Backdoor TDSS?

[rhino1]

Redirect is from google search in IE and Firefox. Also get computer error messages generated by malware/virus.

Malwarebytes didn't find anything. I cannot run tdss killer, even in safe mode and even after renaming it.

I've also tried combofix, super antispyware, norman tdss cleaner, eolmarktdl4 cleaner, mcafee stinger, eset online, f-secure blacklight and a few other programs; they don't seem to detect that there's a problem.

Dr. Web identified a backdoor tdss 565 and eradicates it, but then it reappears.

computer is running windows xp sp3; pentium 4 dell.

Hijack This log attached.

Thanks in advance for your help.

hijackthis.1_7_11.log

[Elise]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the Quick Scan button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please Download Rootkit Unhooker Save it to your desktop.

• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  
• Wait till the scanner has finished and then click File, Save Report.
  
• Save the report somewhere where you can find it. Click Close.
  

Copy the entire contents of the report and paste it in a reply here.

Note - if you get the following warning, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Click on Cancel, then Accept.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• RKU log
  

Thanks and again sorry for the delay.

[rhino1]

OTL logfile created on: 1/8/2011 9:09:55 AM - Run 1

OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Steve Sokol\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 75.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 93.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 43.95 Gb Total Space | 7.19 Gb Free Space | 16.36% Space Free | Partition Type: NTFS

Drive D: | 105.10 Gb Total Space | 105.02 Gb Free Space | 99.93% Space Free | Partition Type: NTFS

Drive G: | 7.52 Gb Total Space | 3.11 Gb Free Space | 41.40% Space Free | Partition Type: FAT32

Computer Name: STEVE-B845C28B7 | User Name: Steve Sokol | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/06 23:03:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Sokol\Desktop\OTL.exe

PRC - [2010/07/09 11:40:24 | 000,065,856 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\NLSSRV32.EXE

PRC - [2009/09/29 09:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

PRC - [2008/11/12 16:01:20 | 002,037,096 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProTray.exe

PRC - [2008/11/12 16:01:14 | 003,425,632 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PRC - [2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2004/10/14 11:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe

========== Modules (SafeList) ==========

MOD - [2011/01/06 23:03:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Sokol\Desktop\OTL.exe

MOD - [2010/08/23 08:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\WINDOWS\System32\NWCWorkstation360.dll -- (NWCWorkstation)

SRV - [2010/07/09 11:40:24 | 000,065,856 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\WINDOWS\system32\NLSSRV32.EXE -- (nlsX86cc)

SRV - [2009/09/29 09:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)

SRV - [2009/05/20 13:18:28 | 000,297,472 | ---- | M] (Amazon.com) [Disabled | Stopped] -- C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe -- (amazon download agent)

SRV - [2009/03/24 08:45:58 | 000,127,656 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\WINDOWS\System32\SUPDSvc.exe -- (Samsung UPD Service)

SRV - [2008/11/12 16:01:14 | 003,425,632 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe -- (Norton Ghost)

SRV - [2007/08/17 21:02:15 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2007/06/15 16:55:00 | 000,300,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2006/06/15 17:17:00 | 000,705,024 | ---- | M] () [Disabled | Stopped] -- C:\WINDOWS\system32\TSSchBkpService.exe -- (TSScheduleBackup)

SRV - [2005/11/14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\Drivers\SSPORT.sys -- (ssport)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\F.tmp -- (MEMSWEEP2)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\STEVES~1\LOCALS~1\Temp\catchme.sys -- (catchme)

DRV - [2010/05/10 10:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/02/17 10:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2010/01/14 20:26:01 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\b3f546b2.sys -- (b3f546b2)

DRV - [2008/11/12 15:49:22 | 000,138,080 | ---- | M] (StorageCraft) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symsnap.sys -- (symsnap)

DRV - [2007/08/18 16:56:52 | 000,010,430 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secbulk.sys -- (SecBulk)

DRV - [2007/08/13 00:39:19 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\DGIVECP.SYS -- (dgivecp)

DRV - [2007/07/31 16:22:16 | 000,014,072 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vproeventmonitor.sys -- (VProEventMonitor)

DRV - [2007/03/28 19:49:42 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WimFltr.sys -- (WimFltr)

DRV - [2007/03/28 19:29:10 | 000,037,864 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\v2imount.sys -- (v2imount)

DRV - [2007/02/22 11:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (nmwcd)

DRV - [2007/02/22 11:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (nmwcdcm)

DRV - [2007/02/22 11:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (nmwcdc)

DRV - [2006/09/24 05:28:46 | 000,005,248 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2004/09/17 06:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)

DRV - [2004/08/03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2004/05/05 20:48:40 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv)

DRV - [2003/09/08 14:43:36 | 000,089,728 | ---- | M] (Atmel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbvsp.sys -- (USBVSP)

DRV - [2003/06/11 10:54:36 | 000,196,352 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003/06/11 10:54:36 | 000,030,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)

DRV - [2003/06/11 10:54:34 | 001,063,040 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2003/06/11 10:54:32 | 000,631,296 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2001/08/15 14:21:28 | 000,023,200 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\ppsio2.sys -- (ppsio2)

DRV - [1996/04/03 11:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/advanced_search

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A6 F5 E0 1B 28 AE CB 01 [binary data]

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: citius@orbiscom:3.7.11.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - HKLM\software\mozilla\Firefox\extensions\\citius@orbiscom: C:\Program Files\Virtual Account Numbers [2010/08/20 23:52:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/26 19:34:08 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/06 09:09:06 | 000,000,000 | ---D | M]

[2010/12/11 09:13:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Steve Sokol\Application Data\Mozilla\Extensions

[2011/01/06 10:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Steve Sokol\Application Data\Mozilla\Firefox\Profiles\5z4v44e5.default\extensions

[2010/12/15 21:12:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Steve Sokol\Application Data\Mozilla\Firefox\Profiles\5z4v44e5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011/01/06 10:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2011/01/06 09:09:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011/01/06 09:08:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2010/08/20 23:52:51 | 000,000,000 | ---D | M] (Virtual Account Numbers) -- C:\PROGRAM FILES\VIRTUAL ACCOUNT NUMBERS

[2011/01/06 09:08:51 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/01/05 01:09:33 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.

O3 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Norton Ghost 12.0] C:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync] C:\Program Files\Nokia PC Suite\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)

O4 - HKU\S-1-5-18..\Run: [Nokia.PCSync] C:\Program Files\Nokia PC Suite\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)

O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)

O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found

O4 - HKLM..\RunOnceEx: [Title] File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: ([]msn in My Computer)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: aol.com ([free] http in Trusted sites)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: humana-medicare.com ([]* in Trusted sites)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: intuit.com ([]* in Trusted sites)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: turbotax.com ([]http in Trusted sites)

O15 - HKU\S-1-5-21-842925246-1409082233-725345543-1003\..Trusted Domains: turbotax.com ([]https in Trusted sites)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1282257022093 (WUWebControl Class)

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst...tDetection2.cab (GMNRev Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab (HPSDDX Class)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_23)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Soap Bubbles.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Soap Bubbles.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007/07/02 14:24:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/06 23:52:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC

[2011/01/06 23:09:05 | 000,000,000 | ---D | C] -- C:\_OTL

[2011/01/06 23:07:55 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Steve Sokol\Desktop\OTL.exe

[2011/01/06 21:18:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\DoctorWeb

[2011/01/06 19:59:16 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Steve Sokol\IECompatCache

[2011/01/06 19:57:35 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Steve Sokol\PrivacIE

[2011/01/06 19:56:39 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Steve Sokol\IETldCache

[2011/01/06 19:50:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates

[2011/01/06 19:49:16 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2011/01/06 19:47:31 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8

[2011/01/06 19:36:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\My Documents\Ace Utilities Backups

[2011/01/06 19:33:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\Start Menu\Programs\Ace Utilities

[2011/01/06 19:33:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ace Utilities

[2011/01/06 19:33:08 | 000,000,000 | ---D | C] -- C:\Program Files\Ace Utilities

[2011/01/06 19:29:01 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Documents and Settings\Steve Sokol\Desktop\ATF-Cleaner.exe

[2011/01/06 16:12:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\My Documents\RegRun2

[2011/01/06 16:12:04 | 000,000,000 | ---D | C] -- C:\Program Files\UnHackMe

[2011/01/06 14:23:27 | 000,000,000 | --SD | C] -- C:\Steve27710S

[2011/01/06 14:11:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro

[2011/01/06 09:22:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\F-Secure

[2011/01/06 09:09:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

[2011/01/06 09:09:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011/01/06 09:09:06 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2011/01/06 09:09:06 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2011/01/06 09:09:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2011/01/06 09:09:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2011/01/06 09:09:06 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2011/01/06 09:08:48 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2011/01/06 00:04:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\Application Data\SUPERAntiSpyware.com

