It's a stumper.....

dngrwill · June 1, 2011

Hello -

I'm stumped - first figured I'd been compromised when I saw spam using my email address (they scrapped the addressbook?).

The updater for Malwarebytes was somehow disabled. So I ran MWB with the most recent db and nothing came up -

here is the info (win7 ult x64. Any help would be greatly appreciated.

tc

Will

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

Run by Dan at 13:44:08 on 2011-06-01

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1377 [GMT -4:00]

.

AV: Norton Internet Security *Enabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Sprint\Sprint SmartView\RDVCHG.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\Dan\Desktop\dds.scr

C:\WINDOWS\system32\WSCRIPT.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://my.yahoo.com/index.html

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.6.0.29\ips\IPSBHO.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll

BHO: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [FolderShare] "c:\program files\foldershare\FolderShare.exe" /background

uRun: [Aim6]

uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [Apoint] c:\program files\apoint\Apoint.exe

mRun: [intelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"

mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe

mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [updateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [sprint SmartView] "c:\program files\sprint\sprint smartview\SprintSV.exe" -a

mRun: [RDVCHG] "c:\program files\sprint\sprint smartview\RDVCHG.exe"

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\docume~1\dan\startm~1\programs\startup\skysca~1.lnk - c:\program files\common files\skyscape\smARTupdate.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: bmnet.dll

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=48835

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125720196883

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\dan\application data\mozilla\firefox\profiles\ki7vo4p3.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\coffplgn\components\coFFPlgn.dll

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\ipsffplgn\components\IPSFFPl.dll

FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npDimdimControl.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Symantec IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\IPSFFPlgn

FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\coFFPlgn

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1206000.01d\symds.sys [2011-5-9 340088]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1206000.01d\symefa.sys [2011-5-9 744568]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20110430.001\BHDrvx86.sys [2011-5-5 802936]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1206000.01d\ironx86.sys [2011-5-9 136312]

R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.6.0.29\ccsvchst.exe [2011-5-9 130008]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2009-3-28 31896]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-5-16 105592]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20110513.001\IDSXpx86.sys [2011-5-16 341944]

R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\virusdefs\20110516.002\NAVENG.SYS [2011-5-16 86136]

R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\virusdefs\20110516.002\NAVEX15.SYS [2011-5-16 1393144]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-11 135664]

S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys --> c:\windows\system32\drivers\camfilt2.sys [?]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2008-12-20 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2008-12-20 3072]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-11 135664]

.

=============== File Associations ===============

.

.txt=

.

=============== Created Last 30 ================

.

2011-05-16 18:14:02 86016 ----a-w- c:\windows\system32\Epfb5cpl.dll

2011-05-16 18:14:02 47104 ----a-w- c:\windows\system32\escimgn.dll

2011-05-16 18:14:02 47104 ----a-w- c:\windows\system32\escimgd.dll

2011-05-16 18:14:02 33280 ----a-w- c:\windows\system32\esccm.dll

2011-05-16 18:14:02 27648 ----a-w- c:\windows\system32\escimg.dll

2011-05-16 18:14:02 23552 ----a-w- c:\windows\system32\esccmn.dll

2011-05-16 18:14:02 22528 ----a-w- c:\windows\system32\esccmd.dll

2011-05-16 18:03:57 90112 ----a-w- c:\windows\system32\epcomdd.dll

2011-05-16 18:03:57 77824 ----a-w- c:\windows\system32\Esintpl.dll

2011-05-16 18:03:57 66048 ----a-w- c:\windows\system32\escwian.dll

2011-05-16 18:03:57 61952 ----a-w- c:\windows\system32\escwiad.dll

2011-05-16 18:03:57 53248 ----a-w- c:\windows\system32\ESICM.dll

2011-05-16 18:03:57 44544 ----a-w- c:\windows\system32\escwiab.dll

2011-05-16 18:03:57 3584 ----a-w- c:\windows\system32\eswiaml.dll

2011-05-16 18:03:57 184320 ----a-w- c:\windows\system32\ESDTR.dll

2011-05-16 18:03:57 126976 ----a-w- c:\windows\system32\Esint23.dll

2011-05-16 18:03:29 -------- d-----w- C:\EPSON

2011-05-09 23:31:50 331384 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\symtdiv.sys

2011-05-09 23:31:49 744568 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\symefa.sys

2011-05-09 23:31:49 369784 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\symtdi.sys

2011-05-09 23:31:49 296568 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\symnets.sys

2011-05-09 23:31:48 516216 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\srtsp.sys

2011-05-09 23:31:48 50168 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\srtspx.sys

2011-05-09 23:31:48 340088 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\symds.sys

2011-05-09 23:31:48 136312 ----a-w- c:\windows\system32\drivers\nis\1206000.01d\ironx86.sys

2011-05-09 23:31:03 -------- d-----w- c:\windows\system32\drivers\nis\1206000.01D

.

