: Virus alike driver modification [ialmkchw.sys]WARNING: Virus alike driver modification [WudfRd.sys]WARNING: Virus alike driver modification [ialmnt5.sys]WARNING: Virus alike driver modification [slnthal.sys] Link to post Share on other sites More sharing options...
chumpstar Posted December 18, 2010 Author ID:362532 Share Posted December 18, 2010 MSRT log---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.2, March 2005Started On Wed Mar 09 18:11:59 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 09 18:12:05 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.3, April 2005Started On Wed Apr 13 00:03:15 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 13 00:03:22 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.4, May 2005Started On Tue May 10 19:19:35 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue May 10 19:19:50 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.5, June 2005Started On Tue Jun 14 18:07:35 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Jun 14 18:07:52 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.6, July 2005Started On Wed Jul 13 09:09:21 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 13 09:09:41 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.7, August 2005Started On Fri Aug 12 19:05:36 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 12 19:05:50 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.8, September 2005Started On Tue Sep 13 17:05:30 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Sep 13 17:06:06 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.9, October 2005Started On Mon Oct 24 01:55:07 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Mon Oct 24 01:55:24 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.10, November 2005Started On Fri Nov 11 21:31:29 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Fri Nov 11 21:31:42 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.11, December 2005Started On Wed Dec 14 21:52:15 2005Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 14 21:52:32 2005---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.12, January 2006Started On Tue Jan 10 15:55:25 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 10 15:55:41 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.13, February 2006Started On Tue Feb 14 13:16:44 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 14 13:16:57 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.14, March 2006Started On Fri Mar 17 05:56:50 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Fri Mar 17 05:57:00 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.15, April 2006Started On Sat Apr 15 16:23:07 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Sat Apr 15 16:23:21 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.16, May 2006Started On Wed May 10 23:17:11 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed May 10 23:17:20 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.17, June 2006Started On Thu Jun 15 16:12:46 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Thu Jun 15 16:12:57 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.18, July 2006Started On Thu Jul 13 20:37:11 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Thu Jul 13 20:37:27 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.19, August 2006Started On Fri Aug 11 18:33:51 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 11 18:34:08 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.20, September 2006Started On Wed Sep 13 17:46:17 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 13 17:46:37 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.21, October 2006Started On Tue Oct 10 23:14:25 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Oct 10 23:14:39 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.22, November 2006Started On Wed Nov 15 09:06:39 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 15 09:06:54 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.22, November 2006Started On Wed Nov 22 21:54:35 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 22 21:55:03 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.22, November 2006Started On Wed Nov 22 22:03:21 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 22 22:03:40 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.23, December 2006Started On Wed Dec 13 15:04:03 2006Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 13 15:04:20 2006---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.24, January 2007Started On Tue Jan 09 22:33:09 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 09 22:33:27 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.25, February 2007Started On Fri Feb 16 12:11:00 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Fri Feb 16 12:11:28 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.27, March 2007Started On Thu Mar 15 18:48:36 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Thu Mar 15 18:48:57 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.28, April 2007Started On Thu Apr 12 10:31:34 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Thu Apr 12 10:32:03 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.29, May 2007Started On Tue May 08 14:21:50 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue May 08 14:23:09 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.30, June 2007Started On Wed Jun 13 08:54:06 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 13 08:55:49 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.31, July 2007Started On Tue Jul 10 20:48:06 2007->Scan ERROR: resource process://pid:5836 (code 0x0000054F (1359))->Scan ERROR: resource process://pid:3496 (code 0x0000054F (1359))Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Jul 10 20:50:28 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.32, August 2007Started On Tue Aug 14 19:50:28 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Aug 14 19:51:50 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.33, September 2007Started On Wed Sep 12 19:18:47 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 12 19:20:04 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.34, October 2007Started On Wed Oct 10 16:25:32 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 10 16:28:03 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.35, November 2007Started On Wed Nov 14 15:00:19 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 14 15:06:17 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.36, December 2007Started On Wed Dec 12 04:15:41 2007Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12 04:17:41 2007---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.37, January 2008Started On Wed Jan 09 09:04:31 2008Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 09 09:06:02 2008---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v1.38, February 2008Started On Tue Feb 12 21:56:08 2008->Scan ERROR: resource process://pid:2672 (code 0x00000057 (87))->Scan ERROR: resource process://pid:2672 (code 0x0000054F (1359))Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 12 21:57:42 2008---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v2.13, August 2009Started On Mon Aug 17 22:38:05 2009WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Mon Aug 17 22:39:58 2009---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v2.14, September 2009Started On Tue Sep 08 19:05:47 2009WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Sep 08 19:07:35 2009---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.0, October 2009Started On Tue Oct 13 20:17:23 2009WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Tue Oct 13 20:19:12 2009---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.1, November 2009Started On Wed Nov 11 02:12:27 2009WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Return code: 0Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 11 02:14:21 2009---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.5, March 2010Started On Sun Mar 21 22:20:18 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.G driver://atapi file://C:\WINDOWS\system32\DRIVERS\atapi.sys SigSeq: 0x0000247FB0A2CBE9 SHA1: FB840BBEF0388DE31CAC82177E07F019700DDEBAResults Summary:----------------Found Virus:Win32/Alureon.G, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Sun Mar 21 22:23:00 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.5, March 2010Started On Mon Mar 22 10:31:02 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.G driver://atapi file://C:\WINDOWS\system32\DRIVERS\atapi.sys SHA1: FB840BBEF0388DE31CAC82177E07F019700DDEBAMicrosoft Windows Malicious Software Removal Tool Finished On Mon Mar 22 10:33:19 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.5, March 2010Started On Mon Mar 22 19:28:25 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.G driver://atapi file://C:\WINDOWS\system32\DRIVERS\atapi.sys SigSeq: 0x0000247FB0A2CBE9 SHA1: FB840BBEF0388DE31CAC82177E07F019700DDEBAResults Summary:----------------Found Virus:Win32/Alureon.G, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Mon Mar 22 19:31:33 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.6, April 2010Started On Tue Apr 13 20:43:07 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Apr 13 20:45:36 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.7, May 2010Started On Tue May 11 20:25:12 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue May 11 20:27:59 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.8, June 2010Started On Fri Jun 11 18:20:40 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Fri Jun 11 18:23:57 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.8, June 2010Started On Fri Jun 11 20:41:45 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Microsoft Windows Malicious Software Removal Tool Finished On Fri Jun 11 20:45:26 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.9, July 2010Started On Wed Jul 14 22:34:42 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Wed Jul 14 22:39:06 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.9, July 2010Started On Thu Jul 15 15:51:38 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Microsoft Windows Malicious Software Removal Tool Finished On Thu Jul 15 15:56:09 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.10, August 2010Started On Wed Aug 25 17:23:57 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Wed Aug 25 17:26:51 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.10, August 2010Started On Wed Aug 25 17:44:08 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Microsoft Windows Malicious Software Removal Tool Finished On Wed Aug 25 18:34:50 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.11, September 2010Started On Tue Sep 14 22:28:55 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Tue Sep 14 22:31:37 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.11, September 2010Started On Wed Sep 15 17:08:47 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 15 18:31:36 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.12, October 2010Started On Tue Oct 12 22:14:11 2010WARNING: Security policy doesn't allow for all actions MSRT may require.Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Tue Oct 12 22:21:28 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.12, October 2010Started On Wed Oct 13 12:19:37 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 13 12:21:48 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.13, November 2010Started On Wed Nov 10 13:55:23 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Wed Nov 10 14:01:59 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.13, November 2010Started On Wed Nov 10 15:59:31 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Extended Scan Results----------------No infection found as part of the extended scanExtended Scan Removal Results----------------Start 'clean' for driver://nv_agpOperation succeeded !Start 'clean' for file://\\?\C:\WINDOWS\system32\DRIVERS\nv_agp.sysOperation failed (code=0x800f), please use a full antivirus product ! !Results Summary:----------------Found Virus:Win32/Alureon.H, partially removed.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 10 16:00:57 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.14, December 2010Started On Thu Dec 16 22:15:52 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Results Summary:----------------Found Virus:Win32/Alureon.H, full system scan needed to complete removalMicrosoft Windows Malicious Software Removal Tool Finished On Thu Dec 16 22:19:41 2010Return code: 7 (0x7)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.14, December 2010Started On Fri Dec 17 09:50:56 2010Quick Scan Results for 938A448F-8B79-4B5D-BE0D-6F978DDADDD9:----------------Threat detected: Virus:Win32/Alureon.H driver://nv_agp file://C:\WINDOWS\system32\DRIVERS\nv_agp.sys SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Extended Scan Removal Results----------------Start 'clean' for driver://nv_agpOperation succeeded !Start 'clean' for file://\\?\C:\WINDOWS\system32\DRIVERS\nv_agp.sysOperation was scheduled to be completed after next reboot.Results Summary:----------------For cleaning Virus:Win32/Alureon.H, the system needs to be restarted.Microsoft Windows Malicious Software Removal Tool Finished On Fri Dec 17 10:00:12 2010Return code: 10 (0xa)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.14, December 2010Started On Fri Dec 17 19:17:10 2010Extended Scan Results----------------->Scan ERROR: resource file://C:\hiberfil.sys (code 0x00000020 (32))->Scan ERROR: resource file://C:\pagefile.sys (code 0x00000020 (32))->Scan ERROR: resource file://C:\Program Files\Valve\Steam\SteamApps\common\left 4 dead\left4dead\downloads\f2baaac4.dat (code 0x00000017 (23))Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP171\A0064834.