[2011/01/06 00:04:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

[2011/01/06 00:04:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware

[2011/01/06 00:04:45 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2011/01/05 21:39:37 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2011/01/05 18:51:29 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/01/05 16:58:28 | 000,000,000 | ---D | C] -- C:\Steve4845S

[2011/01/05 15:57:27 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos

[2011/01/05 13:34:37 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\stevehope.exe

[2011/01/05 13:34:34 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\stevehope.com

[2011/01/05 12:05:20 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\TDSSKiller.exe

[2011/01/05 11:19:27 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2011/01/05 11:19:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\Start Menu\Programs\HiJackThis

[2011/01/05 07:34:16 | 000,000,000 | ---D | C] -- C:\Steve

[2011/01/05 00:35:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011/01/05 00:35:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011/01/05 00:35:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011/01/04 23:37:03 | 000,000,000 | ---D | C] -- C:\SteveFx

[2011/01/04 23:03:00 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW(2)

[2010/12/25 23:22:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\IsolatedStorage

[2010/12/25 23:16:14 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll

[2010/12/24 08:54:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\My Documents\GarminLatest

[2010/12/24 01:26:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\My Documents\Garmin Europe

[2010/12/15 07:18:59 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys

[2010/12/15 07:17:34 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe

[2010/12/11 09:13:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\Local Settings\Application Data\Mozilla

[2010/12/11 09:13:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Steve Sokol\Application Data\Mozilla

========== Files - Modified Within 30 Days ==========

[2011/01/08 08:54:40 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/01/08 08:54:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/01/08 08:54:24 | 1608,568,832 | -HS- | M] () -- C:\hiberfil.sys

[2011/01/08 00:10:24 | 000,004,096 | -HS- | M] () -- C:\VSNAP.IDX

[2011/01/07 07:34:26 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Outlook 2007.lnk

[2011/01/07 00:17:05 | 000,002,459 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\HiJackThis.lnk

[2011/01/06 23:03:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Steve Sokol\Desktop\OTL.exe

[2011/01/06 21:41:15 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/01/06 20:49:48 | 054,253,528 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\tfw8gpjs.exe

[2011/01/06 19:56:45 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2011/01/06 19:56:45 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Internet Explorer.lnk

[2011/01/06 19:50:52 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011/01/06 19:33:14 | 000,000,795 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Ace Utilities.lnk

[2011/01/06 19:14:55 | 000,435,740 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/01/06 19:14:55 | 000,068,636 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/01/06 19:06:15 | 000,068,020 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Cobra's Market View.url

[2011/01/06 18:49:38 | 000,294,400 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\exeHelper.com

[2011/01/06 16:12:12 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2011/01/06 16:12:12 | 000,001,688 | ---- | M] () -- C:\WINDOWS\System32\AUTOEXEC.NT

[2011/01/06 16:12:12 | 000,000,002 | RHS- | M] () -- C:\WINDOWS\winstart.bat

[2011/01/06 14:15:22 | 000,016,968 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011/01/06 14:14:23 | 000,000,519 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Gmail.url

[2011/01/06 12:59:30 | 000,535,163 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Yahoo! Finance.url

[2011/01/06 10:14:34 | 000,000,282 | -HS- | M] () -- C:\boot.ini

[2011/01/06 09:14:40 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\defogger_reenable

[2011/01/06 09:08:50 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2011/01/06 09:08:50 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2011/01/06 09:08:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2011/01/06 09:08:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2011/01/06 09:08:50 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2011/01/06 08:42:38 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Defogger.exe

[2011/01/05 23:42:18 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Steve Sokol\Desktop\ATF-Cleaner.exe

[2011/01/05 12:10:16 | 000,719,873 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\rkill.com

[2011/01/05 11:18:18 | 001,402,880 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\HiJackThis.msi

[2011/01/05 07:29:01 | 004,148,657 | R--- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Steve.exe

[2011/01/05 01:09:33 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011/01/04 21:36:02 | 000,252,211 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Amazon.com.url

[2011/01/04 18:03:45 | 000,000,681 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Yahoo Maps.url

[2011/01/04 09:16:43 | 000,000,522 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\tires-easy.com - Our selection of 205-55 R16 All season tires.url

[2011/01/04 09:00:56 | 000,002,340 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\HotMail.url

[2011/01/03 23:35:06 | 000,007,554 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\nokia 6230i.url

[2011/01/03 23:33:29 | 000,002,572 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Carl Futia.url

[2011/01/03 22:41:48 | 000,000,244 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\craigslist los angeles.url

[2011/01/03 21:47:45 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Mini-Wheats Class Action Settlement Website.url

[2011/01/03 21:29:36 | 000,000,295 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Bureau of Sanitation.url

[2011/01/03 16:35:32 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\turbotax business 2010 items - Get great deals on items on eBay.com!.url

[2011/01/03 00:27:12 | 000,000,172 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\TheMLS.com.url

[2011/01/02 13:46:04 | 000,000,221 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Fidelity Investments.url

[2011/01/01 22:14:49 | 000,000,229 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\camel camel amazon price Amazon price tracker - tracking, Amazon price history charts, price watches, and price drop alerts. camelcamelcamel.com.url

[2010/12/31 20:05:00 | 000,000,289 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\eBay.url

[2010/12/29 00:52:53 | 000,005,223 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Bloomberg.com Earnings.url

[2010/12/25 23:16:04 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb

[2010/12/25 23:16:04 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb

[2010/12/24 17:29:37 | 000,004,231 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Vanguard.url

[2010/12/24 01:25:05 | 000,000,692 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\WinRAR.lnk

[2010/12/23 21:08:22 | 000,000,439 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\r10 directv items - Get great deals on Satellite Cable TV, r-10 r items on eBay.com!.url

[2010/12/23 12:23:22 | 000,000,168 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Humana RightSourceRx.url

[2010/12/21 10:32:14 | 000,006,251 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Sigalert.com - Los Angeles.url

[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/12/20 00:58:59 | 000,007,131 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\Richard Suttmeier's Instablog -- Seeking Alpha.url

[2010/12/19 19:34:20 | 000,000,541 | ---- | M] () -- C:\Documents and Settings\Steve Sokol\Desktop\FIA Card Services.url

[2010/12/16 09:47:00 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\TDSSKiller.exe

[2010/12/16 09:47:00 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\stevehope.exe

[2010/12/16 09:47:00 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Steve Sokol\Desktop\stevehope.com

[2010/12/15 12:34:30 | 000,334,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/12/11 09:13:35 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat

[2010/12/11 09:13:26 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2011/01/07 07:17:50 | 1608,568,832 | -HS- | C] () -- C:\hiberfil.sys

[2011/01/06 22:20:14 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Internet Explorer.lnk

[2011/01/06 21:18:12 | 054,253,528 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\tfw8gpjs.exe

[2011/01/06 19:33:14 | 000,000,795 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Ace Utilities.lnk

[2011/01/06 18:55:12 | 000,294,400 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\exeHelper.com

[2011/01/06 16:12:12 | 000,000,002 | RHS- | C] () -- C:\WINDOWS\winstart.bat

[2011/01/06 14:11:40 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys

[2011/01/06 09:14:40 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\defogger_reenable

[2011/01/06 09:14:32 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Defogger.exe

[2011/01/05 12:30:28 | 000,719,873 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\rkill.com

[2011/01/05 11:19:27 | 000,002,459 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\HiJackThis.lnk

[2011/01/05 11:19:08 | 001,402,880 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\HiJackThis.msi

[2011/01/05 00:35:13 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/01/05 00:35:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/01/05 00:35:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/01/05 00:35:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/01/05 00:35:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/01/04 23:49:03 | 004,148,657 | R--- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Steve.exe

[2011/01/04 23:30:58 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/01/03 21:29:36 | 000,000,295 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Bureau of Sanitation.url

[2011/01/01 00:21:15 | 000,000,229 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\camel camel amazon price Amazon price tracker - tracking, Amazon price history charts, price watches, and price drop alerts. camelcamelcamel.com.url

[2010/12/31 20:05:33 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\turbotax business 2010 items - Get great deals on items on eBay.com!.url

[2010/12/31 10:53:37 | 000,000,174 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\Mini-Wheats Class Action Settlement Website.url