==================== Find3M ====================

.

2011-05-16 21:55:20 89680 ----a-w- c:\documents and settings\dan\MSSSerif120.fon

2011-05-09 23:31:52 60872 ----a-w- c:\windows\system32\S32EVNT1.DLL

2011-05-09 23:31:52 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll

.

============= FINISH: 13:44:43.89 ===============

attach (2).zip

LDTate · June 4, 2011

:welcome:

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs from these scans, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

dngrwill · June 4, 2011

Excellent - went through all phases w/o finding anything - log below

2011/06/03 21:10:05.0093 0776 TDSS rootkit removing tool 2.5.3.0 May 25 2011

07:09:24

2011/06/03 21:10:07.0093 0776

============================================================================

====

2011/06/03 21:10:07.0093 0776 SystemInfo:

2011/06/03 21:10:07.0093 0776

2011/06/03 21:10:07.0093 0776 OS Version: 5.1.2600 ServicePack: 3.0

2011/06/03 21:10:07.0093 0776 Product type: Workstation

2011/06/03 21:10:07.0093 0776 ComputerName: WILLS9300LAPTOP

2011/06/03 21:10:07.0093 0776 UserName: Dan

2011/06/03 21:10:07.0093 0776 Windows directory: C:\WINDOWS

2011/06/03 21:10:07.0093 0776 System windows directory: C:\WINDOWS

2011/06/03 21:10:07.0093 0776 Processor architecture: Intel x86

2011/06/03 21:10:07.0093 0776 Number of processors: 1

2011/06/03 21:10:07.0093 0776 Page size: 0x1000

2011/06/03 21:10:07.0093 0776 Boot type: Normal boot

2011/06/03 21:10:07.0093 0776

============================================================================

====

2011/06/03 21:10:09.0374 0776 Initialize success

2011/06/03 21:10:14.0171 3088

============================================================================

====

2011/06/03 21:10:14.0171 3088 Scan started

2011/06/03 21:10:14.0171 3088 Mode: Manual;

2011/06/03 21:10:14.0171 3088

============================================================================

====

2011/06/03 21:10:16.0827 3088 abp480n5 (6abb91494fe6c59089b9336452ab2ea3)

C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS

2011/06/03 21:10:17.0093 3088 ACPI (8fd99680a539792a30e97944fdaecf17)

C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/06/03 21:10:17.0218 3088 ACPIEC (9859c0f6936e723e4892d7141b1327d5)

C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/06/03 21:10:17.0343 3088 adpu160m

(9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys

2011/06/03 21:10:17.0499 3088 aec (8bed39e3c35d6a489438b8141717a557)

C:\WINDOWS\system32\drivers\aec.sys

2011/06/03 21:10:17.0624 3088 AegisP (076394a345ee5e9e3911fc0f058f4f38)

C:\WINDOWS\system32\DRIVERS\AegisP.sys

2011/06/03 21:10:17.0749 3088 AFD (7618d5218f2a614672ec61a80d854a37)

C:\WINDOWS\System32\drivers\afd.sys

2011/06/03 21:10:17.0905 3088 agp440 (08fd04aa961bdc77fb983f328334e3d7)

C:\WINDOWS\system32\DRIVERS\agp440.sys

2011/06/03 21:10:18.0030 3088 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063)

C:\WINDOWS\system32\DRIVERS\agpCPQ.sys

2011/06/03 21:10:18.0155 3088 Aha154x (c23ea9b5f46c7f7910db3eab648ff013)

C:\WINDOWS\system32\DRIVERS\aha154x.sys

2011/06/03 21:10:18.0280 3088 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529)