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP172\A0064855.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP170\A0064830.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP189\A0072290.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP192\A0073318.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP168\A0064721.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP179\A0066991.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056815.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP178\A0066970.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP189\A0072298.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP167\A0062649.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0069155.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP177\A0065959.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP186\A0069221.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058241.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0071279.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056526.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056692.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056780.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP154\A0056442.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP153\A0056378.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP151\A0055882.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP146\A0055469.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP141\A0055046.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055799.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0072317.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP185\A0069188.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP148\A0055628.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP141\A0055063.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP162\A0058277.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP143\A0055336.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP170\A0064759.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP148\A0055579.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP173\A0065890.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP150\A0055806.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP164\A0060481.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP166\A0060572.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP146\A0055463.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP144\A0055423.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP177\A0065969.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP185\A0069167.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP187\A0069232.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP181\A0067079.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP169\A0064755.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP179\A0067000.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067031.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0067142.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP168\A0063716.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP159\A0058152.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067052.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0072281.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP171\A0064840.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056930.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP159\A0058117.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP182\A0067091.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067013.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056868.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0072286.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP182\A0067141.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065893.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056680.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058274.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP173\A0065857.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065907.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0069149.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP153\A0056229.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP175\A0065926.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP186\A0069189.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP160\A0058184.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065924.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP163\A0058479.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP152\A0056225.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP152\A0056170.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP142\A0055089.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0072299.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP187\A0071232.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP162\A0058445.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP145\A0055437.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056728.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP164\A0060541.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055693.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058227.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP160\A0058191.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP176\A0065952.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP144\A0055366.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP175\A0065933.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055768.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP163\A0060478.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP184\A0069158.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP165\A0060568.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056674.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP157\A0056787.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP191\A0073313.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067025.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0073311.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP169\A0064749.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0067150.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP193\A0073397.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Threat detected: Virus:Win32/Alureon.H file://C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056831.SYS SigSeq: 0x0000247FD0F38616 SHA1: 3016F243C3991136C2E02DA7B0981D0D262E08E7Extended Scan Removal Results----------------Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP193\A0073397.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP192\A0073318.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP191\A0073313.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0073311.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0072317.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP190\A0072299.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP189\A0072298.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP189\A0072290.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0072286.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0072281.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP188\A0071279.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP187\A0071232.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP187\A0069232.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP186\A0069221.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP186\A0069189.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP185\A0069188.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP185\A0069167.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP184\A0069158.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0069155.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0069149.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0067150.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP183\A0067142.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP182\A0067141.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP182\A0067091.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP181\A0067079.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067052.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067031.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067025.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP180\A0067013.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP179\A0067000.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP179\A0066991.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP178\A0066970.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP177\A0065969.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP177\A0065959.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP176\A0065952.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP175\A0065933.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP175\A0065926.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065924.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065907.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP174\A0065893.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP173\A0065890.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP173\A0065857.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP172\A0064855.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP171\A0064840.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP171\A0064834.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP170\A0064830.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP170\A0064759.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP169\A0064755.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP169\A0064749.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP168\A0064721.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP168\A0063716.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP167\A0062649.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP166\A0060572.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP165\A0060568.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP164\A0060541.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP164\A0060481.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP163\A0060478.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP163\A0058479.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP162\A0058445.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP162\A0058277.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058274.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058241.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP161\A0058227.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP160\A0058191.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP160\A0058184.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP159\A0058152.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP159\A0058117.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056930.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056868.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056831.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP158\A0056815.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP157\A0056787.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056780.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056728.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP156\A0056692.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056680.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056674.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP155\A0056526.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP154\A0056442.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP153\A0056378.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP153\A0056229.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP152\A0056225.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP152\A0056170.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP151\A0055882.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP150\A0055806.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055799.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055768.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP149\A0055693.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP148\A0055628.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP148\A0055579.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP146\A0055469.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP146\A0055463.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP145\A0055437.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP144\A0055423.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP144\A0055366.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP143\A0055336.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP142\A0055089.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP141\A0055063.SYSOperation succeeded !Start 'clean' for file://\\?\C:\System Volume Information\_restore{BC9F3C70-F33F-48FB-93C7-198E1A9B1607}\RP141\A0055046.SYSOperation succeeded !Results Summary:----------------Found Virus:Win32/Alureon.H, partially removed and requires additional removal stepsMicrosoft Windows Malicious Software Removal Tool Finished On Fri Dec 17 22:44:27 2010Return code: 8 (0x8) Link to post Share on other sites More sharing options...