[2010/12/24 01:25:05 | 000,000,692 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\WinRAR.lnk

[2010/12/23 21:08:22 | 000,000,439 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\r10 directv items - Get great deals on Satellite Cable TV, r-10 r items on eBay.com!.url

[2010/12/16 21:34:55 | 000,000,522 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Desktop\tires-easy.com - Our selection of 205-55 R16 All season tires.url

[2010/12/11 09:13:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/12/11 09:13:26 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2010/03/20 23:44:22 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\WIAIPH.dll

[2010/03/20 23:44:22 | 000,081,920 | R--- | C] () -- C:\WINDOWS\System32\WIAEH.dll

[2010/03/20 23:44:22 | 000,057,344 | R--- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll

[2010/03/20 23:44:22 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll

[2009/09/16 16:27:58 | 000,508,224 | ---- | C] () -- C:\WINDOWS\System32\ICCProfiles.dll

[2009/09/03 16:21:09 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\spd__l3.dll

[2009/09/03 16:21:08 | 000,339,968 | ---- | C] () -- C:\WINDOWS\System32\DscPnt1.dll

[2009/09/03 16:21:08 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\DscPnt0.dll

[2009/09/03 16:21:08 | 000,229,376 | ---- | C] () -- C:\WINDOWS\System32\DscPnt.dll

[2009/09/01 10:51:56 | 000,022,723 | ---- | C] () -- C:\WINDOWS\System32\cl31cl3.dll

[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/07/28 08:58:31 | 000,622,237 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Application Data\squint1.zip

[2009/06/05 05:55:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\b3f546b2.sys

[2008/10/24 20:23:21 | 000,027,312 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Application Data\Personal Address Book.ADR

[2007/12/20 01:03:19 | 000,023,200 | ---- | C] () -- C:\WINDOWS\System32\drivers\ppsio2.sys

[2007/10/17 12:20:47 | 000,000,430 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI

[2007/10/13 21:54:40 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Application Data\AVSDVDPlayer.m3u

[2007/10/13 21:53:53 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2007/10/13 21:53:53 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2007/09/20 16:23:35 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll

[2007/09/20 16:22:36 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll

[2007/09/14 21:49:33 | 000,000,078 | ---- | C] () -- C:\WINDOWS\TIMESLIP.INI

[2007/07/21 07:58:31 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007/07/07 16:19:36 | 000,000,439 | ---- | C] () -- C:\WINDOWS\TSREMOTE.INI

[2007/07/07 16:12:51 | 000,244,984 | ---- | C] () -- C:\WINDOWS\System32\tutil32.dll

[2007/07/04 22:06:55 | 000,000,067 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2007/07/04 18:19:07 | 000,032,167 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Local Settings\Application Data\FASTWiz.log

[2007/07/04 15:05:14 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Steve Sokol\Local Settings\Application Data\FASTWiz.html

[2007/07/04 12:53:25 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\ZLIB.DLL

[2007/07/04 12:53:12 | 000,049,152 | ---- | C] () -- C:\WINDOWS\SDConfig.dll

[2007/07/04 12:49:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\usc0.dll

[2007/07/04 12:49:34 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\_isusr2k.dll

[2007/07/02 20:50:20 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007/07/02 07:02:13 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007/03/29 23:00:40 | 000,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll

[2004/02/18 14:40:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

[1996/04/03 11:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

< End of report >

OTL Extras logfile created on: 1/8/2011 9:09:55 AM - Run 1

OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Steve Sokol\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 75.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 93.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 43.95 Gb Total Space | 7.19 Gb Free Space | 16.36% Space Free | Partition Type: NTFS

Drive D: | 105.10 Gb Total Space | 105.02 Gb Free Space | 99.93% Space Free | Partition Type: NTFS

Drive G: | 7.52 Gb Total Space | 3.11 Gb Free Space | 41.40% Space Free | Partition Type: FAT32

Computer Name: STEVE-B845C28B7 | User Name: Steve Sokol | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"FirewallDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00d3bdaf-c064-4821-89c5-89105f6c738e}" = Portfolio Browser

"{0db87eac-f695-4d59-9609-c93119ae6b35}" = SAMSUNG Dr. Printer

"{11964613-805F-432D-A12B-169554B793E7}" = Nokia Connectivity Cable Driver

"{180D45DA-5140-48D4-BDEA-8B9CE3A6D9A4}" = TurboTax 2008 WinBizTaxSupport

"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP

"{21DBBDD6-93A5-4326-9A04-C9A5C9148502}" = Norton PartitionMagic

"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java 6 Update 23

"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3602D1C1-EAA2-012B-AD13-000000000000}" = TurboTax 2009 wcafbpm

"{360EDFB0-EAA2-012B-AD16-000000000000}" = TurboTax 2009 wcaiper

"{3818E081-EAA2-012B-AD94-000000000000}" = TurboTax 2009 WinBizFedFormset

"{3830D551-EAA2-012B-AD9A-000000000000}" = TurboTax 2009 WinBizReleaseEngine

"{383CBC31-EAA2-012B-AD9D-000000000000}" = TurboTax 2009 WinBizTaxSupport

"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset

"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine

"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport

"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper

"{3C5A81D1-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper

"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AEBD86C-C82E-401A-9AA0-8B8AF7A5A3CA}" = TurboTax 2008 WinBizFedFormset

"{56D4C8A0-6126-11DD-AD8B-0800200C9A66}" = TurboTax 2008 WinBizUserEducation

"{5B30AA25-BF39-4BE4-8FEE-51938BAB214D}" = TurboTax 2008 wcaiper

"{6E7EAD75-4602-456A-80F1-2329C7AA6FA6}" = TurboTax 2008 wcafbpm

"{6EECB283-E65F-40EF-86D3-D51BF02A8D43}" = Microsoft Office Converter Pack

"{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset

"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English

"{7ED00F05-2109-4F42-B3DC-370EE3E2C1FE}" = ScanSoft OmniPage Pro 14.0

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{87001C85-FF5F-42F9-B78A-114A7ED373BE}" = ScanSoft PDF Converter

"{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver

"{8B611C23-ADB6-4F5E-A04A-959EB0D349F6}" = Winkflash Transporter

"{8F9C77FF-C017-4B12-BA71-A3A53BD52775}_is1" = AnyBizSoft PDF Converter (Build 2.0.2)

"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007

"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007

"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007

"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007

"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81

"{99A40651-0BC2-4095-8F9A-A40FAB224FEF}" = PC Connectivity Solution

"{9C411DC9-B8B8-45F3-B688-073BF4B59094}" = Virtual Account Numbers

"{9E1BC481-AE76-49D3-913C-D901D8CFDFCA}" = ScanSoft PDF Printer

"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe

[rhino1]

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>Drivers

==============================================

0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 4276224 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 56.73 )

0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2189952 bytes

0x804D7000 RAW 2189952 bytes

0x804D7000 WMIxWDM 2189952 bytes

0xB9A83000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 1900544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 56.73 )

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xB9918000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1064960 bytes (Conexant Systems, Inc., HSF_DP driver)

0xB972C000 C:\WINDOWS\system32\drivers\senfilt.sys 733184 bytes (Creative Technology Ltd., Creative WDM Audio Driver)

0xB987D000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 634880 bytes (Conexant Systems, Inc., HSF_CNXT driver)

0xF7B52000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xB51D5000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)

0xB597F000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xB9676000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xB5AD6000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xA99B7000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xB9803000 C:\WINDOWS\system32\drivers\smwdm.sys 262144 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )

0xB9A3F000 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 196608 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)

0xB96D4000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xF75A8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xA9AAB000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xF786A000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xA9241000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xB59EF000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xB5AAE000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF74B2000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)

0xB9857000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel® PRO/100 Adapter NDIS 5.1 driver)

0xB5959000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xA9A0F000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xB97DF000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xB9C53000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xB9A1C000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xB5A8C000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0xB5A6A000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)

0xF742F000 symsnap.sys 135168 bytes (StorageCraft, StorageCraft Volume Snap-Shot)

0x806EE000 ACPI_HAL 131840 bytes

0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF7462000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF74D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xF7850000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF749A000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xABB64000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xF7482000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)

0xF7418000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xB9715000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xA997A000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xB9843000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xB9A6F000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xB5B2F000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xF7405000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF7450000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xF7597000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xB9704000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xACCAA000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xBA642000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF7557000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xB92B5000 C:\WINDOWS\system32\Drivers\DgiVecp.sys 61440 bytes (Samsung Electronics Co., Ltd., Windows 2k,XP IEEE-1284 parallel class driver for ECP, Byte, and Nibble modes)