C:\WINDOWS\system32\DRIVERS\aic78u2.sys

2011/06/03 21:10:18.0436 3088 aic78xx (b7fe594a7468aa0132deb03fb8e34326)

C:\WINDOWS\system32\DRIVERS\aic78xx.sys

2011/06/03 21:10:18.0561 3088 AliIde (1140ab9938809700b46bb88e46d72a96)

C:\WINDOWS\system32\DRIVERS\aliide.sys

2011/06/03 21:10:18.0796 3088 alim1541 (cb08aed0de2dd889a8a820cd8082d83c)

C:\WINDOWS\system32\DRIVERS\alim1541.sys

2011/06/03 21:10:19.0030 3088 amdagp (95b4fb835e28aa1336ceeb07fd5b9398)

C:\WINDOWS\system32\DRIVERS\amdagp.sys

2011/06/03 21:10:19.0155 3088 amsint (79f5add8d24bd6893f2903a3e2f3fad6)

C:\WINDOWS\system32\DRIVERS\amsint.sys

2011/06/03 21:10:19.0296 3088 ApfiltrService (aeb775a2bae0f392ba6adc0bb706233a)

C:\WINDOWS\system32\DRIVERS\Apfiltr.sys

2011/06/03 21:10:19.0483 3088 APPDRV (ec94e05b76d033b74394e7b2175103cf)

C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS

2011/06/03 21:10:19.0624 3088 Arp1394 (b5b8a80875c1dededa8b02765642c32f)

C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/06/03 21:10:19.0765 3088 asc (62d318e9a0c8fc9b780008e724283707)

C:\WINDOWS\system32\DRIVERS\asc.sys

2011/06/03 21:10:19.0936 3088 asc3350p (69eb0cc7714b32896ccbfd5edcbea447)

C:\WINDOWS\system32\DRIVERS\asc3350p.sys

2011/06/03 21:10:20.0140 3088 asc3550 (5d8de112aa0254b907861e9e9c31d597)

C:\WINDOWS\system32\DRIVERS\asc3550.sys

2011/06/03 21:10:20.0311 3088 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc)

C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/06/03 21:10:20.0421 3088 atapi (9f3a2f5aa6875c72bf062c712cfa2674)

C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/06/03 21:10:20.0624 3088 ati2mtag (5b75176663f88e90f14a87e57b8562a4)

C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/06/03 21:10:20.0749 3088 Atmarpc (9916c1225104ba14794209cfa8012159)

C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/06/03 21:10:20.0858 3088 audstub (d9f724aa26c010a217c97606b160ed68)

C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/06/03 21:10:21.0124 3088 BANTExt (5d7be7b19e827125e016325334e58ff1)

C:\WINDOWS\System32\Drivers\BANTExt.sys

2011/06/03 21:10:21.0280 3088 bcm4sbxp

(78123f44be9e4768852a3a017e02d637) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys

2011/06/03 21:10:21.0405 3088 Beep (da1f27d85e0d1525f6621372e7b685e9)

C:\WINDOWS\system32\drivers\Beep.sys

2011/06/03 21:10:21.0749 3088 BHDrvx86 (925a191c8c06124426c63ceb2ea93085)

C:\Documents and Settings\All Users\Application

Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDef

s\20110430.001\BHDrvx86.sys

2011/06/03 21:10:22.0030 3088 cbidf (90a673fc8e12a79afbed2576f6a7aaf9)

C:\WINDOWS\system32\DRIVERS\cbidf2k.sys

2011/06/03 21:10:22.0124 3088 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9)

C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/06/03 21:10:22.0249 3088 CCDECODE

(0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/06/03 21:10:22.0421 3088 cd20xrnt (f3ec03299634490e97bbce94cd2954c7)

C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys

2011/06/03 21:10:22.0515 3088 Cdaudio (c1b486a7658353d33a10cc15211a873b)

C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/06/03 21:10:22.0608 3088 Cdfs (c885b02847f5d2fd45a24e219ed93b32)

C:\WINDOWS\system32\drivers\Cdfs.sys

2011/06/03 21:10:22.0765 3088 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc)

C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/06/03 21:10:23.0061 3088 CmBatt (0f6c187d38d98f8df904589a5f94d411)

C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/06/03 21:10:23.0186 3088 CmdIde (e5dcb56c533014ecbc556a8357c929d5)