chumpstar Posted December 18, 2010 Author ID:362533 Share Posted December 18, 2010 ComboFix logComboFix 10-12-16.05 - Owner 12/17/2010 18:12:56.3.1 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.508 [GMT -8:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeAV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\Owner\My Documents\DPE.DUSc:\windows\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Security Guard.lnkc:\windows\XSxS.((((((((((((((((((((((((( Files Created from 2010-11-18 to 2010-12-18 ))))))))))))))))))))))))))))))).2010-12-17 22:42 . 2010-12-17 22:43 -------- d-----w- C:\ARK2010-12-17 17:59 . 2010-12-17 18:00 -------- d-----w- c:\windows\system32\MpEngineStore2010-12-15 01:00 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys2010-12-05 20:06 . 2010-12-05 20:06 -------- d-----w- c:\program files\PurePlay2010-12-05 20:06 . 2010-12-05 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\PurePlay2010-11-18 18:12 . 2010-11-18 18:12 81920 -c----w- c:\windows\system32\dllcache\isign32.dll.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-12-17 17:59 . 2003-10-11 10:59 21120 ----a-w- c:\windows\system32\drivers\nv_agp.sys2010-11-18 18:12 . 2003-10-31 20:05 81920 ----a-w- c:\windows\system32\isign32.dll2010-11-05 05:05 . 2004-08-24 03:32 667136 ----a-w- c:\windows\system32\wininet.dll2010-11-05 05:05 . 2003-10-31 18:51 61952 ----a-w- c:\windows\system32\tdc.ocx2010-11-05 05:05 . 2010-03-23 03:33 81920 ----a-w- c:\windows\system32\ieencode.dll2010-11-03 12:59 . 2004-08-04 05:59 369664 ----a-w- c:\windows\system32\html.iec2010-11-02 15:17 . 2003-10-31 20:06 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys2010-10-30 19:49 . 2010-10-30 19:49 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys2010-10-30 19:49 . 2010-10-30 19:49 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys2010-10-28 13:13 . 2003-10-31 20:04 290048 ----a-w- c:\windows\system32\atmfd.dll2010-10-26 13:25 . 2003-10-11 10:06 1853312 ----a-w- c:\windows\system32\win32k.sys2007-12-13 05:26 . 2007-12-13 05:26 50688 -c--a-w- c:\program files\ATF-Cleaner.exe.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"LTMSG"="LTMSG.exe 7" [X]"ViewMgr"="c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-12 106557]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552][HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Joint Operations Typhoon Rising Registration.lnk]HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Qwest Personal Digital VaultHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QwestTouchPointAgent[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]2007-06-02 00:51 257088 -c--a-w- c:\program files\iTunes\iTunesHelper.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]2009-11-11 07:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]2004-10-22 19:53 53248 ----a-w- c:\windows\system32\VTTimer.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"svcWRSSSDK"=2 (0x2)"YahooAUService"=2 (0x2)"PnkBstrB"=2 (0x2)"PnkBstrA"=2 (0x2)"iPod Service"=3 (0x3)"ewido security suite control"=2 (0x2)"Bonjour Service"=2 (0x2)"AresChatServer"=3 (0x3)"Apple Mobile Device"=2 (0x2)"UleadBurningHelper"=2 (0x2)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\WINDOWS\\system32\\sessmgr.exe"="c:\\Program Files\\Ares\\Ares.exe"="c:\\Program Files\\Valve\\Steam\\Steam.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\half-life 2 deathmatch\\hl2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\counter-strike source\\hl2.exe"="c:\\WINDOWS\\system32\\mshta.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\WINDOWS\\system32\\dplaysvr.exe"="c:\\WINDOWS\\system32\\PnkBstrA.exe"="c:\\WINDOWS\\system32\\PnkBstrB.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\codename gordon\\cg.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\WINDOWS\\system32\\verclsid.exe"="c:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"="c:\\Program Files\\iPod\\bin\\iPodService.exe"="c:\\Program Files\\GameTap Web Player\\bin\\release\\GameTapPlayer.exe"="c:\\Program Files\\Java\\jre6\\bin\\java.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3.EXE"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\amnesia the dark descent demo\\Launcher.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"="c:\\GameTap\\Games\\overlordgold\\Launcher.exe"="c:\\GameTap\\Games\\overlordgold\\GamepadConfig.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\chumpstar\\counter-strike source\\hl2.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009350\\tropico3patch109\\tropico3.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3plus.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"27015:TCP"= 27015:TCP:*:Disabled:hlserverR0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1108000.005\symds.sys [9/23/2010 4:31 PM 328752]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1108000.005\symefa.sys [9/23/2010 4:31 PM 173104]R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [11/22/2010 6:20 PM 691248]R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1108000.005\cchpx86.sys [9/23/2010 4:31 PM 501888]R1 NtFsLdf20;NtFsLdf20;c:\windows\system32\drivers\NtFsLdf20.sys [11/7/2004 2:48 AM 31660]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1108000.005\ironx86.sys [9/23/2010 4:31 PM 116784]R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [9/23/2010 4:31 PM 126392]R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [6/14/2004 3:35 PM 2368]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/27/2010 7:58 PM 102448]R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20101215.001\IDSXpx86.sys [12/16/2010 10:11 PM 341944]S1 uidzpipc;uidzpipc;\??\c:\windows\system32\drivers\uidzpipc.sys --> c:\windows\system32\drivers\uidzpipc.sys [?][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]getPlusHelper REG_MULTI_SZ getPlusHelper.Contents of the 'Scheduled Tasks' folder2010-11-23 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]2010-12-11 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job- c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe [2007-02-14 19:09]2007-06-30 c:\windows\Tasks\Uniblue SpeedUpMyPC.job- c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe [2007-02-14 19:09]..------- Supplementary Scan -------.uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepagemStart Page = hxxp://my.yahoo.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = <local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000Trusted Zone: gametap.com\wwwTrusted Zone: musicmatch.com\onlineDPF: Microsoft XML Parser for JavaDPF: RaptisoftGameLoader - hxxp://www.arcadetown.com/swf/hamsterball/raptisoftgameloader.cabDPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cabDPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebUpdater.cabFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\gxgc9m86.default\FF - prefs.js: browser.startup.homepage - hxxp://www.gametap.com/FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}FF - Ext: Yummy Games Player: YPlayer@yummy.net - c:\program files\Mozilla Firefox\extensions\YPlayer@yummy.netFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\IPSFFPlgnFF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ffFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}FF - Ext: GameTap: GameTapPlayer@gametap.com - %profile%\extensions\GameTapPlayer@gametap.comFF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}FF - user.js: signed.applets.codebase_principal_support - true/* To avoid the user interaction, add the following lines: */FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_YAEL.id - hxxp://yael.metaboli.fr/FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_LHOST.id - hxxp://localhost/.- - - - ORPHANS REMOVED - - - -MSConfigStartUp-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exeMSConfigStartUp-nwiz - nwiz.exeAddRemove-{D8768524-DE8D-40D3-904B-B1FCC31CF9F9} - c:\program files\InstallShield Installation Information\{D8768524-DE8D-40D3-904B-B1FCC31CF9F9}\setup.exe**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-12-17 18:33Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-3493499844-2403009658-1251160805-1003\Software\SecuROM\License information*]"datasecu"=hex:ae,af,8b,39,40,c8,f0,b1,b8,9a,69,e1,f7,3f,28,82,f3,27,97,f6,55, 34,e5,81,c0,10,fc,65,49,78,ef,ae,ee,59,c4,57,35,38,c6,53,3e,a4,a9,f1,3e,08,\"rkeysecu"=hex:8a,6c,83,b9,92,c6,60,a1,a2,85,97,e0,7c,72,9e,a2.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(2820)c:\program files\Logitech\MouseWare\System\LgWndHk.dllc:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\program files\Java\jre6\bin\jqs.exec:\windows\system32\drivers\WDelMgr20.exec:\windows\system32\wscntfy.exec:\windows\LTMSG.exec:\program files\Logitech\MouseWare\system\em_exec.exe.**************************************************************************.Completion time: 2010-12-17 18:43:07 - machine was rebootedComboFix-quarantined-files.txt 2010-12-18 02:43Pre-Run: 31,114,981,376 bytes freePost-Run: 31,088,214,016 bytes free- - End Of File - - 9A1B34511E248B339E33807F7462A4B6 Link to post Share on other sites More sharing options...
chumpstar Posted December 18, 2010 Author ID:362535 Share Posted December 18, 2010 When I downloaded ComboFix I renamed it, but when I started the program it renamed itself back... I'm going to assume I did something wrong Link to post Share on other sites More sharing options...