0xBA622000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xBA632000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xACCDA000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF7687000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF7637000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xBA612000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF7617000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xB5DFE000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)

0xBA5F2000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xB604B000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF7547000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF7607000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xBA602000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF75F7000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF7667000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xBA5D2000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF7627000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xB5E6E000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xF7567000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)

0xBA5E2000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xB605B000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xA936C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xB603B000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF7717000 cercsr6.sys 32768 bytes (Adaptec, Inc., DELL CERC SATA1.5/6ch Miniport Driver)

0xF77CF000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)

0xB63B8000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xB4A3D000 C:\WINDOWS\system32\DRIVERS\strmdisp.sys 32768 bytes (Conexant Systems, Inc., Conexant Stream Dispatcher)

0xB6388000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)

0xF77C7000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xB4CA7000 C:\WINDOWS\system32\DRIVERS\v2imount.sys 32768 bytes (Symantec Corporation, V2iMount.sys - Image Mounting Device Driver)

0xF77D7000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xF77DF000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CD/DVD Class Filter Driver)

0xB7AA0000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xB6370000 C:\WINDOWS\system32\DRIVERS\NuidFltr.sys 28672 bytes (Microsoft Corporation, Filter Driver for Microsoft Hardware HID Non-User Input Data)

0xF7707000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xAD92D000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)

0xF77FF000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF7807000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xB63B0000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)

0xF77BF000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0xB7A98000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xB7AB0000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xB7A90000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF77EF000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF77F7000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF77E7000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xACBAA000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xB5F6B000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xB7B35000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)

0xBA7FC000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xB0440000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xA9B30000 C:\WINDOWS\System32\Drivers\ppsio2.SYS 16384 bytes (-, Flatbed DevDriver/NT4 v3.25 Build 315)

0xF792B000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF7897000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xACB4B000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xB673E000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xA9AFC000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)

0xB5F63000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xF7933000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xB7B19000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xB5F43000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF798B000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xF79A9000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xB5F45000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF7987000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xB5F41000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xB9327000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)

0xB5F3F000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF798D000 speedfan.sys 8192 bytes

0xF79D5000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF7991000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7989000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xB9D0C000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7A88000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xF7A50000 giveio.sys 4096 bytes

0xB6460000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0xB5F26000 C:\WINDOWS\System32\Drivers\PQNTDrv.SYS 4096 bytes (PowerQuest Corporation, PowerQuest Boot Mode Driver.)

==============================================

>Stealth

==============================================

WARNING: Virus alike driver modification [sffp_mmc.sys]

WARNING: Virus alike driver modification [hsfdpsp2.sys]

WARNING: Virus alike driver modification [secbulk.sys]

WARNING: Virus alike driver modification [atinrvxx.sys]

WARNING: Virus alike driver modification [HSF_DP.sys]

0x054F0000 Hidden Image-->Intuit.Spc.Map.WindowsFirewallUtilities.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 1077248 bytes

WARNING: Virus alike driver modification [mdmxsdk.sys]

WARNING: Virus alike driver modification [wadv08nt.sys]

WARNING: Virus alike driver modification [ati1mdxx.sys]

WARNING: Virus alike driver modification [wadv07nt.sys]

WARNING: Virus alike driver modification [wadv09nt.sys]

WARNING: Virus alike driver modification [wadv11nt.sys]

WARNING: Virus alike driver modification [ati1pdxx.sys]

WARNING: Virus alike driver modification [mtlmnt5.sys]

0x05490000 Hidden Image-->System.ServiceProcess.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 126976 bytes

WARNING: Virus alike driver modification [slnt7554.sys]

WARNING: Virus alike driver modification [ialmnt5.sys]

WARNING: Virus alike driver modification [mtlstrm.sys]

WARNING: Virus alike driver modification [slwdmsup.sys]

WARNING: Virus alike driver modification [recagent.sys]

WARNING: Virus alike driver modification [atinmdxx.sys]

WARNING: Virus alike driver modification [atinttxx.sys]

WARNING: Virus alike driver modification [atinpdxx.sys]

WARNING: Virus alike driver modification [hdaudbus.sys]

WARNING: Virus alike driver modification [e100b325.sys]

WARNING: Virus alike driver modification [GEARAspiWDM.sys]

WARNING: Virus alike driver modification [MODEMCSA.sys]

WARNING: Virus alike driver modification [s3gnbm.sys]

WARNING: Virus alike driver modification [ntmtlfax.sys]

WARNING: Virus alike driver modification [nv4_mini.sys]

WARNING: Virus alike driver modification [HSFHWBS2.sys]

0x032B0000 Hidden Image-->System.XML.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 2060288 bytes

WARNING: Virus alike driver modification [ati1ttxx.sys]

WARNING: Virus alike driver modification [hsfbs2s2.sys]

WARNING: Virus alike driver modification [watv06nt.sys]

WARNING: Virus alike driver modification [ppsio2.sys]

WARNING: Virus alike driver modification [watv10nt.sys]

WARNING: Virus alike driver modification [smwdm.sys]

WARNING: Virus alike driver modification [ati1snxx.sys]

0x04620000 Hidden Image-->System.EnterpriseServices.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 266240 bytes

0x04360000 Hidden Image-->System.Transactions.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 270336 bytes

0x058A0000 Hidden Image-->log4net.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 282624 bytes

WARNING: Virus alike driver modification [atinsnxx.sys]

WARNING: Virus alike driver modification [ati1xbxx.sys]

0x04030000 Hidden Image-->System.Data.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 2961408 bytes

WARNING: Virus alike driver modification [strmdisp.sys]

WARNING: Virus alike driver modification [ati1raxx.sys]

0x04B70000 Hidden Image-->System.Runtime.Remoting.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 307200 bytes

0x898413CC Unknown page with executable code, 3124 bytes

WARNING: Virus alike driver modification [atinxbxx.sys]

0x034E0000 Hidden Image-->System.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 3190784 bytes

WARNING: Virus alike driver modification [ati2mtaa.sys]

0x8984430A Unknown page with executable code, 3318 bytes

0x8984028A Unknown page with executable code, 3446 bytes

WARNING: Virus alike driver modification [ati1xsxx.sys]

WARNING: Virus alike driver modification [ati1tuxx.sys]

0x89846143 Unknown page with executable code, 3773 bytes

WARNING: Virus alike driver modification [wpdusb.sys]

WARNING: Virus alike driver modification [slntamr.sys]

0x062F0000 Hidden Image-->Intuit.Spc.Map.WindowsFirewallUtilities.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 421888 bytes

WARNING: Virus alike driver modification [PQNTDRV.sys]

0x03240000 Hidden Image-->System.configuration.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 438272 bytes

WARNING: Virus alike driver modification [mtxparhm.sys]

0x03020000 Hidden Image-->Intuit.Spc.Foundations.Portability.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 471040 bytes

0x04460000 Hidden Image-->Intuit.Spc.Map.Reporter.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 479232 bytes

0x05EF0000 Hidden Image-->Intuit.Spc.Map.Reporter.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 479232 bytes

0x04DC0000 Hidden Image-->System.Windows.Forms.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 5033984 bytes

WARNING: Virus alike driver modification [atinraxx.sys]

0x00F10000 Hidden Image-->Intuit.Spc.Foundations.Primary.Logging.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 53248 bytes

0xF7617000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes

WARNING: Virus alike driver modification [ati1btxx.sys]

WARNING: Virus alike driver modification [atinbtxx.sys]

0x8984453C Unknown thread object [ ETHREAD 0x898A9DA8 ] TID: 128, 600 bytes

0x8984652D Unknown thread object [ ETHREAD 0x898A9B30 ] TID: 132, 600 bytes

0x8984423F Unknown thread object [ ETHREAD 0x898A98B8 ] , 600 bytes

WARNING: Virus alike driver modification [HSF_CNXT.sys]

WARNING: Virus alike driver modification [atinxsxx.sys]

0x05320000 Hidden Image-->System.Drawing.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 634880 bytes

WARNING: Virus alike driver modification [ati1rvxx.sys]

WARNING: Virus alike driver modification [hsfcxts2.sys]

WARNING: Virus alike driver modification [ati2mtag.sys]

WARNING: Virus alike driver modification [atintuxx.sys]

WARNING: Virus alike driver modification [senfilt.sys]

WARNING: Virus alike driver modification [WudfPf.sys]

0x00FD0000 Hidden Image-->Intuit.Spc.Foundations.Primary.ExceptionHandling.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 77824 bytes

0x03F70000 Hidden Image-->System.Data.SQLite.DLL [ EPROCESS 0x88DFF348 ] PID: 1788, 778240 bytes

WARNING: Virus alike driver modification [WudfRd.sys]

0x031A0000 Hidden Image-->Intuit.Spc.Foundations.Primary.Config.dll [ EPROCESS 0x88DFF348 ] PID: 1788, 86016 bytes

0x05D50000 Hidden Image-->System.Data.SQLite.DLL [ EPROCESS 0x88DFF348 ] PID: 1788, 872448 bytes

WARNING: Virus alike driver modification [usbvsp.sys]

WARNING: Virus alike driver modification [slnthal.sys]

[Elise]

I see indeed some evidence of TDSS. This is a nasty rootkit. Please read the following first.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.
  