C:\WINDOWS\system32\DRIVERS\cmdide.sys

2011/06/03 21:10:23.0280 3088 Compbatt (6e4c9f21f0fae8940661144f41b13203)

C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/06/03 21:10:23.0468 3088 Cpqarray (3ee529119eed34cd212a215e8c40d4b6)

C:\WINDOWS\system32\DRIVERS\cpqarray.sys

2011/06/03 21:10:23.0593 3088 dac2w2k (e550e7418984b65a78299d248f0a7f36)

C:\WINDOWS\system32\DRIVERS\dac2w2k.sys

2011/06/03 21:10:23.0671 3088 dac960nt (683789caa3864eb46125ae86ff677d34)

C:\WINDOWS\system32\DRIVERS\dac960nt.sys

2011/06/03 21:10:23.0858 3088 dfmirage (d8cd6a2a94f545858eec6117f0d5dff4)

C:\WINDOWS\system32\DRIVERS\dfmirage.sys

2011/06/03 21:10:24.0061 3088 Disk (044452051f3e02e7963599fc8f4f3e25)

C:\WINDOWS\system32\DRIVERS\disk.sys

2011/06/03 21:10:24.0265 3088 dmboot (d992fe1274bde0f84ad826acae022a41)

C:\WINDOWS\system32\drivers\dmboot.sys

2011/06/03 21:10:24.0436 3088 dmio (7c824cf7bbde77d95c08005717a95f6f)

C:\WINDOWS\system32\drivers\dmio.sys

2011/06/03 21:10:24.0546 3088 dmload (e9317282a63ca4d188c0df5e09c6ac5f)

C:\WINDOWS\system32\drivers\dmload.sys

2011/06/03 21:10:24.0655 3088 DMusic (8a208dfcf89792a484e76c40e5f50b45)

C:\WINDOWS\system32\drivers\DMusic.sys

2011/06/03 21:10:24.0765 3088 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660)

C:\WINDOWS\system32\DRIVERS\dpti2o.sys

2011/06/03 21:10:24.0999 3088 drmkaud (8f5fcff8e8848afac920905fbd9d33c8)

C:\WINDOWS\system32\drivers\drmkaud.sys

2011/06/03 21:10:25.0124 3088 drvmcdb (e814854e6b246ccf498874839ab64d77)

C:\WINDOWS\system32\drivers\drvmcdb.sys

2011/06/03 21:10:25.0202 3088 drvnddm (ee83a4ebae70bc93cf14879d062f548b)

C:\WINDOWS\system32\drivers\drvnddm.sys

2011/06/03 21:10:25.0311 3088 E100B (3fca03cbca11269f973b70fa483c88ef)

C:\WINDOWS\system32\DRIVERS\e100b325.sys

2011/06/03 21:10:25.0546 3088 eeCtrl (5461f01b7def17dc90d90b029f874c3b)

C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys

2011/06/03 21:10:25.0686 3088 epmntdrv (57cc1bf06c159dfbb989f5783c0e6a50)

C:\WINDOWS\system32\epmntdrv.sys

2011/06/03 21:10:25.0749 3088 EraserUtilRebootDrv

(17fcc372d03ba39f3aee85198c0ec594) C:\Program Files\Common Files\Symantec

Shared\EENGINE\EraserUtilRebootDrv.sys

2011/06/03 21:10:25.0858 3088 EuGdiDrv (5f779f5edab787f2d090c71a9051f365)

C:\WINDOWS\system32\EuGdiDrv.sys

2011/06/03 21:10:26.0061 3088 Fastfat (38d332a6d56af32635675f132548343e)

C:\WINDOWS\system32\drivers\Fastfat.sys

2011/06/03 21:10:26.0171 3088 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81)

C:\WINDOWS\system32\DRIVERS\fdc.sys

2011/06/03 21:10:26.0265 3088 Fips (d45926117eb9fa946a6af572fbe1caa3)

C:\WINDOWS\system32\drivers\Fips.sys

2011/06/03 21:10:26.0436 3088 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0)

C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2011/06/03 21:10:26.0577 3088 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0)

C:\WINDOWS\system32\drivers\fltmgr.sys

2011/06/03 21:10:26.0718 3088 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a)

C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/06/03 21:10:26.0843 3088 FTDIBUS (7c17235845d5ae3fb33ead47b5881521)