negster22 Posted December 18, 2010 ID:362548 Share Posted December 18, 2010 Run this program first (TDSSKiller) and then run Combofix after your system reboots.In answer to our question don't worry about the Combofix renaming reversal, it has been known to occur normally.Some background information on what we're planning to do can be found HEREPlease read carefully and follow these steps. Download TDSSKiller and save it to your Desktop.Extract its contents to your desktop.Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.If an infected file is detected, the default action will be Cure, click on Continue.If a suspicious file is detected, the default action will be Skip, click on Continue.It may ask you to reboot the computer to complete the process. Click on Reboot Now.If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.Now run Combofix as per my previous instructions, and post that log, too! Link to post Share on other sites More sharing options...
chumpstar Posted December 19, 2010 Author ID:362828 Share Posted December 19, 2010 TDSS log2010/12/18 17:13:14.0515 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:462010/12/18 17:13:14.0515 ================================================================================2010/12/18 17:13:14.0515 SystemInfo:2010/12/18 17:13:14.0515 2010/12/18 17:13:14.0515 OS Version: 5.1.2600 ServicePack: 3.02010/12/18 17:13:14.0515 Product type: Workstation2010/12/18 17:13:14.0515 ComputerName: CHUMPSTAR2010/12/18 17:13:14.0515 UserName: Owner2010/12/18 17:13:14.0515 Windows directory: C:\WINDOWS2010/12/18 17:13:14.0515 System windows directory: C:\WINDOWS2010/12/18 17:13:14.0515 Processor architecture: Intel x862010/12/18 17:13:14.0515 Number of processors: 12010/12/18 17:13:14.0515 Page size: 0x10002010/12/18 17:13:14.0515 Boot type: Normal boot2010/12/18 17:13:14.0515 ================================================================================2010/12/18 17:13:14.0968 Initialize success2010/12/18 17:13:25.0265 ================================================================================2010/12/18 17:13:25.0265 Scan started2010/12/18 17:13:25.0265 Mode: Manual; 2010/12/18 17:13:25.0265 ================================================================================2010/12/18 17:13:26.0203 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys2010/12/18 17:13:26.0437 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys2010/12/18 17:13:26.0687 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys2010/12/18 17:13:26.0921 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys2010/12/18 17:13:27.0062 AFS2K (0ebb674888cbdefd5773341c16dd6a07) C:\WINDOWS\system32\drivers\AFS2K.sys2010/12/18 17:13:27.0187 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys2010/12/18 17:13:27.0656 ALCXSENS (fbbcb95f677cbaa924140b6ea2d9a97b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS2010/12/18 17:13:28.0062 ALCXWDM (8a8909fdd548d84a3e02e04f699ee705) C:\WINDOWS\system32\drivers\ALCXWDM.SYS2010/12/18 17:13:28.0531 AmdK7 (8fce268cdbdd83b23419d1f35f42c7b1) C:\WINDOWS\system32\DRIVERS\amdk7.sys2010/12/18 17:13:28.0921 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys2010/12/18 17:13:29.0468 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys2010/12/18 17:13:29.0671 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys2010/12/18 17:13:30.0000 ati2mtag (8759322ffc1a50569c1e5528ee8026b7) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys2010/12/18 17:13:30.0250 atinrvxx (a7a01b907db63898d40b0a14248ff9a2) C:\WINDOWS\system32\DRIVERS\atinrvxx.sys2010/12/18 17:13:30.0406 ATITUNEP (edd66332608d27f4fd5069bcd0bc5164) C:\WINDOWS\system32\DRIVERS\atintuxx.sys2010/12/18 17:13:30.0593 ativraxx (da36687d701c833430605a298731410b) C:\WINDOWS\system32\DRIVERS\atinraxx.sys2010/12/18 17:13:30.0781 ATIXSAudio (77b575d7aab35d5908ae6ce681608d62) C:\WINDOWS\system32\DRIVERS\atinxsxx.sys2010/12/18 17:13:30.0968 atksgt (e46d344412d1abc60c58e95c73bcdc70) C:\WINDOWS\system32\DRIVERS\atksgt.sys2010/12/18 17:13:31.0171 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys2010/12/18 17:13:31.0359 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys2010/12/18 17:13:31.0515 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys2010/12/18 17:13:31.0750 BHDrvx86 (83a2fec59a0a0fc73bf6598e901b2fbd) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20101123.003\BHDrvx86.sys2010/12/18 17:13:32.0140 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys2010/12/18 17:13:32.0296 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys2010/12/18 17:13:32.0515 ccHP (e941e709847fa00e0dd6d58d2b8fb5e1) C:\WINDOWS\system32\drivers\NAV\1108000.005\ccHPx86.sys2010/12/18 17:13:32.0828 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys2010/12/18 17:13:32.0953 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys2010/12/18 17:13:33.0171 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys2010/12/18 17:13:33.0953 DCamUSBEMPIA (0c63e13e8debad206e20015115cedd1e) C:\WINDOWS\system32\DRIVERS\emDevice.sys2010/12/18 17:13:34.0171 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys2010/12/18 17:13:34.0359 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys2010/12/18 17:13:34.0609 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys2010/12/18 17:13:34.0812 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys2010/12/18 17:13:34.0968 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys2010/12/18 17:13:35.0312 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys2010/12/18 17:13:35.0546 eeCtrl (089296aedb9b72b4916ac959752bdc89) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys2010/12/18 17:13:35.0765 enodpl (b4556f3d468c8dcb0b259d9d866cd4c4) C:\WINDOWS\system32\drivers\enodpl.sys2010/12/18 17:13:35.0984 EraserUtilRebootDrv (850259334652d392e33ee3412562e583) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys2010/12/18 17:13:36.0234 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys2010/12/18 17:13:36.0437 fasttx2k (6339aaf63240df0634902b98c0f56049) C:\WINDOWS\system32\DRIVERS\fasttx2k.sys2010/12/18 17:13:36.0593 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys2010/12/18 17:13:36.0750 FETND5BV (cfc4cc73c903152a23e1db28eaba1f03) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys2010/12/18 17:13:36.0953 FETNDISB (29063004926b225c417e7147822f5866) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys2010/12/18 17:13:37.0156 FiltUSBEMPIA (4723090a93c0052e568e8d15e63efd56) C:\WINDOWS\system32\DRIVERS\emFilter.sys2010/12/18 17:13:37.0328 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys2010/12/18 17:13:37.0515 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys2010/12/18 17:13:37.0687 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys2010/12/18 17:13:38.0046 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys2010/12/18 17:13:38.0234 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys2010/12/18 17:13:38.0421 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys2010/12/18 17:13:38.0625 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys2010/12/18 17:13:38.0890 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys2010/12/18 17:13:39.0203 HPZid412 (287a63bd8509bd78e7978823b38afa81) C:\WINDOWS\system32\DRIVERS\HPZid412.sys2010/12/18 17:13:39.0390 HPZipr12 (0b4fda2657c3e0315eaa57f9c6d4fd1f) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys2010/12/18 17:13:39.0578 HPZius12 (29559db25258b60510a60c4e470fce32) C:\WINDOWS\system32\DRIVERS\HPZius12.sys2010/12/18 17:13:39.0765 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys2010/12/18 17:13:40.0156 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys2010/12/18 17:13:40.0312 ialm (1406d6ef4436aee970efe13193123965) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys2010/12/18 17:13:40.0562 IDSxpx86 (0308238c582a55d83d34feee39542793) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20101215.001\IDSxpx86.sys2010/12/18 17:13:40.0781 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys2010/12/18 17:13:41.0046 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\System32\DRIVERS\intelide.sys2010/12/18 17:13:41.0296 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys2010/12/18 17:13:41.0421 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys2010/12/18 17:13:41.0609 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys2010/12/18 17:13:41.0781 