Jump to content

Im sorry to all Admins! A cry for help.

VenomRx

By VenomRx
in Resolved Malware Removal Logs

 Share

Recommended Posts

VenomRx

VenomRx

Posted
Posted

Scanned with malwarebytes and found 200 infections, I removed all infections and scanned again, it finds nothing but computer slows down and the tool bar changes color.Thanks in advance.

OTL logfile created on: 2/3/2011 11:31:09 AM - Run 1

OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\skater boy\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 113.00 Mb Available Physical Memory | 22.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.50 Gb Total Space | 35.15 Gb Free Space | 47.18% Space Free | Partition Type: NTFS

Drive F: | 7.75 Gb Total Space | 7.22 Gb Free Space | 93.15% Space Free | Partition Type: FAT32

Computer Name: NEC-E750A3827B0 | User Name: skater boy | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/03 11:29:06 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skater boy\Desktop\OTL.exe

PRC - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/02/23 19:35:23 | 000,020,480 | ---- | M] (Logitech) -- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe

PRC - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe

PRC - [2009/11/16 09:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe

PRC - [2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005/11/22 20:58:48 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe

PRC - [2005/01/18 17:37:30 | 000,217,088 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Video\LogiTray.exe

PRC - [2005/01/18 17:08:36 | 000,192,512 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Video\FxSvr2.exe

PRC - [2004/10/15 12:54:14 | 000,100,016 | ---- | M] (America Online, Inc) -- C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

PRC - [2004/10/15 12:54:12 | 000,046,768 | ---- | M] (America Online Inc) -- C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe

PRC - [2004/10/14 14:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe

PRC - [2004/10/08 11:52:32 | 000,221,184 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\system32\LVCOMSX.EXE

========== Modules (SafeList) ==========

MOD - [2011/02/03 11:29:06 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skater boy\Desktop\OTL.exe

MOD - [2010/08/23 08:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)

SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2009/11/16 09:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)

SRV - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)

SRV - [2005/11/22 20:58:48 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2004/10/15 12:54:14 | 000,100,016 | ---- | M] (America Online, Inc) [Auto | Running] -- C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe -- (AOL TopSpeedMonitor)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)

DRV - [2009/11/16 09:06:48 | 000,055,768 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)

DRV - [2009/11/16 09:06:44 | 000,135,048 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)

DRV - [2009/11/16 09:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)

DRV - [2009/11/16 08:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)

DRV - [2009/06/19 08:10:40 | 000,033,096 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)

DRV - [2009/03/20 18:03:36 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys -- (SMSIVZAM5)

DRV - [2008/04/13 10:56:49 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)

DRV - [2008/04/13 10:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)

DRV - [2008/04/13 10:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)

DRV - [2004/10/08 03:59:11 | 000,326,656 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Camdrl.sys -- (CamDrL) Logitech QuickCam Pro 3000(CamDrl)

DRV - [2004/10/08 03:57:48 | 000,022,016 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - [2004/09/29 10:45:32 | 000,026,525 | R--- | M] (SMC2208USB/ETH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SMC2208.SYS -- (SMC2208)

DRV - [2004/09/17 09:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)

DRV - [2004/08/04 02:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)

DRV - [2004/08/04 02:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)

DRV - [2003/01/10 13:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 32 31 3C 79 D8 C3 CB 01 [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local

FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2011/02/02 18:57:51 | 000,000,000 | ---D | M]

[2011/02/01 17:14:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\skater boy\Application Data\Mozilla\Extensions

[2010/09/19 07:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\skater boy\Application Data\Mozilla\Extensions\mozswing@mozswing.org

O1 HOSTS File: ([2011/02/03 10:07:03 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {B80F591E-FE9A-46CF-A13E-180377240586} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {CE18769B-C7FA-42D2-860D-17C4662C70AD} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.