C:\WINDOWS\system32\drivers\ftdibus.sys

2011/06/03 21:10:27.0015 3088 Ftdisk (6ac26732762483366c3969c9e4d2259d)

C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/06/03 21:10:27.0140 3088 FTSER2K (23220a4709cc5785f9633ba71416145c)

C:\WINDOWS\system32\drivers\ftser2k.sys

2011/06/03 21:10:27.0280 3088 Gpc (0a02c63c8b144bd8c86b103dee7c86a2)

C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/06/03 21:10:27.0452 3088 HidUsb (ccf82c5ec8a7326c3066de870c06daf1)

C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/06/03 21:10:27.0577 3088 hpn (b028377dea0546a5fcfba928a8aefae0)

C:\WINDOWS\system32\DRIVERS\hpn.sys

2011/06/03 21:10:27.0686 3088 HSFHWICH

(140ba850417896b6b3322048de280368) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys

2011/06/03 21:10:27.0874 3088 HSF_DP (b2dfc168d6f7512faea085253c5a37ad)

C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

2011/06/03 21:10:28.0061 3088 HTTP (f80a415ef82cd06ffaf0d971528ead38)

C:\WINDOWS\system32\Drivers\HTTP.sys

2011/06/03 21:10:28.0202 3088 i2omgmt (9368670bd426ebea5e8b18a62416ec28)

C:\WINDOWS\system32\drivers\i2omgmt.sys

2011/06/03 21:10:28.0311 3088 i2omp (f10863bf1ccc290babd1a09188ae49e0)

C:\WINDOWS\system32\DRIVERS\i2omp.sys

2011/06/03 21:10:28.0499 3088 i8042prt (4a0b06aa8943c1e332520f7440c0aa30)

C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/06/03 21:10:28.0874 3088 IDSxpx86 (50fa4c70534cf3b5c17ec83debe07afd)

C:\Documents and Settings\All Users\Application

Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\

20110513.001\IDSxpx86.sys

2011/06/03 21:10:29.0108 3088 Imapi (083a052659f5310dd8b6a6cb05edcf8e)

C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/06/03 21:10:29.0249 3088 ini910u (4a40e045faee58631fd8d91afc620719)

C:\WINDOWS\system32\DRIVERS\ini910u.sys

2011/06/03 21:10:29.0452 3088 IntelIde (b5466a9250342a7aa0cd1fba13420678)

C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/06/03 21:10:29.0624 3088 intelppm (8c953733d8f36eb2133f5bb58808b66b)

C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/06/03 21:10:29.0718 3088 Ip6Fw (3bb22519a194418d5fec05d800a19ad0)

C:\WINDOWS\system32\drivers\ip6fw.sys

2011/06/03 21:10:29.0843 3088 IpFilterDriver (731f22ba402ee4b62748adaf6363c182)

C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/06/03 21:10:30.0061 3088 IpInIp (b87ab476dcf76e72010632b5550955f5)

C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/06/03 21:10:30.0202 3088 IpNat (cc748ea12c6effde940ee98098bf96bb)

C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/06/03 21:10:30.0390 3088 IPSec (23c74d75e36e7158768dd63d92789a91)

C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/06/03 21:10:30.0483 3088 IRENUM (c93c9ff7b04d772627a3646d89f7bf89)

C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/06/03 21:10:30.0624 3088 isapnp (05a299ec56e52649b1cf2fc52d20f2d7)

C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/06/03 21:10:30.0780 3088 IWCA (872d090ca5c306f62d1982bce6302376)

C:\WINDOWS\system32\DRIVERS\iwca.sys

2011/06/03 21:10:30.0905 3088 Kbdclass (463c1ec80cd17420a542b7f36a36f128)

C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/06/03 21:10:31.0093 3088 kbdhid (9ef487a186dea361aa06913a75b3fa99)

C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/06/03 21:10:31.0186 3088 kmixer (692bcf44383d056aed41b045a323d378)

C:\WINDOWS\system32\drivers\kmixer.sys

2011/06/03 21:10:31.0327 3088 KSecDD (b467646c54cc746128904e1654c750c1)

C:\WINDOWS\system32\drivers\KSecDD.sys

2011/06/03 21:10:31.0624 3088 mdmxsdk

(3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

2011/06/03 21:10:31.0749 3088 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6)