[rhino1]

in my initial post, i wrote that i am unable to run tdsskiller, even in safe mode and even if i change name or extension of program.

[Elise]

My apologies, I must have overlooked that.

Do you have a Dr. Web log to show me what exactly was detected?

Also, please post me the combofix log (can be found at c:\combofix.txt).

[rhino1]

never did dr. web log; i'll try now. again, dr. web identifies and "eradicates" a tdss file, but then it reappears. so dr. web doesn't find and doesn't eliminate the script that is creating that file.

i got infected from looking at a google image; upon clicking on the image, a javascript program ran and i couldn't shut it down in time.

from looking at various forums, it appears that the victims who have succeeded in eliminating this malware have run a specific script (often with combofix).

ComboFix 11-01-04.06 - Steve Sokol 01/05/2011 17:04:59.10.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1052 [GMT -8:00]

Running from: c:\documents and settings\Steve Sokol\Desktop\Steve.exe

.

((((((((((((((((((((((((( Files Created from 2010-12-06 to 2011-01-06 )))))))))))))))))))))))))))))))

.

2011-01-05 23:57 . 2011-01-05 23:57 -------- d-----w- c:\program files\Sophos

2011-01-05 19:19 . 2011-01-05 19:19 388096 ----a-r- c:\documents and settings\Steve Sokol\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-01-05 19:19 . 2011-01-05 19:19 -------- d-----w- c:\program files\Trend Micro

2011-01-05 15:34 . 2011-01-05 16:23 -------- d-----w- C:\Steve

2011-01-05 07:18 . 2011-01-05 07:18 -------- d-----w- c:\windows\system32\wbem\Repository

2011-01-05 07:03 . 2011-01-05 07:18 -------- d-----w- C:\32788R22FWJFW(2)

2011-01-05 06:48 . 2011-01-05 06:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-01-05 06:46 . 2011-01-05 06:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-12-26 07:22 . 2010-12-26 07:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\IsolatedStorage

2010-12-15 15:18 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-15 15:17 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-21 02:09 . 2010-05-23 02:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-21 02:08 . 2010-05-23 02:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-18 18:12 . 2007-07-02 22:21 81920 ----a-w- c:\windows\system32\isign32.dll

2010-11-06 00:34 . 2006-03-04 03:33 832512 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:34 . 2004-08-04 10:00 78336 ------w- c:\windows\system32\ieencode.dll

2010-11-06 00:34 . 2004-08-04 10:00 1830912 ------w- c:\windows\system32\inetcpl.cpl

2010-11-06 00:34 . 2004-08-04 10:00 17408 ------w- c:\windows\system32\corpol.dll

2010-11-03 12:25 . 2004-08-04 10:00 389120 ------w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2004-08-04 10:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

2010-10-28 13:13 . 2004-08-04 10:00 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-10-26 13:25 . 2004-08-04 10:00 1853312 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((( SnapShot_2011-01-05_09.11.10 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-01-05 23:47 . 2011-01-05 23:47 16384 c:\windows\temp\Perflib_Perfdata_548.dat

+ 2007-07-02 22:27 . 2011-01-05 23:47 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

- 2007-07-02 22:27 . 2011-01-05 08:29 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2007-07-02 22:27 . 2011-01-05 23:47 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

- 2007-07-02 22:27 . 2011-01-05 08:29 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2010-08-19 21:43 . 2011-01-05 23:47 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

- 2010-08-19 21:43 . 2011-01-05 08:29 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2011-01-05 19:19 . 2011-01-05 19:19 1094656 c:\windows\Installer\33d50e.msi

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"Norton Ghost 12.0"="c:\program files\Norton Ghost\Agent\VProTray.exe" [2008-11-13 2037096]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="c:\program files\Nokia PC Suite\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Amazon Unbox.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Amazon Unbox.lnk

backup=c:\windows\pss\Amazon Unbox.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk

backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2010-09-23 21:36 624056 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2007-03-09 18:09 63712 -c--a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 15:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amazongsdownloadertray]

2009-05-20 21:17 223744 ----a-w- c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService]

2003-06-11 18:54 4608 -c--a-w- c:\windows\system32\carpserv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Citi Virtual Account Numbers]

2009-07-10 23:53 372736 ----a-w- c:\progra~1\VIRTUA~1\CitiVAN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 18:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0]

2008-11-13 00:01 2037096 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OP14 Reminder]

2003-07-07 17:29 729088 -c--a-r- c:\program files\ScanSoft\OmniPagePro14.0\EregEng\Ereg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpScheduler]

2004-03-08 20:33 114688 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\OpScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware14]

2004-03-08 20:30 57344 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\opware14.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

2007-06-18 23:10 271360 -c--a-w- c:\program files\Nokia PC Suite\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Converter Registry Controller]

2003-09-30 17:55 102400 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfCnv\RegistryController.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SharpTray]

2003-07-18 17:58 28672 -c--a-w- c:\program files\Sharp\Sharpdesk\SharpTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2003-10-14 17:22 155648 -c--a-r- c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSPrnAgent]

2003-10-29 10:07 20480 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2007-07-04 03:11 185896 -c--a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorkFlowTray]

2004-03-08 20:31 155747 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 amazon download agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [9/30/2009 7:44 PM 297472]

R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [7/9/2010 11:40 AM 65856]

R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [12/20/2007 1:03 AM 23200]

R3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\F.tmp --> c:\windows\system32\F.tmp [?]

S1 b3f546b2;b3f546b2;c:\windows\system32\drivers\b3f546b2.sys [6/5/2009 5:55 AM 0]

S2 ssport;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S2 TSScheduleBackup;TimeslipsBackup;c:\windows\system32\TSSchBkpService.exe [7/7/2007 4:12 PM 705024]

S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [9/3/2009 4:21 PM 127656]

S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [8/18/2007 4:49 PM 10430]

S3 USBVSP;USBVSP;c:\windows\system32\drivers\usbvsp.sys [11/22/2007 12:29 AM 89728]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MEMSWEEP2

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uDefault_Search_URL = about:blank

uStart Page = hxxp://www.google.com/advanced_search?hl=en

uInternet Settings,ProxyServer = http=127.0.0.1:6522

uInternet Settings,ProxyOverride = <local>

IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Open PDF in Word - c:\program files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100

Trusted Zone: aol.com\free

Trusted Zone: humana-medicare.com

Trusted Zone: intuit.com

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

FF - ProfilePath - c:\documents and settings\Steve Sokol\Application Data\Mozilla\Firefox\Profiles\5z4v44e5.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Virtual Account Numbers: citius@orbiscom - c:\program files\Virtual Account Numbers

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-pxdotnetloader - c:\program files\Fidelity Investments\Fidelity Active Trader\System\ATPStartupAssistant.exe

MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe

MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-05 17:29

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\F.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F928A42E-A485-A8B7-A8CC-6E7802559D58}*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"ianhlbjfebnofkegph"=hex:6a,61,6a,6b,6e,65,6c,6e,6d,66,64,66,66,69,62,70,63,6e,

69,6f,00,d0

"hahffkgkenhelpng"=hex:6a,61,6a,6b,63,66,6d,6d,6d,6c,63,65,67,6e,69,66,70,6f,

66,6d,00,22

"iajelklmbnpiaghgac"=hex:63,61,6d,6b,6d,67,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@DACL=(02 0010)

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(560)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2011-01-05 17:43:55

ComboFix-quarantined-files.txt 2011-01-06 01:43

ComboFix2.txt 2011-01-05 16:22

ComboFix3.txt 2011-01-05 09:25

ComboFix4.txt 2010-08-19 16:45

ComboFix5.txt 2011-01-06 01:00

Pre-Run: 7,819,866,112 bytes free

Post-Run: 7,804,264,448 bytes free

- - End Of File - - D0149ECE3252D9953CA4924EB9BAE464

[Elise]

Combofix usually takes out tdss without a script, but there are newer variants out that are hard to detect at the moment. Before starting to shoot blindly, it would be helpful if you could tell me what dr. web detects (what file). No need to run a complete scan. As soon as the treat is detected, stop the scan and note down the file.