O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)

O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)

O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)

O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKCU..\Run: [iSUSPM] C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)

O4 - HKCU..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe (Logitech)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - File not found

O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - File not found

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/01/15 20:30:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: AppMgmt - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/02/03 11:28:54 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\skater boy\Desktop\OTL.exe

[2011/02/03 11:08:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Local Settings\Application Data\ESET

[2011/02/02 18:59:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Application Data\ESET

[2011/02/02 18:57:49 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/02/02 18:57:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ESET

[2011/02/02 18:57:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET

[2011/02/02 15:49:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2011/02/02 14:59:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes

[2011/02/02 14:58:14 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2011/02/02 14:56:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime

[2011/02/02 14:55:41 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime

[2011/02/02 14:54:00 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update

[2011/02/02 14:53:19 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour

[2011/02/02 14:52:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple

[2011/02/02 14:34:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office

[2011/02/02 14:32:26 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works

[2011/02/02 14:31:41 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio

[2011/02/02 14:31:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER

[2011/02/02 14:30:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2011/02/02 14:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 8

[2011/02/02 14:27:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW

[2011/02/02 14:26:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Local Settings\Application Data\Microsoft Help

[2011/02/02 14:26:50 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office

[2011/02/02 14:26:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft Help

[2011/02/02 14:26:01 | 000,000,000 | R--D | C] -- C:\MSOCache

[2011/02/01 19:41:56 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\skater boy\IECompatCache

[2011/02/01 19:35:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates

[2011/02/01 19:33:08 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8

[2011/02/01 18:41:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch

[2011/02/01 18:24:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting

[2011/02/01 18:24:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas

[2011/02/01 18:24:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en

[2011/02/01 18:24:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits

[2011/02/01 18:20:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic

[2011/02/01 18:15:40 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$

[2011/02/01 18:15:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\EHome

[2011/02/01 17:33:26 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2011/02/01 17:29:47 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011/02/01 17:29:47 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011/02/01 17:29:47 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011/02/01 17:29:47 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2011/02/01 17:29:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2011/02/01 17:29:28 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011/02/01 17:17:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Start Menu\Programs\WinRAR

[2011/02/01 17:17:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR

[2011/02/01 17:04:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Application Data\URSoft

[2011/02/01 17:04:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2011/02/01 17:04:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Your Uninstaller 2010

[2011/02/01 17:04:49 | 000,000,000 | ---D | C] -- C:\Program Files\Your Uninstaller 2010

[2011/02/01 10:25:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\VirtualEar

[2011/02/01 10:25:35 | 000,045,056 | ---- | C] (adi) -- C:\WINDOWS\System32\CleanUp.exe

[2011/02/01 10:25:35 | 000,000,000 | ---D | C] -- C:\Program Files\Analog Devices

[2011/02/01 10:17:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Application Data\MSNInstaller

[2011/02/01 09:52:14 | 000,000,000 | ---D | C] -- C:\Program Files\Intel

[2011/01/31 20:57:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\VIRepair

[2011/01/31 18:30:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Application Data\Malwarebytes

[2011/01/31 18:30:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011/01/31 18:30:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2011/01/31 18:30:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011/01/31 18:30:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011/01/31 18:30:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2011/01/10 21:06:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\skater boy\Application Data\Styler

[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/03 11:29:06 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\skater boy\Desktop\OTL.exe

[2011/02/03 11:09:07 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011/02/03 10:07:03 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2011/02/03 10:06:55 | 000,000,890 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011/02/03 10:02:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/02/02 19:06:36 | 000,288,107 | ---- | M] () -- C:\Documents and Settings\skater boy\Desktop\gmer.zip

[2011/02/02 16:18:31 | 000,260,839 | ---- | M] () -- C:\Documents and Settings\skater boy\Desktop\Doc1.docx

[2011/02/02 15:16:08 | 000,270,192 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011/02/02 14:59:55 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2011/02/02 14:56:39 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk

[2011/02/02 14:54:05 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2011/02/02 14:25:18 | 000,035,840 | ---- | M] () -- C:\Documents and Settings\skater boy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/02/01 19:52:48 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/02/01 19:47:22 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2011/02/01 19:39:21 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\skater boy\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2011/02/01 19:12:27 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/02/01 19:12:27 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/02/01 18:20:19 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011/02/01 17:33:31 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2011/02/01 10:11:53 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

[2011/01/31 20:46:21 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/01/04 18:57:59 | 000,019,672 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat

[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/02 19:07:32 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\skater boy\Desktop\gmer.exe