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys2010/12/18 17:13:42.0015 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys2010/12/18 17:13:42.0156 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys2010/12/18 17:13:42.0343 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys2010/12/18 17:13:42.0562 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys2010/12/18 17:13:42.0750 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys2010/12/18 17:13:42.0984 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys2010/12/18 17:13:43.0125 L8042PR2 (0f8b7bf7097d1e8d78f2f52a2bea03cd) C:\WINDOWS\system32\Drivers\l8042pr2.sys2010/12/18 17:13:43.0437 LHidFlt2 (3c357dfdbbf2b4b01aa4b9c8a26e4416) C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys2010/12/18 17:13:43.0625 lirsgt (8ccf9ed46d52af1375875f74a91ffacf) C:\WINDOWS\system32\DRIVERS\lirsgt.sys2010/12/18 17:13:43.0812 LMouFlt2 (aef09673376a4d93c09e8341854f1bf4) C:\WINDOWS\system32\Drivers\LMouFlt2.sys2010/12/18 17:13:44.0015 ltmodem5 (829ef680a308c12e2a80e5e0da0d958d) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys2010/12/18 17:13:44.0250 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys2010/12/18 17:13:44.0437 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys2010/12/18 17:13:44.0609 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys2010/12/18 17:13:44.0812 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys2010/12/18 17:13:44.0984 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys2010/12/18 17:13:45.0265 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys2010/12/18 17:13:45.0515 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys2010/12/18 17:13:45.0765 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys2010/12/18 17:13:45.0937 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys2010/12/18 17:13:46.0125 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys2010/12/18 17:13:46.0312 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys2010/12/18 17:13:46.0500 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys2010/12/18 17:13:46.0687 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys2010/12/18 17:13:46.0875 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys2010/12/18 17:13:47.0062 MVDCODEC (ed4c2bf8403f4437987c0ba09cf48716) C:\WINDOWS\system32\DRIVERS\atinmdxx.sys2010/12/18 17:13:47.0265 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys2010/12/18 17:13:47.0500 NAVENG (c8ef74e4d8105b1d02d58ea4734cf616) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20101218.003\NAVENG.SYS2010/12/18 17:13:47.0718 NAVEX15 (94b3164055d821a62944d9fe84036470) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20101218.003\NAVEX15.SYS2010/12/18 17:13:47.0968 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys2010/12/18 17:13:48.0218 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys2010/12/18 17:13:48.0375 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys2010/12/18 17:13:48.0546 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys2010/12/18 17:13:48.0750 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys2010/12/18 17:13:48.0937 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys2010/12/18 17:13:49.0125 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys2010/12/18 17:13:49.0328 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys2010/12/18 17:13:49.0593 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys2010/12/18 17:13:49.0750 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys2010/12/18 17:13:49.0984 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys2010/12/18 17:13:50.0203 NtFsLdf20 (e5003505aef6d071a243295ce73700e9) C:\WINDOWS\system32\drivers\NtFsLdf20.sys2010/12/18 17:13:50.0359 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys2010/12/18 17:13:50.0906 nv (30913cbf518396912e54c2c9f1dd0f09) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys2010/12/18 17:13:51.0359 nv_agp (4b93ee9abdcd38ecc51c7ba3f6f7b054) C:\WINDOWS\system32\DRIVERS\nv_agp.sys2010/12/18 17:13:51.0500 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys2010/12/18 17:13:51.0671 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys2010/12/18 17:13:51.0875 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys2010/12/18 17:13:52.0093 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys2010/12/18 17:13:52.0281 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys2010/12/18 17:13:52.0453 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys2010/12/18 17:13:52.0640 PCDCODEC (e90ac2b14e98f1a4372e5891b4278784) C:\WINDOWS\system32\DRIVERS\atinpdxx.sys2010/12/18 17:13:52.0843 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys2010/12/18 17:13:53.0171 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys2010/12/18 17:13:53.0359 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys2010/12/18 17:13:54.0234 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys2010/12/18 17:13:54.0406 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys2010/12/18 17:13:54.0578 prodrv06 (5ac2dcbbceb5534bfcd88c2670993f3c) C:\WINDOWS\System32\drivers\prodrv06.sys2010/12/18 17:13:54.0750 prohlp02 (7a78181cc947cdaa0902e113cfd01e93) C:\WINDOWS\system32\drivers\prohlp02.sys2010/12/18 17:13:54.0953 prosync1 (f3471e7971ee62420451d958da635064) C:\WINDOWS\system32\drivers\prosync1.sys2010/12/18 17:13:55.0140 Ps2 (9b793a1ffd480155fe9ee5261153f21b) C:\WINDOWS\system32\DRIVERS\PS2.sys2010/12/18 17:13:55.0328 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys2010/12/18 17:13:55.0484 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys2010/12/18 17:13:55.0656 PxHelp20 (81088114178112618b1c414a65e50f7c) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys2010/12/18 17:13:56.0265 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys2010/12/18 17:13:56.0453 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys2010/12/18 17:13:56.0656 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys2010/12/18 17:13:56.0828 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys2010/12/18 17:13:57.0015 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys2010/12/18 17:13:57.0234 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys2010/12/18 17:13:57.0390 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys2010/12/18 17:13:57.0625 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys2010/12/18 17:13:57.0781 rtl8139 (2ef9c0dc26b30b2318b1fc3faa1f0ae7) C:\WINDOWS\system32\DRIVERS\R8139n51.SYS2010/12/18 17:13:57.0906 S3Psddr (0dbcc071a268e0340a2ba6bdd98bace4) C:\WINDOWS\system32\DRIVERS\s3gnbm.sys2010/12/18 17:13:58.0109 ScanUSBEMPIA (71343164b40e741b3ce8f35c4072fb6d) C:\WINDOWS\system32\DRIVERS\emScan.sys2010/12/18 17:13:58.0296 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys2010/12/18 17:13:58.0515 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys2010/12/18 17:13:58.0718 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys2010/12/18 17:13:58.0968 sfdrv01 (56250672235bbe54ba8a4963b1ac997c) C:\WINDOWS\system32\drivers\sfdrv01.sys2010/12/18 17:13:59.0171 sfhlp01 (91f99f3e331e24c438819a38a1ad049c) C:\WINDOWS\system32\drivers\sfhlp01.sys2010/12/18 17:13:59.0375 sfhlp02 (3ad2b15ccc03febfbaf5ff057822aa75) C:\WINDOWS\system32\drivers\sfhlp02.sys2010/12/18 17:13:59.0546 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys2010/12/18 17:13:59.0781 sfsync02 (798d918d8f20380008277ce3ce5319d1) C:\WINDOWS\system32\drivers\sfsync02.sys2010/12/18 17:14:00.0140 SiS315 (bdfef5c5d41ba377852389e8f07104ea) C:\WINDOWS\system32\DRIVERS\sisgrp.sys2010/12/18 17:14:00.0343 SISAGP (923d23638c616eecb0d811461161d0b8) C:\WINDOWS\system32\DRIVERS\SISAGPX.sys2010/12/18 17:14:00.0484 SiSkp (7e9e5823afbb5af2851abb1659ff627d) C:\WINDOWS\system32\DRIVERS\srvkp.sys2010/12/18 17:14:00.0609 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys2010/12/18 17:14:00.0859 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys2010/12/18 17:14:01.0062 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys2010/12/18 17:14:01.0312 SRTSP (ec5c3c6260f4019b03dfaa03ec8cbf6a) C:\WINDOWS\System32\Drivers\NAV\1108000.005\SRTSP.SYS2010/12/18 17:14:01.0562 SRTSPX (55d5c37ed41231e3ac2063d16df50840) C:\WINDOWS\system32\drivers\NAV\1108000.005\SRTSPX.SYS2010/12/18 17:14:01.0781 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys2010/12/18 17:14:02.0031 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys2010/12/18 17:14:02.0140 SVKP (f05028b163b92c302a74409d683ac9b0) C:\WINDOWS\System32\SVKP.sys2010/12/18 17:14:02.0343 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys2010/12/18 17:14:02.0500 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys2010/12/18 17:14:02.0937 SymDS (56890bf9d9204b93042089d4b45ae671) C:\WINDOWS\system32\drivers\NAV\1108000.005\SYMDS.SYS2010/12/18 17:14:03.0203 SymEFA (1c91df5188150510a6f0cf78f7d94b69) C:\WINDOWS\system32\drivers\NAV\1108000.005\SYMEFA.SYS2010/12/18 17:14:03.0421 SymEvent (961b48b86f94d4cc8ceb483f8aa89374) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS2010/12/18 17:14:03.0593 SymIRON (dc80fbf0a348e54853ef82eed4e11e35) C:\WINDOWS\system32\drivers\NAV\1108000.005\Ironx86.SYS2010/12/18 17:14:03.0843 SYMTDI (41aad61f87ca8e3b5d0f7fe7fba0797d) C:\WINDOWS\System32\Drivers\NAV\1108000.005\SYMTDI.SYS2010/12/18 17:14:04.0265 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys2010/12/18 17:14:04.0468 tandpl (126d7b3b4c7b724491c604060e1f4e14) C:\WINDOWS\system32\drivers\tandpl.sys2010/12/18 17:14:04.0640 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys2010/12/18 17:14:04.0875 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys2010/12/18 17:14:05.0031 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys2010/12/18 17:14:05.0203 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys2010/12/18 17:14:05.0562 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys2010/12/18 17:14:05.0828 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys2010/12/18 17:14:06.0093 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys2010/12/18 17:14:06.0250 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys2010/12/18 17:14:06.0437 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys2010/12/18 17:14:06.0609 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys2010/12/18 17:14:06.0796 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys2010/12/18 17:14:07.0031 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys2010/12/18 17:14:07.0187 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys2010/12/18 17:14:07.0375 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS2010/12/18 17:14:07.0546 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys2010/12/18 17:14:07.0718 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys2010/12/18 17:14:07.0890 viaagp1 (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys2010/12/18 17:14:08.0031 viagfx (45489356501ec6cbb789dece991d393f) C:\WINDOWS\system32\DRIVERS\vtmini.sys2010/12/18 17:14:08.0203 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys2010/12/18 17:14:08.0390 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys2010/12/18 17:14:08.0625 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys2010/12/18 17:14:08.0953 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys2010/12/18 17:14:09.0546 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys2010/12/18 17:14:09.0968 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys2010/12/18 17:14:10.0375 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS2010/12/18 17:14:10.0593 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys2010/12/18 17:14:10.0890 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys2010/12/18 17:14:11.0109 X4HSX32 (72e8f37e00dcbd7432c7824570a3a7aa) C:\Program Files\GameTap Web Player\bin\release\X4HSX32.Sys2010/12/18 17:14:11.0375 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys2010/12/18 17:14:11.0687 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys2010/12/18 17:14:11.0781 ================================================================================2010/12/18 17:14:11.0781 Scan finished2010/12/18 17:14:11.0781 ================================================================================ Link to post Share on other sites More sharing options...
chumpstar Posted December 19, 2010 Author ID:362829 Share Posted December 19, 2010 ComboFix 10-12-18.01 - Owner 12/18/2010 17:21:34.4.1 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.603 [GMT -8:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeAV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}.((((((((((((((((((((((((( Files Created from 2010-11-19 to 2010-12-19 ))))))))))))))))))))))))))))))).2010-12-17 22:42 . 2010-12-17 22:43 -------- d-----w- C:\ARK2010-12-17 17:59 . 2010-12-18 03:17 -------- d-----w- c:\windows\system32\MpEngineStore2010-12-15 01:00 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys2010-12-05 20:06 . 2010-12-05 20:06 -------- d-----w- c:\program files\PurePlay2010-12-05 20:06 . 2010-12-05 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\PurePlay.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-12-17 17:59 . 2003-10-11 10:59 21120 ----a-w- c:\windows\system32\drivers\nv_agp.sys2010-11-18 18:12 . 2003-10-31 20:05 81920 ----a-w- c:\windows\system32\isign32.dll2010-11-05 05:05 . 2004-08-24 03:32 667136 ----a-w- c:\windows\system32\wininet.dll2010-11-05 05:05 . 2003-10-31 18:51 61952 ----a-w- c:\windows\system32\tdc.ocx2010-11-05 05:05 . 2010-03-23 03:33 81920 ----a-w- c:\windows\system32\ieencode.dll2010-11-03 12:59 . 2004-08-04 05:59 369664 ----a-w- c:\windows\system32\html.iec2010-11-02 15:17 . 2003-10-31 20:06 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys2010-10-30 19:49 . 2010-10-30 19:49 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys2010-10-30 19:49 . 2010-10-30 19:49 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys2010-10-28 13:13 . 2003-10-31 20:04 290048 ----a-w- c:\windows\system32\atmfd.dll2010-10-26 13:25 . 2003-10-11 10:06 1853312 ----a-w- c:\windows\system32\win32k.sys2007-12-13 05:26 . 2007-12-13 05:26 50688 -c--a-w- c:\program files\ATF-Cleaner.exe.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"LTMSG"="LTMSG.exe 7" [X]"ViewMgr"="c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-12 106557]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552][HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Joint Operations Typhoon Rising Registration.lnk][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]2007-06-02 00:51 257088 -c--a-w- c:\program files\iTunes\iTunesHelper.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]2009-11-11 07:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]2004-10-22 19:53 53248 ----a-w- c:\windows\system32\VTTimer.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"svcWRSSSDK"=2 (0x2)"YahooAUService"=2 (0x2)"PnkBstrB"=2 (0x2)"PnkBstrA"=2 (0x2)"iPod Service"=3 (0x3)"ewido security suite control"=2 (0x2)"Bonjour Service"=2 (0x2)"AresChatServer"=3 (0x3)"Apple Mobile Device"=2 (0x2)"UleadBurningHelper"=2 (0x2)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\WINDOWS\\system32\\sessmgr.exe"="c:\\Program Files\\Ares\\Ares.exe"="c:\\Program Files\\Valve\\Steam\\Steam.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\half-life 2 deathmatch\\hl2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\counter-strike source\\hl2.exe"="c:\\WINDOWS\\system32\\mshta.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\WINDOWS\\system32\\dplaysvr.exe"="c:\\WINDOWS\\system32\\PnkBstrA.exe"="c:\\WINDOWS\\system32\\PnkBstrB.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\codename gordon\\cg.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\WINDOWS\\system32\\verclsid.exe"="c:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"="c:\\Program Files\\iPod\\bin\\iPodService.exe"="c:\\Program Files\\GameTap Web Player\\bin\\release\\GameTapPlayer.exe"="c:\\Program Files\\Java\\jre6\\bin\\java.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3.EXE"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\amnesia the dark descent demo\\Launcher.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"="c:\\GameTap\\Games\\overlordgold\\Launcher.exe"="c:\\GameTap\\Games\\overlordgold\\GamepadConfig.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\chumpstar\\counter-strike source\\hl2.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009350\\tropico3patch109\\tropico3.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3plus.