[rhino1]

Combofix usually takes out tdss without a script, but there are newer variants out that are hard to detect at the moment. Before starting to shoot blindly, it would be helpful if you could tell me what dr. web detects (what file). No need to run a complete scan. As soon as the treat is detected, stop the scan and note down the file.

per dr. web, the file is: c:\windows\explorer.exe:1456. the four digit number will change when old file is eradicated and new one created. and dr. web calls this a backdoor.tdss 565 infection.

i've seen several other postings where people note that dr. web finds the file, but then it reappears. it doesn't sound like any of dr. web's programs can eliminate it (the dr. web people suggested running two other dr. web programs, but the victims reported that the programs didn't help).

[Elise]

I definitely know an infection that patches explorer.exe, but thats not TDSS. Please rerun OTL and click the NONE button. Copy/paste the following text into the "custom scan/fix" field and click Run Scan. Post me the resulting log.

/md5start
explorer.exe
winlogon.exe
hlp.dat
/md5stop

[rhino1]

not sure if this is what you want.

OTL logfile created on: 1/8/2011 11:57:06 AM - Run 3

OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Steve Sokol\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 93.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 43.95 Gb Total Space | 7.18 Gb Free Space | 16.33% Space Free | Partition Type: NTFS

Drive D: | 105.10 Gb Total Space | 105.02 Gb Free Space | 99.93% Space Free | Partition Type: NTFS

Computer Name: STEVE-B845C28B7 | User Name: Steve Sokol | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

< End of report >

[Elise]

Loos like you didn't paste in the script I gave you. Can you please try again? First copy/paste the script into the "custom scan/fix" field, then click Run Scan.

[rhino1]

sorry, script image didn't open up first time.

OTL logfile created on: 1/8/2011 12:19:08 PM - Run 4

OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Steve Sokol\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 92.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 43.95 Gb Total Space | 7.18 Gb Free Space | 16.34% Space Free | Partition Type: NTFS

Drive D: | 105.10 Gb Total Space | 105.02 Gb Free Space | 99.93% Space Free | Partition Type: NTFS

Drive G: | 7.52 Gb Total Space | 3.11 Gb Free Space | 41.40% Space Free | Partition Type: FAT32

Computer Name: STEVE-B845C28B7 | User Name: Steve Sokol | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< MD5 for: EXPLORER.EXE >

[2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe

[2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe

[2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

[2007/06/13 03:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

[2004/08/04 02:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

[2004/08/12 08:19:08 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: WINLOGON.EXE >

[2004/08/04 02:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008/04/13 16:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe

[2008/04/13 16:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008/04/13 16:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< >

< End of report >

[Elise]

That all looks good.

Please download mbr.exe http://www2.gmer.net/mbr/mbr.exe

Doubleclick on the file to run it. You will see a black window flash briefly and then a file, mbr.log, will be created in the same location as mbr.exe

Please post me the contents of mbr.log

[rhino1]

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: WDC_WD1600JB-00REA0 rev.20.00K20 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

[Elise]

Please delete any old copy of combofix you may have and download a new one and run it as instructed below.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

[rhino1]

with all due respect, are we getting anywhere? this is the fifth time that i've run combofix, and the second time that i've sent you the log.

well here it is......again.

ComboFix 11-01-08.04 - Steve Sokol 01/08/2011 23:54:43.11.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1108 [GMT -8:00]

Running from: c:\documents and settings\Steve Sokol\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2010-12-09 to 2011-01-09 )))))))))))))))))))))))))))))))

.

2011-01-09 06:25 . 2011-01-09 07:29 -------- d-----w- C:\Lop SD

2011-01-07 07:09 . 2011-01-07 07:09 -------- d-----w- C:\_OTL

2011-01-07 05:18 . 2011-01-07 05:18 -------- d-----w- c:\documents and settings\Steve Sokol\DoctorWeb

2011-01-07 04:01 . 2011-01-07 04:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2011-01-07 03:59 . 2011-01-07 03:59 -------- d-sh--w- c:\documents and settings\Steve Sokol\IECompatCache

2011-01-07 03:57 . 2011-01-07 03:57 -------- d-sh--w- c:\documents and settings\Steve Sokol\PrivacIE

2011-01-07 03:56 . 2011-01-07 03:56 -------- d-sh--w- c:\documents and settings\Steve Sokol\IETldCache

2011-01-07 03:50 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll

2011-01-07 03:49 . 2010-11-06 00:26 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2011-01-07 03:49 . 2010-11-06 00:26 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2011-01-07 03:49 . 2010-11-06 00:26 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2011-01-07 03:47 . 2011-01-07 03:48 -------- dc-h--w- c:\windows\ie8

2011-01-07 03:33 . 2011-01-07 03:33 -------- d-----w- c:\program files\Ace Utilities

2011-01-07 00:12 . 2011-01-07 00:12 2 --shatr- c:\windows\winstart.bat

2011-01-07 00:12 . 2011-01-07 00:15 -------- d-----w- c:\program files\UnHackMe

2011-01-06 22:11 . 2011-01-06 22:15 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-01-06 22:11 . 2011-01-06 22:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro

2011-01-06 17:22 . 2011-01-06 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure

2011-01-06 17:09 . 2011-01-06 17:09 -------- d-----w- c:\program files\Common Files\Java

2011-01-06 17:09 . 2011-01-06 17:08 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2011-01-06 17:09 . 2011-01-06 17:08 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-01-06 17:09 . 2011-01-06 17:08 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-01-06 17:08 . 2011-01-06 17:08 -------- d-----w- c:\program files\Java

2011-01-06 16:14 . 2011-01-06 18:43 -------- d-----w- c:\documents and settings\Jamie

2011-01-06 08:04 . 2011-01-06 08:04 -------- d-----w- c:\documents and settings\Steve Sokol\Application Data\SUPERAntiSpyware.com

2011-01-06 08:04 . 2011-01-06 08:04 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-01-06 08:04 . 2011-01-06 08:05 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-01-06 02:51 . 2011-01-06 02:51 -------- d-----w- c:\program files\ESET

2011-01-05 23:57 . 2011-01-05 23:57 -------- d-----w- c:\program files\Sophos

2011-01-05 19:19 . 2011-01-05 19:19 388096 ----a-r- c:\documents and settings\Steve Sokol\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-01-05 19:19 . 2011-01-05 19:19 -------- d-----w- c:\program files\Trend Micro

2011-01-05 15:34 . 2011-01-05 16:23 -------- d-----w- C:\Steve

2011-01-05 07:18 . 2011-01-05 07:18 -------- d-----w- c:\windows\system32\wbem\Repository

2011-01-05 07:03 . 2011-01-05 07:18 -------- d-----w- C:\32788R22FWJFW(2)

2011-01-05 06:48 . 2011-01-05 06:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-01-05 06:46 . 2011-01-05 06:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-12-26 07:22 . 2010-12-26 07:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\IsolatedStorage

2010-12-15 15:18 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-15 15:17 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-21 02:09 . 2010-05-23 02:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-21 02:08 . 2010-05-23 02:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-18 18:12 . 2007-07-02 22:21 81920 ----a-w- c:\windows\system32\isign32.dll

2010-11-06 00:26 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:26 . 2004-08-04 10:00 43520 ------w- c:\windows\system32\licmgr10.dll

2010-11-06 00:26 . 2004-08-04 10:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-11-03 12:25 . 2004-08-04 10:00 385024 ------w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2004-08-04 10:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

2010-10-28 13:13 . 2004-08-04 10:00 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-10-26 13:25 . 2004-08-04 10:00 1853312 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"Norton Ghost 12.0"="c:\program files\Norton Ghost\Agent\VProTray.exe" [2008-11-13 2037096]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="c:\program files\Nokia PC Suite\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Amazon Unbox.lnk]

backup=c:\windows\pss\Amazon Unbox.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2010-09-23 21:36 624056 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2007-03-09 18:09 63712 -c--a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 15:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amazongsdownloadertray]

2009-05-20 21:17 223744 ----a-w- c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService]

2003-06-11 18:54 4608 -c--a-w- c:\windows\system32\carpserv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Citi Virtual Account Numbers]

2009-07-10 23:53 372736 ----a-w- c:\progra~1\VIRTUA~1\CitiVAN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 18:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0]