[2011/02/02 19:06:32 | 000,288,107 | ---- | C] () -- C:\Documents and Settings\skater boy\Desktop\gmer.zip

[2011/02/02 16:18:08 | 000,260,839 | ---- | C] () -- C:\Documents and Settings\skater boy\Desktop\Doc1.docx

[2011/02/02 14:59:55 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk

[2011/02/02 14:56:39 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk

[2011/02/02 14:54:04 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2011/02/02 14:54:01 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk

[2011/02/01 19:27:14 | 000,000,785 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk

[2011/02/01 18:42:21 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\skater boy\Start Menu\Programs\Outlook Express.lnk

[2011/02/01 17:33:31 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2011/02/01 17:33:28 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2011/02/01 17:29:47 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/02/01 17:29:47 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/02/01 17:29:47 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/02/01 17:29:47 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/02/01 17:29:47 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/02/01 09:59:38 | 000,001,902 | ---- | C] () -- C:\WINDOWS\System32\SetupBD.din

[2011/02/01 09:58:58 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

[2011/02/01 09:58:58 | 000,005,110 | ---- | C] () -- C:\WINDOWS\System32\e100b325.din

[2011/01/29 16:53:14 | 000,039,851 | ---- | C] () -- C:\Documents and Settings\skater boy\Local Settings\Application Data\FASTWiz.log

[2011/01/04 18:57:59 | 000,019,672 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/01/03 17:57:32 | 000,000,664 | ---- | C] () -- C:\Documents and Settings\skater boy\Local Settings\Application Data\d3d9caps.dat

[2010/12/20 14:23:38 | 000,019,644 | ---- | C] () -- C:\WINDOWS\System32\WMSPerf.ini

[2010/11/29 21:10:16 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI

[2010/10/04 13:37:50 | 000,000,097 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2010/10/02 07:52:02 | 000,000,640 | ---- | C] () -- C:\Documents and Settings\skater boy\Application Data\ReplayConverterLog.log

[2010/09/30 19:59:16 | 000,000,022 | ---- | C] () -- C:\WINDOWS\pspvc_path.ini

[2010/09/28 18:43:23 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2010/09/28 18:32:28 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll

[2010/09/28 18:29:00 | 000,004,779 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2010/02/27 15:50:07 | 000,035,840 | ---- | C] () -- C:\Documents and Settings\skater boy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/02/23 19:39:57 | 000,006,812 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2010/02/23 19:33:47 | 000,000,770 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Installer.log

[2010/01/15 21:10:11 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2010/01/15 12:17:53 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2001/07/07 02:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

[1999/01/27 13:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll

[1997/06/13 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2011/01/01 11:17:45 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\1e6fcc

[2010/09/09 17:54:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\391F

[2010/10/13 14:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon

[2010/09/20 13:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

[2010/12/28 19:45:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Boost

[2011/01/03 18:42:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz

[2011/02/02 18:57:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET

[2010/12/22 14:00:35 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\IAUEVLMMHWV

[2010/11/09 20:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance

[2010/10/11 15:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Optimizer Pro

[2010/09/30 19:59:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PSPVC

[2010/09/20 13:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2011/02/01 17:18:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/02/01 20:41:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2010/11/05 14:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Winferno

[2010/09/19 07:16:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/11/15 20:42:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\AnvSoft

[2010/11/01 20:47:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Azureus

[2010/10/01 14:00:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Babylon

[2010/12/24 12:10:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\CBS Interactive

[2011/01/01 21:28:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\com.w3i.FlipToast

[2011/01/05 14:50:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\DriverFinder

[2010/12/16 13:18:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Elluminate

[2011/02/02 18:59:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\ESET

[2011/01/31 20:47:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\FrostWire

[2010/10/02 07:47:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\HandBrake

[2011/02/01 10:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\MSNInstaller

[2010/11/01 15:03:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Need for Speed World

[2010/11/14 11:06:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Nuance

[2010/11/15 20:42:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\OpenCandy

[2010/11/12 17:51:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Search Settings

[2011/02/01 17:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Sony

[2011/01/10 21:06:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Styler

[2010/11/16 14:36:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Uniblue

[2011/02/01 17:04:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\URSoft

[2010/10/04 16:00:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\YouTube Downloader