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"27015:TCP"= 27015:TCP:*:Disabled:hlserverR0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1108000.005\symds.sys [9/23/2010 4:31 PM 328752]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1108000.005\symefa.sys [9/23/2010 4:31 PM 173104]R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [11/22/2010 6:20 PM 691248]R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1108000.005\cchpx86.sys [9/23/2010 4:31 PM 501888]R1 NtFsLdf20;NtFsLdf20;c:\windows\system32\drivers\NtFsLdf20.sys [11/7/2004 2:48 AM 31660]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1108000.005\ironx86.sys [9/23/2010 4:31 PM 116784]R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [9/23/2010 4:31 PM 126392]R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [6/14/2004 3:35 PM 2368]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/27/2010 7:58 PM 102448]R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20101215.001\IDSXpx86.sys [12/16/2010 10:11 PM 341944]--- Other Services/Drivers In Memory ---*NewlyCreated* - KLMD25*Deregistered* - klmd25[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]getPlusHelper REG_MULTI_SZ getPlusHelper.Contents of the 'Scheduled Tasks' folder2010-11-23 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]2010-12-11 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job- c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe [2007-02-14 19:09]2007-06-30 c:\windows\Tasks\Uniblue SpeedUpMyPC.job- c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe [2007-02-14 19:09]..------- Supplementary Scan -------.uStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepagemStart Page = hxxp://my.yahoo.com/uInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = <local>uSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000Trusted Zone: gametap.com\wwwTrusted Zone: musicmatch.com\onlineDPF: Microsoft XML Parser for JavaDPF: RaptisoftGameLoader - hxxp://www.arcadetown.com/swf/hamsterball/raptisoftgameloader.cabDPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cabDPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebUpdater.cabFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\gxgc9m86.default\FF - prefs.js: browser.startup.homepage - hxxp://www.gametap.com/FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}FF - Ext: Yummy Games Player: YPlayer@yummy.net - c:\program files\Mozilla Firefox\extensions\YPlayer@yummy.netFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\IPSFFPlgnFF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ffFF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}FF - Ext: GameTap: GameTapPlayer@gametap.com - %profile%\extensions\GameTapPlayer@gametap.comFF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}FF - user.js: signed.applets.codebase_principal_support - true/* To avoid the user interaction, add the following lines: */FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_YAEL.id - hxxp://yael.metaboli.fr/FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.granted - UniversalXPConnectFF - user.js: capability.principal.codebase.YummyPlayer_LHOST.id - hxxp://localhost/**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-12-18 17:35Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-3493499844-2403009658-1251160805-1003\Software\SecuROM\License information*]"datasecu"=hex:ae,af,8b,39,40,c8,f0,b1,b8,9a,69,e1,f7,3f,28,82,f3,27,97,f6,55, 34,e5,81,c0,10,fc,65,49,78,ef,ae,ee,59,c4,57,35,38,c6,53,3e,a4,a9,f1,3e,08,\"rkeysecu"=hex:8a,6c,83,b9,92,c6,60,a1,a2,85,97,e0,7c,72,9e,a2.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(2728)c:\program files\Logitech\MouseWare\System\LgWndHk.dllc:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.Completion time: 2010-12-18 17:45:10ComboFix-quarantined-files.txt 2010-12-19 01:45ComboFix2.txt 2010-12-18 02:43Pre-Run: 30,997,860,352 bytes freePost-Run: 30,990,053,376 bytes free- - End Of File - - E55C267250A8EEFA526F18240F20C910 Link to post Share on other sites More sharing options...
negster22 Posted December 20, 2010 ID:363530 Share Posted December 20, 2010 TDSSKiller is completely negative for Alureon and though the MSRT detected it previously, it seems to have cleaned it up because the only thing it detected in your full scan are Alureon traces in your system restore (SR) data (system volume information) and this is not an active infection. We will simply purge those SR points at the end of our work here. Uninstall Viewpoint Manager from Add/Remove Programs.If you no longer use Ares let me know because it is still being given a free pass through your firewall.I want You to submit the following two files for analysis C:\WINDOWS\system32\drivers\NtFsLdf20.sysC:\WINDOWS\system32\DRIVERS\nv_agp.sysThen, Go HERE:http://www.virustotal.com/and upload each file to VirusTotal to have all the scanners cast their verdict. To do that:Select the "Upload a File" Tab.Click the "Browse" button and a Windows Explorer-type interface will open that enables you to navigate through your file system.Locate the file you want analyzed for it's threat potential, left-click that file, and click "Send File" to upload it to VirusTotal.If the file was previously scanned VirusTotal, it will display this message:If this happens Select "Reanalyze".Wait for it to be scanned and post back the url (copy/paste the link to the scan result page from your browser's address bar) if any of the scanners determine the file to be a threat.Repeat this same procedure for each of the two files listed above.Please perform a scan with the ESET online virus scanner. ESET may flag some files in Combofix's quarantine (Qoobox) and system volume information. They will not represent active malware so don't worry:http://www.eset.com/onlinescan/index.phpESET recommends disabling your resident antivirus's auto-protection feature before beginning the scan to avoid conflicts and system hangsUse Internet Explorer to navigate to the scanner website because you must approve install an ActiveX add-on to complete the scan.Check the "Yes, I accept the terms of use" box.Click "Start"Approve the installation of the ActiveX control that's required to enable scanningMake sure the box to Remove found threats. is CHECKED!!Click "Start" [*]Allow the definition data base to install[*]Click "Scan"When the scan is done, please post the scan report in your next reply. It can be found in this location:C:\Program Files\EsetOnlineScanner\log.txtNote to Windows 7 and Vista users, and anyone with restrictive IE security settings:Depending on your security settings, you may have to allow cookies and put the ESET website, www.eset.com, into the trusted zone of Internet Explorer if the scan has problems starting (in Vista this is a necessity as IE runs in Protected mode).To do that, on the Internet Explorer menu click Tools => Internet Options => Security => Trusted Sites => Sites. Then UNcheck "Require server verification for all sites in this zone" checkbox at the bottom of the dialog. Add the above www.eset.com url to the list of trusted sites, by inserting it in the blank box and clicking the Add button, then click Close. For cookies, choose the IE Privacy tab and add the above eset.com url to the exceptions list for cookie blocking. Link to post Share on other sites More sharing options...
chumpstar Posted December 25, 2010 Author ID:365435 Share Posted December 25, 2010 I am on holiday at the moment and unable to complete these scans. I will run them on Monday. Just wanted to let you know so they don't close this thread or you think I disappeared, thanks again for all your help and will update soon! Link to post Share on other sites More sharing options...
negster22 Posted December 25, 2010 ID:365442 Share Posted December 25, 2010 You're Welcome!!We'll leave the thread open andHAPPY HOLIDAYS!!!! Link to post Share on other sites More sharing options...
chumpstar Posted December 25, 2010 Author ID:365446 Share Posted December 25, 2010 Happy Holidays to you and yours as well Link to post Share on other sites More sharing options...
chumpstar Posted December 29, 2010 Author ID:366967 Share Posted December 29, 2010 When you say I want You to submit the following two files for analysisC:\WINDOWS\system32\drivers\NtFsLdf20.sysC:\WINDOWS\system32\DRIVERS\nv_agp.sysWhere do you want me to submit them? Also, I don't see Viewpoint Manager in the add/remove programs Link to post Share on other sites More sharing options...
chumpstar Posted December 29, 2010 Author ID:366971 Share Posted December 29, 2010 Nevermind about the submit part, got that but still don't see Viewpoint Manager Link to post Share on other sites More sharing options...