2008-11-13 00:01 2037096 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OP14 Reminder]

2003-07-07 17:29 729088 -c--a-r- c:\program files\ScanSoft\OmniPagePro14.0\EregEng\Ereg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpScheduler]

2004-03-08 20:33 114688 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\OpScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware14]

2004-03-08 20:30 57344 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\opware14.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

2007-06-18 23:10 271360 -c--a-w- c:\program files\Nokia PC Suite\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Converter Registry Controller]

2003-09-30 17:55 102400 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfCnv\RegistryController.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SharpTray]

2003-07-18 17:58 28672 -c--a-w- c:\program files\Sharp\Sharpdesk\SharpTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2003-10-14 17:22 155648 -c--a-r- c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSPrnAgent]

2003-10-29 10:07 20480 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 19:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2010-12-14 20:02 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2007-07-04 03:11 185896 -c--a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorkFlowTray]

2004-03-08 20:31 155747 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TSScheduleBackup"=2 (0x2)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"FLEXnet Licensing Service"=3 (0x3)

"amazon download agent"=2 (0x2)

"ADVService"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]

R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [7/9/2010 11:40 AM 65856]

R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [12/20/2007 1:03 AM 23200]

S1 b3f546b2;b3f546b2;c:\windows\system32\drivers\b3f546b2.sys [6/5/2009 5:55 AM 0]

S2 ssport;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\F.tmp --> c:\windows\system32\F.tmp [?]

S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [9/3/2009 4:21 PM 127656]

S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [8/18/2007 4:49 PM 10430]

S3 USBVSP;USBVSP;c:\windows\system32\drivers\usbvsp.sys [11/22/2007 12:29 AM 89728]

S4 amazon download agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [9/30/2009 7:44 PM 297472]

S4 TSScheduleBackup;TimeslipsBackup;c:\windows\system32\TSSchBkpService.exe [7/7/2007 4:12 PM 705024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/advanced_search

uInternet Settings,ProxyServer = http=127.0.0.1:6522

uInternet Settings,ProxyOverride = <local>

Trusted Zone: aol.com\free

Trusted Zone: humana-medicare.com

Trusted Zone: intuit.com

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

FF - ProfilePath - c:\documents and settings\Steve Sokol\Application Data\Mozilla\Firefox\Profiles\5z4v44e5.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Virtual Account Numbers: citius@orbiscom - c:\program files\Virtual Account Numbers

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-09 00:19

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\F.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F928A42E-A485-A8B7-A8CC-6E7802559D58}*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"ianhlbjfebnofkegph"=hex:6a,61,6a,6b,6e,65,6c,6e,6d,66,64,66,66,69,62,70,63,6e,

69,6f,00,d0

"hahffkgkenhelpng"=hex:6a,61,6a,6b,63,66,6d,6d,6d,6c,63,65,67,6e,69,66,70,6f,

66,6d,00,22

"iajelklmbnpiaghgac"=hex:63,61,6d,6b,6d,67,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@DACL=(02 0010)

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(680)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1940)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2011-01-09 00:34:10

ComboFix-quarantined-files.txt 2011-01-09 08:33

ComboFix2.txt 2011-01-06 01:44

ComboFix3.txt 2011-01-05 16:22

ComboFix4.txt 2011-01-05 09:25

ComboFix5.txt 2011-01-09 07:47

Pre-Run: 7,652,208,640 bytes free

Post-Run: 7,623,200,768 bytes free

- - End Of File - - 929D9752542AA549EC6A60CF11284E89

[Elise]

We are dealing here either with a false positive detection or a new variant of an advanced rootkit. Before I rule out any of these possibilities, I want to be absolutely sure, as you can imagine. I could just tell you: DrWeb is detecting a false positive (would hardly be the first time) and RKU shows a glitch, but I think you rather have I''m absolutely sure when I say that.

For that reason, I want to see a copy of the file RKU is flagging. For that to work, we first need to rename it and then replace it with a known clean copy. Afterwards we can analyse the renamed file and see if it was patched or not.

Please let me know if you have an XP CD at hand we can use (if not, no problem, I'll post additional instructions).

For now, lets fix all visible malware with a script.

CF-SCRIPT

-------------

We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:
  

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:6522

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Lets also have a look for possible replacement copies: please rerun OTL, click the NONE button and copy/paste the following into the "custom scan/fix" field. Then click Run Scan. Post me the resulting log.

/md5start
volsnap.sys
/md5stop

Finally, please describe how your computer is running (especially malware symptoms). Are the redirects still occurring and what error messages do you get?

[rhino1]

i do have xp cd.

nothing new with computer. redirects continue. i suspect virus-generated warning messages would also continue, but i don't keep redirect pages open long enough for that to occur.

so i don't think it's a false positive.

here's combo again. still need to run otl.

ComboFix 11-01-08.04 - Steve Sokol 01/09/2011 9:42.12.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1156 [GMT -8:00]

Running from: c:\documents and settings\Steve Sokol\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Steve Sokol\Desktop\CFScript.txt

.

((((((((((((((((((((((((( Files Created from 2010-12-09 to 2011-01-09 )))))))))))))))))))))))))))))))

.

2011-01-09 06:25 . 2011-01-09 07:29 -------- d-----w- C:\Lop SD

2011-01-07 07:09 . 2011-01-07 07:09 -------- d-----w- C:\_OTL

2011-01-07 05:18 . 2011-01-07 05:18 -------- d-----w- c:\documents and settings\Steve Sokol\DoctorWeb

2011-01-07 04:01 . 2011-01-07 04:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2011-01-07 03:59 . 2011-01-07 03:59 -------- d-sh--w- c:\documents and settings\Steve Sokol\IECompatCache

2011-01-07 03:57 . 2011-01-07 03:57 -------- d-sh--w- c:\documents and settings\Steve Sokol\PrivacIE

2011-01-07 03:56 . 2011-01-07 03:56 -------- d-sh--w- c:\documents and settings\Steve Sokol\IETldCache

2011-01-07 03:50 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll

2011-01-07 03:49 . 2010-11-06 00:26 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2011-01-07 03:49 . 2010-11-06 00:26 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2011-01-07 03:49 . 2010-11-06 00:26 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2011-01-07 03:47 . 2011-01-07 03:48 -------- dc-h--w- c:\windows\ie8

2011-01-07 03:33 . 2011-01-07 03:33 -------- d-----w- c:\program files\Ace Utilities

2011-01-07 00:12 . 2011-01-07 00:12 2 --shatr- c:\windows\winstart.bat

2011-01-07 00:12 . 2011-01-07 00:15 -------- d-----w- c:\program files\UnHackMe

2011-01-06 22:11 . 2011-01-06 22:15 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-01-06 22:11 . 2011-01-06 22:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro

2011-01-06 17:22 . 2011-01-06 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure

2011-01-06 17:09 . 2011-01-06 17:09 -------- d-----w- c:\program files\Common Files\Java

2011-01-06 17:09 . 2011-01-06 17:08 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2011-01-06 17:09 . 2011-01-06 17:08 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-01-06 17:09 . 2011-01-06 17:08 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-01-06 17:08 . 2011-01-06 17:08 -------- d-----w- c:\program files\Java

2011-01-06 16:14 . 2011-01-06 18:43 -------- d-----w- c:\documents and settings\Jamie

2011-01-06 08:04 . 2011-01-06 08:04 -------- d-----w- c:\documents and settings\Steve Sokol\Application Data\SUPERAntiSpyware.com

2011-01-06 08:04 . 2011-01-06 08:04 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-01-06 08:04 . 2011-01-06 08:05 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-01-06 02:51 . 2011-01-06 02:51 -------- d-----w- c:\program files\ESET

2011-01-05 23:57 . 2011-01-05 23:57 -------- d-----w- c:\program files\Sophos

2011-01-05 19:19 . 2011-01-05 19:19 388096 ----a-r- c:\documents and settings\Steve Sokol\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-01-05 19:19 . 2011-01-05 19:19 -------- d-----w- c:\program files\Trend Micro

2011-01-05 15:34 . 2011-01-05 16:23 -------- d-----w- C:\Steve

2011-01-05 07:18 . 2011-01-05 07:18 -------- d-----w- c:\windows\system32\wbem\Repository

2011-01-05 07:03 . 2011-01-05 07:18 -------- d-----w- C:\32788R22FWJFW(2)

2011-01-05 06:48 . 2011-01-05 06:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-01-05 06:46 . 2011-01-05 06:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-12-26 07:22 . 2010-12-26 07:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\IsolatedStorage