[2010/09/20 13:47:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\skater boy\Application Data\Zeon

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2010/01/15 20:30:02 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2010/01/31 15:50:27 | 000,000,211 | ---- | M] () -- C:\Boot.bak

[2011/02/01 17:33:31 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr

[2011/02/03 11:22:28 | 000,016,792 | ---- | M] () -- C:\ComboFix.txt

[2010/01/15 20:30:02 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2010/10/21 17:01:06 | 000,000,618 | ---- | M] () -- C:\debug.log

[2010/01/31 19:17:09 | 000,000,055 | ---- | M] () -- C:\DVDPATH.TXT

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt

[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt

[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt

[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt

[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini

[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini

[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll

[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll

[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll

[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll

[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll

[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll

[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll

[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll

[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll

[2010/01/15 20:30:02 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010/01/31 16:42:30 | 000,001,599 | -H-- | M] () -- C:\IPH.PH

[2010/02/23 19:35:29 | 000,000,183 | ---- | M] () -- C:\LogiSetup.log

[2011/02/01 10:23:08 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt

[2010/01/15 20:30:02 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004/08/04 02:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2011/02/01 18:20:19 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011/02/03 10:02:37 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys

[2011/02/01 10:32:19 | 000,000,702 | ---- | M] () -- C:\rkill.log

[2011/02/02 18:51:34 | 000,038,248 | ---- | M] () -- C:\TDSSKiller.2.4.16.0_02.02.2011_18.50.49_log.txt

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

[2010/01/15 12:13:20 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2010/01/15 12:13:20 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2010/01/15 12:13:20 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-12 11:04:11

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 168 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CE11B51

< End of report >

Link to post
Share on other sites
VenomRx

VenomRx

Posted
  • Author
Posted

2011/02/02 18:50:49.0531 3508 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03

2011/02/02 18:50:49.0953 3508 ================================================================================

2011/02/02 18:50:49.0953 3508 SystemInfo:

2011/02/02 18:50:49.0953 3508

2011/02/02 18:50:49.0953 3508 OS Version: 5.1.2600 ServicePack: 3.0

2011/02/02 18:50:49.0953 3508 Product type: Workstation

2011/02/02 18:50:49.0953 3508 ComputerName: NEC-E750A3827B0

2011/02/02 18:50:49.0953 3508 UserName: skater boy

2011/02/02 18:50:49.0953 3508 Windows directory: C:\WINDOWS

2011/02/02 18:50:49.0953 3508 System windows directory: C:\WINDOWS

2011/02/02 18:50:49.0953 3508 Processor architecture: Intel x86

2011/02/02 18:50:49.0953 3508 Number of processors: 1

2011/02/02 18:50:49.0953 3508 Page size: 0x1000

2011/02/02 18:50:49.0953 3508 Boot type: Normal boot

2011/02/02 18:50:49.0953 3508 ================================================================================

2011/02/02 18:50:50.0296 3508 Initialize success

2011/02/02 18:50:52.0937 3552 ================================================================================

2011/02/02 18:50:52.0937 3552 Scan started

2011/02/02 18:50:52.0937 3552 Mode: Manual;

2011/02/02 18:50:52.0937 3552 ================================================================================

2011/02/02 18:50:53.0984 3552 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/02/02 18:50:54.0156 3552 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/02/02 18:50:54.0281 3552 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/02/02 18:50:54.0468 3552 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2011/02/02 18:50:54.0812 3552 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/02/02 18:50:54.0984 3552 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/02/02 18:50:55.0406 3552 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/02/02 18:50:55.0562 3552 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/02/02 18:50:55.0796 3552 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/02/02 18:50:55.0906 3552 CamDrL (cba8bce5bf67a3c619d5ce540bed9cf7) C:\WINDOWS\system32\DRIVERS\Camdrl.sys

2011/02/02 18:50:56.0250 3552 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/02/02 18:50:56.0312 3552 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/02/02 18:50:56.0484 3552 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/02/02 18:50:56.0656 3552 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/02/02 18:50:56.0734 3552 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/02/02 18:50:56.0921 3552 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys

2011/02/02 18:50:57.0203 3552 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/02/02 18:50:57.0437 3552 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/02/02 18:50:57.0656 3552 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/02/02 18:50:57.0875 3552 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/02/02 18:50:58.0046 3552 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/02/02 18:50:58.0312 3552 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/02/02 18:50:58.0437 3552 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys

2011/02/02 18:50:58.0640 3552 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/02/02 18:50:58.0812 3552 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/02/02 18:50:58.0906 3552 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/02/02 18:50:59.0078 3552 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/02/02 18:50:59.0156 3552 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/02/02 18:50:59.0343 3552 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/02/02 18:50:59.0421 3552 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/02/02 18:50:59.0609 3552 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

2011/02/02 18:50:59.0734 3552 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/02/02 18:50:59.0921 3552 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/02/02 18:51:00.0031 3552 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

2011/02/02 18:51:00.0250 3552 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

2011/02/02 18:51:00.0468 3552 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

2011/02/02 18:51:00.0640 3552 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/02/02 18:51:00.0953 3552 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/02/02 18:51:01.0203 3552 ialm (0294a30b302ca71a2c26e582dda93486) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2011/02/02 18:51:01.0437 3552 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/02/02 18:51:01.0796 3552 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/02/02 18:51:01.0890 3552 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/02/02 18:51:02.0000 3552 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/02/02 18:51:02.0093 3552 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/02/02 18:51:02.0250 3552 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/02/02 18:51:02.0375 3552 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/02/02 18:51:02.0562 3552 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/02/02 18:51:02.0671 3552 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/02/02 18:51:02.0828 3552 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/02/02 18:51:02.0937 3552 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/02/02 18:51:03.0125 3552 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/02/02 18:51:03.0203 3552 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/02/02 18:51:03.0390 3552 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/02/02 18:51:03.0656 3552 LVUSBSta (90259f3a20fbaec1a08d74ef5415b9d8) C:\WINDOWS\system32\drivers\lvusbsta.sys

2011/02/02 18:51:03.0750 3552 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/02/02 18:51:03.0921 3552 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/02/02 18:51:04.0000 3552 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys

2011/02/02 18:51:04.0156 3552 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/02/02 18:51:04.0296 3552 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/02/02 18:51:04.0484 3552 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/02/02 18:51:04.0703 3552 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/02/02 18:51:04.0906 3552 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/02/02 18:51:05.0093 3552 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/02/02 18:51:05.0171 3552 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/02/02 18:51:05.0312 3552 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/02/02 18:51:05.0390 3552 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/02/02 18:51:05.0562 3552 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/02/02 18:51:05.0625 3552 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/02/02 18:51:05.0796 3552 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/02/02 18:51:05.0968 3552 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/02/02 18:51:06.0078 3552 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/02/02 18:51:06.0250 3552 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/02/02 18:51:06.0328 3552 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/02/02 18:51:06.0500 3552 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/02/02 18:51:06.0578 3552 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/02/02 18:51:06.0750 3552 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/02/02 18:51:06.0828 3552 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/02/02 18:51:07.0000 3552 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/02/02 18:51:07.0125 3552 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/02/02 18:51:07.0312 3552 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/02/02 18:51:07.0515 3552 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/02/02 18:51:07.0593 3552 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/02/02 18:51:07.0718 3552 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/02/02 18:51:07.0812 3552 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys

2011/02/02 18:51:07.0953 3552 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys

2011/02/02 18:51:08.0015 3552 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys

2011/02/02 18:51:08.0140 3552 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/02/02 18:51:08.0312 3552 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/02/02 18:51:08.0484 3552 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/02/02 18:51:08.0687 3552 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/02/02 18:51:09.0046 3552 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/02/02 18:51:09.0296 3552 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/02/02 18:51:10.0656 3552 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/02/02 18:51:10.0906 3552 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/02/02 18:51:11.0109 3552 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/02/02 18:51:12.0062 3552 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/02/02 18:51:12.0250 3552 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/02/02 18:51:12.0437 3552 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/02/02 18:51:12.0812 3552 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/02/02 18:51:13.0125 3552 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/02/02 18:51:13.0312 3552 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/02/02 18:51:13.0593 3552 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/02/02 18:51:14.0218 3552 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/02/02 18:51:14.0546 3552 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys

2011/02/02 18:51:14.0812 3552 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/02/02 18:51:15.0234 3552 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys

2011/02/02 18:51:15.0437 3552 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/02/02 18:51:15.0531 3552 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/02/02 18:51:15.0796 3552 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/02/02 18:51:16.0187 3552 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/02/02 18:51:16.0343 3552 SMC2208 (142f1fe694f38dbd4fafcd6f86f325a4) C:\WINDOWS\system32\DRIVERS\SMC2208.SYS

2011/02/02 18:51:16.0453 3552 SMSIVZAM5 (1e715247efffdda938c085913045d599) C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS

2011/02/02 18:51:16.0625 3552 smwdm (0066ff77aeb4ae70066f7e94d5a6d866) C:\WINDOWS\system32\drivers\smwdm.sys

2011/02/02 18:51:16.0843 3552 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/02/02 18:51:16.0953 3552 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/02/02 18:51:17.0187 3552 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/02/02 18:51:17.0437 3552 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys

2011/02/02 18:51:17.0671 3552 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/02/02 18:51:17.0828 3552 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/02/02 18:51:17.0953 3552 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/02/02 18:51:18.0390 3552 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/02/02 18:51:18.0578 3552 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/02/02 18:51:18.0750 3552 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/02/02 18:51:18.0812 3552 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/02/02 18:51:18.0906 3552 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/02/02 18:51:19.0171 3552 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/02/02 18:51:19.0390 3552 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/02/02 18:51:19.0750 3552 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

2011/02/02 18:51:19.0859 3552 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/02/02 18:51:20.0031 3552 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/02/02 18:51:20.0093 3552 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/02/02 18:51:20.0265 3552 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/02/02 18:51:20.0343 3552 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/02/02 18:51:20.0515 3552 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/02/02 18:51:20.0593 3552 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/02/02 18:51:20.0750 3552 USB_RNDIS (bee793d4a059caea55d6ac20e19b3a8f) C:\WINDOWS\system32\DRIVERS\usb8023.sys

2011/02/02 18:51:20.0843 3552 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/02/02 18:51:21.0046 3552 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/02/02 18:51:21.0156 3552 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/02/02 18:51:21.0328 3552 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

2011/02/02 18:51:21.0578 3552 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/02/02 18:51:21.0859 3552 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/02/02 18:51:21.0953 3552 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/02/02 18:51:22.0203 3552 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/02/02 18:51:22.0437 3552 ================================================================================

2011/02/02 18:51:22.0437 3552 Scan finished

2011/02/02 18:51:22.0437 3552 ================================================================================

2011/02/02 18:51:34.0531 3504 Deinitialize success

Link to post
Share on other sites
VenomRx

VenomRx

Posted
  • Author
Posted

OTL Extras logfile created on: 2/3/2011 11:31:09 AM - Run 1

OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\skater boy\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 113.00 Mb Available Physical Memory | 22.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.50 Gb Total Space | 35.15 Gb Free Space | 47.18% Space Free | Partition Type: NTFS

Drive F: | 7.75 Gb Total Space | 7.22 Gb Free Space | 93.15% Space Free | Partition Type: FAT32

Computer Name: NEC-E750A3827B0 | User Name: skater boy | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015

"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016

"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015

"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016

"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Application Loader -- (America Online, Inc.)

"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Disabled:Logitech Desktop Messenger -- (Logitech)

"C:\Program Files\Java\jre6\launch4j-tmp\wowd.exe" = C:\Program Files\Java\jre6\launch4j-tmp\wowd.exe:*:Enabled:Wowd -- (Sun Microsystems, Inc.)

"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Disabled:Files and Settings Transfer Wizard -- (Microsoft Corporation)

"C:\Program Files\VirtualDJ\virtualdj_home.exe" = C:\Program Files\VirtualDJ\virtualdj_home.exe:*:Enabled:VirtualDJ -- (Atomix Productions)

"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi and welcome to Malwarebytes.

Please describe in detail what symptoms of infection you are currently experiencing.

Post the log from MBAM where it detected 200 items.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post DDS.txt directly into your reply.

Link to post
Share on other sites
  • 3 weeks later...
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.