negster22 Posted December 29, 2010 ID:366998 Share Posted December 29, 2010 Viewpoint is listed as an autostart in your Combofix log here:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ViewMgr"="c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe" [2004-11-12 106557]These programs all have open access thru your firewall and ViewPoint Manager is one of them. Anyway, you see any programs You have removed previously that are on this list, let me know so we can remove them:[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\Program Files\\Ares\\Ares.exe"="c:\\Program Files\\Valve\\Steam\\Steam.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\half-life 2 deathmatch\\hl2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\counter-strike source\\hl2.exe"="c:\\WINDOWS\\system32\\mshta.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\WINDOWS\\system32\\dplaysvr.exe"="c:\\WINDOWS\\system32\\PnkBstrA.exe"="c:\\WINDOWS\\system32\\PnkBstrB.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\samoajoe\\codename gordon\\cg.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\WINDOWS\\system32\\verclsid.exe"="c:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"="c:\\Program Files\\iPod\\bin\\iPodService.exe"="c:\\Program Files\\GameTap Web Player\\bin\\release\\GameTapPlayer.exe"="c:\\Program Files\\Java\\jre6\\bin\\java.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3.EXE"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\amnesia the dark descent demo\\Launcher.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"="c:\\GameTap\\Games\\overlordgold\\Launcher.exe"="c:\\GameTap\\Games\\overlordgold\\GamepadConfig.exe"="c:\\Program Files\\Valve\\Steam\\SteamApps\\chumpstar\\counter-strike source\\hl2.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009350\\tropico3patch109\\tropico3.exe"="c:\\Documents and Settings\\All Users\\Application Data\\GameTap Web Player\\games\\150009250\\rollercoaster3deluxe\\RCT3plus.exe"=Also if this folder is present, then remove it: c:\\Program Files\\Viewpoint\ Link to post Share on other sites More sharing options...
chumpstar Posted January 6, 2011 Author ID:370423 Share Posted January 6, 2011 Sorry again about long response time, crazy holidays still I haven't been near my second computer at all. I ran those scans and everything was fine. They took a really long time to run but there weren't any results. I am able to find the Viewpoint folder in the program files but still don't see it as an option to add/remove program and there isn't an uninstall option in the folder. All of the other programs on the list are still current. Link to post Share on other sites More sharing options...
chumpstar Posted January 6, 2011 Author ID:370425 Share Posted January 6, 2011 I am going to run the eset again, not sure what I did wrong but there isn't a log for it so just going to redo it. Link to post Share on other sites More sharing options...
negster22 Posted January 6, 2011 ID:370427 Share Posted January 6, 2011 Just check at the end of the ESET scan to see if any threats were found. If none were found tell me, but still try to produce the log! Link to post Share on other sites More sharing options...
chumpstar Posted January 7, 2011 Author ID:370802 Share Posted January 7, 2011 I ran it again just to be sure but it was clear. I realized why I couldn't find the log and that's because I did the auto uninstall when the scan was finished so there wasn't a folder Link to post Share on other sites More sharing options...
negster22 Posted January 7, 2011 ID:370828 Share Posted January 7, 2011 OK that's good and I checked out those two drivers I asked You to upload to Virustotal and they appear to be legit!Excellent job! Your scans are all coming up clean now so we just have a few steps to finish up!!You should update your version of the Sun Java Platform (JRE) to the newest version which is Java Runtime Environment (JRE) 6 Update 23, if you have not done that already.You can check your currently installed JRE version here.If you find you need to update to the Java Runtime Environment (JRE) 6 Update 23, then follow these steps: 1. Download the latest JRE version clicking the "Agree and Start Free Download" button. 2. Save the installer to your desktop. 3. Close any programs you may have running - especially your web browser. 4. Next, remove all older versions of the Sun Java Platform using the Control Panel's Add/Remove Program feature (as they may contain security vulnerabilities). 5. Reboot your system 6. Then from your desktop double-click on jxpiinstall.exe to install the newest version of the Sun Java Platform 7. "Install the Yahoo Toolbar' is prechecked by default, so be sure to UNCHECK it, if you do not care to have it, or You already have it installed - it is NOT part of the JRE install and it is NOT required for any Java applications. 8. You may verify that the current version installed properly by clicking http://java.com/en/download/installed.jsp here.Now clear the Java cache:After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)On the General tab, under Temporary Internet Files, click the Settings button.Next, click on the Delete Files buttonThere are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files[*]Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.[*] Click OK to leave the Temporary Files Window[*]Click OK to leave the Java Control Panel.As Java Cache can be an infection repository, You can quickly scan it periodically for infectious elements, by right-clicking the following folder and selecting the "Scan with <Your antivirus>" option:The location of this folder usually is:In XP:C:\Documents and Settings\<user_name>\Application Data\Sun\Java\Deployment\cache\In Vista and Windows 7:C:\Users\<user_name>\AppData\LocalLow\Sun\Java\Deployment\cache\Let's remove the troubleshooting tools & programs we used:If I asked you to download and run an ARK (Antirootkit program) such as Gmer, Rootkit Unhooker, or Root Repeal, then please uninstall it by doing the following:Delete the contents of the C:\ARK folder (or whatever folder you chose to install the antirootkit in) Delete the C:\ARK folder(or whatever folder you chose to install the antirootkit in)If I asked You to download OTL, TDSSKiller, MBRCheck or mbr.exe, please delete these programs from your Desktop (or their download location). If I asked you to make a back-up copy of your MBR, retain that on your hard drive and also burn it to CD for safekeeping, in the event You need to restore it.To remove Combofix and it's quarantine folder:Click Start -> Run, and copy/paste the following bolded text in the Open: box and select OK:"%userprofile%\desktop\combofix.exe" /uninstallThis will do the following:Uninstall Combofix and all its associated files and folders.Flush your system restore points and create a new restore point.Rehide your system files and foldersReset your system clock---Here are some additional measures you should take to keep your system in good working order and ensure your continued security.1. Scan your system for outdated versions of commonly used software applications that may also cause your PC be vulnerable, using the Secunia Online Software Inspector (OSI) by clicking the Start Scanner button. This is very important because recent statistics confirm that an overwhelming majority of infections are aquired through application not Operating System flaws. Commonly used programs like Quicktime, Java, and Adobe Acrobat Reader, itunes, FlashPlayer and many others are frequently targeted today. You can make your computer much more secure if you update to the most current versions of these programs and any others that Secunia alerts you to.Just click the "Start Scanner" button to get a listing of all outdated and possibly insecure resident programs. Note: If your firewall prompts you about access, allow it.2. Keep MBAM as an on demand scanner because I highly recommend it, and the quick scan will find most all active malware in minutes.3. You can reduce your startups by downloading Malwarebyte's StartUp Lite and saving it to a convenient location. Just double-click StartUpLite.exe. Then, check the options you would like based on the descriptions provided, then select continue. This will free up system resources because nonessential background programs will no longer be running when you start up your computer. You should visit the Windows Updates website, and obtain the most current Operating System updates/patches, and Internet Explorer released versions.The easiest and fastest way to obtain Windows Updates is by clicking Control Panel -> Windows Update. However, setting your computer to download and install updates automatically will relieve you of the responsibility of doing this on a continual basis. It is important to periodically check that Windows Updates is functioning properly because many threats disable it as part of their strategy to compromise your system. Windows Updates are released on the second Tuesday of every month.Finally, please review the additional suggestions offered by Tony Klein in How did I get infected in the first place. so you can maintain a safe and secure computing environment. Happy Surfing! Link to post Share on other sites More sharing options...
chumpstar Posted January 7, 2011 Author ID:371055 Share Posted January 7, 2011 Thank you for all of your help Happy New Year! Link to post Share on other sites More sharing options...
negster22 Posted January 7, 2011 ID:371063 Share Posted January 7, 2011 You're very welcome and Happy New Year to You!! Link to post Share on other sites More sharing options...
Recommended Posts