2010-12-15 15:18 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-15 15:17 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-21 02:09 . 2010-05-23 02:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-21 02:08 . 2010-05-23 02:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-18 18:12 . 2007-07-02 22:21 81920 ----a-w- c:\windows\system32\isign32.dll

2010-11-06 00:26 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:26 . 2004-08-04 10:00 43520 ------w- c:\windows\system32\licmgr10.dll

2010-11-06 00:26 . 2004-08-04 10:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-11-03 12:25 . 2004-08-04 10:00 385024 ------w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2004-08-04 10:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

2010-10-28 13:13 . 2004-08-04 10:00 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-10-26 13:25 . 2004-08-04 10:00 1853312 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((( SnapShot@2011-01-09_08.20.09 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-01-09 17:20 . 2011-01-09 17:20 16384 c:\windows\temp\Perflib_Perfdata_77c.dat

+ 2011-01-09 17:20 . 2011-01-09 17:20 16384 c:\windows\temp\Perflib_Perfdata_720.dat

- 2011-01-07 07:16 . 2011-01-09 06:20 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2011-01-07 07:16 . 2011-01-09 17:20 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2007-07-02 22:27 . 2011-01-09 17:20 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

- 2007-07-02 22:27 . 2011-01-09 06:20 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

+ 2010-08-19 21:43 . 2011-01-09 17:20 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

- 2010-08-19 21:43 . 2011-01-09 06:20 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"Norton Ghost 12.0"="c:\program files\Norton Ghost\Agent\VProTray.exe" [2008-11-13 2037096]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Nokia.PCSync"="c:\program files\Nokia PC Suite\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-12 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Amazon Unbox.lnk]

backup=c:\windows\pss\Amazon Unbox.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2010-09-23 21:36 624056 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2007-03-09 18:09 63712 -c--a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 15:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amazongsdownloadertray]

2009-05-20 21:17 223744 ----a-w- c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService]

2003-06-11 18:54 4608 -c--a-w- c:\windows\system32\carpserv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Citi Virtual Account Numbers]

2009-07-10 23:53 372736 ----a-w- c:\progra~1\VIRTUA~1\CitiVAN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 18:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 12.0]

2008-11-13 00:01 2037096 ----a-w- c:\program files\Norton Ghost\Agent\VProTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OP14 Reminder]

2003-07-07 17:29 729088 -c--a-r- c:\program files\ScanSoft\OmniPagePro14.0\EregEng\Ereg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpScheduler]

2004-03-08 20:33 114688 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\OpScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware14]

2004-03-08 20:30 57344 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\opware14.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

2007-06-18 23:10 271360 -c--a-w- c:\program files\Nokia PC Suite\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Converter Registry Controller]

2003-09-30 17:55 102400 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfCnv\RegistryController.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SharpTray]

2003-07-18 17:58 28672 -c--a-w- c:\program files\Sharp\Sharpdesk\SharpTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2003-10-14 17:22 155648 -c--a-r- c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSPrnAgent]

2003-10-29 10:07 20480 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\PdfPrn\SPrnAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 19:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2010-12-14 20:02 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2007-07-04 03:11 185896 -c--a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorkFlowTray]

2004-03-08 20:31 155747 -c--a-w- c:\program files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TSScheduleBackup"=2 (0x2)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"FLEXnet Licensing Service"=3 (0x3)

"amazon download agent"=2 (0x2)

"ADVService"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]

R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [7/9/2010 11:40 AM 65856]

R2 ppsio2;PPDevice;c:\windows\system32\drivers\ppsio2.sys [12/20/2007 1:03 AM 23200]

S1 b3f546b2;b3f546b2;c:\windows\system32\drivers\b3f546b2.sys [6/5/2009 5:55 AM 0]

S2 ssport;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\F.tmp --> c:\windows\system32\F.tmp [?]

S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [9/3/2009 4:21 PM 127656]

S3 SecBulk;SECBULK.sys, SEC SOC USBD Driver;c:\windows\system32\drivers\secbulk.sys [8/18/2007 4:49 PM 10430]

S3 USBVSP;USBVSP;c:\windows\system32\drivers\usbvsp.sys [11/22/2007 12:29 AM 89728]

S4 amazon download agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [9/30/2009 7:44 PM 297472]

S4 TSScheduleBackup;TimeslipsBackup;c:\windows\system32\TSSchBkpService.exe [7/7/2007 4:12 PM 705024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/advanced_search

uInternet Settings,ProxyOverride = <local>

Trusted Zone: aol.com\free

Trusted Zone: humana-medicare.com

Trusted Zone: intuit.com

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

FF - ProfilePath - c:\documents and settings\Steve Sokol\Application Data\Mozilla\Firefox\Profiles\5z4v44e5.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Virtual Account Numbers: citius@orbiscom - c:\program files\Virtual Account Numbers

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-09 10:07

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\F.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-842925246-1409082233-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F928A42E-A485-A8B7-A8CC-6E7802559D58}*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"ianhlbjfebnofkegph"=hex:6a,61,6a,6b,6e,65,6c,6e,6d,66,64,66,66,69,62,70,63,6e,

69,6f,00,d0

"hahffkgkenhelpng"=hex:6a,61,6a,6b,63,66,6d,6d,6d,6c,63,65,67,6e,69,66,70,6f,

66,6d,00,22

"iajelklmbnpiaghgac"=hex:63,61,6d,6b,6d,67,00,7c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@DACL=(02 0010)

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(680)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2244)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2011-01-09 10:22:52

ComboFix-quarantined-files.txt 2011-01-09 18:22

ComboFix2.txt 2011-01-09 08:34

ComboFix3.txt 2011-01-06 01:44

ComboFix4.txt 2011-01-05 16:22

ComboFix5.txt 2011-01-09 17:35

Pre-Run: 7,638,265,856 bytes free

Post-Run: 7,611,330,560 bytes free

- - End Of File - - C8C180F91F6A7A2018FE0A5BEAE82111

[rhino1]

please see these postings regarding similar problem.

http://www.infocarnivore.com/2010/05/19/de...kdoor-tdss-565/

[rhino1]

please see these postings regarding similar problem.

http://www.infocarnivore.com/2010/05/19/de...kdoor-tdss-565/

his fix didn't work for me.

and this fix seems way too complicated:

http://forums.windrivers.com/showthread.php?t=84176

[rhino1]

OTL logfile created on: 1/9/2011 11:08:29 AM - Run 5

OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Steve Sokol\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 92.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 43.95 Gb Total Space | 7.12 Gb Free Space | 16.20% Space Free | Partition Type: NTFS

Drive D: | 105.10 Gb Total Space | 105.02 Gb Free Space | 99.93% Space Free | Partition Type: NTFS

Drive G: | 7.52 Gb Total Space | 3.12 Gb Free Space | 41.49% Space Free | Partition Type: FAT32

Computer Name: STEVE-B845C28B7 | User Name: Steve Sokol | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< MD5 for: VOLSNAP.SYS >

[2008/04/13 10:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\ServicePackFiles\i386\volsnap.sys

[2004/08/04 02:00:00 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys

[2008/04/13 10:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\volsnap.sys

< >

< End of report >

[Elise]

That definitely looks like something is not okay with volsnap.sys

• Insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
  
• If your PC is not booting from the CD, you need to change the boot order:
  
  • Restart your PC
    
  • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
    
  • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
    
  • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
    
  • The tab should now show your current boot order.
    If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
    
  • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
    

  [*]Your PC should now boot from your XP-CD.

  Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.

  [*]When the "Welcome to Setup" screen appears, press R to start the Recovery Console.

  [*]When prompted to choose a windows installation, type 1 and press enter.

  [*]When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

  [*]A command prompt will open

Type the following lines and press enter after each line.

cd system32\drivers

ren volsnap.sys volsnap.vir

copy C:\WINDOWS\ServicePackFiles\i386\volsnap.sys volsnap.sys

exit

Back in Normal Mode, let me know how things are running (still redirects)?

Also upload the following file to www.virustotal.com: c:\windows\system32\drivers\volsnap.sys

[rhino1]

Not sure on status, although i am somewhat optimistic that you got it. i don't get immediate redirect. and tdss killer now does load; i have not run it however.

but alt/cont/del function still does not work.

i have been afraid to check on redirect very much because i previously deleted avg, spybot and a popup blocker program, in order to be able to run all of the other malware programs.

so now i have no protection.

what free protection software do you recommend? i also have an unused paid license for kaspersky internet security 2009.

thanks again for your help!