C:\WINDOWS\system32\drivers\mnmdd.sys

2011/06/03 21:10:31.0874 3088 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1)

C:\WINDOWS\system32\drivers\Modem.sys

2011/06/03 21:10:32.0077 3088 Mouclass (35c9e97194c8cfb8430125f8dbc34d04)

C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/06/03 21:10:32.0202 3088 mouhid (b1c303e17fb9d46e87a98e4ba6769685)

C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/06/03 21:10:32.0311 3088 MountMgr

(a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/06/03 21:10:32.0483 3088 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737)

C:\WINDOWS\system32\DRIVERS\mraid35x.sys

2011/06/03 21:10:32.0593 3088 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd)

C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/06/03 21:10:32.0718 3088 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca)

C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/06/03 21:10:32.0858 3088 Msfs (c941ea2454ba8350021d774daf0f1027)

C:\WINDOWS\system32\drivers\Msfs.sys

2011/06/03 21:10:33.0077 3088 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1)

C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/06/03 21:10:33.0218 3088 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e)

C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/06/03 21:10:33.0405 3088 MSPQM

(bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/06/03 21:10:33.0546 3088 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136)

C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/06/03 21:10:33.0686 3088 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d)

C:\WINDOWS\system32\drivers\MSTEE.sys

2011/06/03 21:10:33.0858 3088 Mup (2f625d11385b1a94360bfc70aaefdee1)

C:\WINDOWS\system32\drivers\Mup.sys

2011/06/03 21:10:34.0140 3088 NABTSFEC

(5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/06/03 21:10:34.0390 3088 NAVENG (c34e2a884ccca8b5567d0c2752527073)

C:\Documents and Settings\All Users\Application

Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDef

s\20110516.002\NAVENG.SYS

2011/06/03 21:10:34.0515 3088 NAVEX15 (b3916eeec738dd4178f4fd6a44a32e36)

C:\Documents and Settings\All Users\Application

Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDef

s\20110516.002\NAVEX15.SYS

2011/06/03 21:10:34.0671 3088 NDIS (1df7f42665c94b825322fae71721130d)

C:\WINDOWS\system32\drivers\NDIS.sys

2011/06/03 21:10:34.0780 3088 NdisIP (7ff1f1fd8609c149aa432f95a8163d97)

C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/06/03 21:10:34.0936 3088 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f)

C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/06/03 21:10:35.0061 3088 Ndisuio (f927a4434c5028758a842943ef1a3849)

C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/06/03 21:10:35.0202 3088 NdisWan (edc1531a49c80614b2cfda43ca8659ab)

C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/06/03 21:10:35.0327 3088 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b)

C:\WINDOWS\system32\drivers\NDProxy.sys

2011/06/03 21:10:35.0483 3088 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0)

C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/06/03 21:10:35.0608 3088 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d)

C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/06/03 21:10:35.0749 3088 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea)

C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/06/03 21:10:35.0890 3088 Nmea (b0d5188e282dc4edae7020f333427bc8)

C:\WINDOWS\system32\DRIVERS\pctnullport.sys

2011/06/03 21:10:36.0265 3088 Npfs (3182d64ae053d6fb034f44b6def8034a)

C:\WINDOWS\system32\drivers\Npfs.sys

2011/06/03 21:10:36.0483 3088 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca)

C:\WINDOWS\system32\drivers\Ntfs.sys

2011/06/03 21:10:36.0624 3088 Null (73c1e1f395918bc2c6dd67af7591a3ad)

C:\WINDOWS\system32\drivers\Null.sys

2011/06/03 21:10:36.0780 3088 nv (2b298519edbfcf451d43e0f1e8f1006d)

C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

2011/06/03 21:10:37.0108 3088 NWADI (0973c0c696780161f4526586d5eac422)

C:\WINDOWS\system32\DRIVERS\NWADIenum.sys

2011/06/03 21:10:37.0218 3088 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57)

C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/06/03 21:10:37.0343 3088 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9)

C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/06/03 21:10:37.0499 3088 ohci1394 (ca33832df41afb202ee7aeb05145922f)

C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/06/03 21:10:37.0608 3088 omci (b17228142cec9b3c222239fd935a37ca)

C:\WINDOWS\system32\DRIVERS\omci.sys

2011/06/03 21:10:37.0733 3088 Parport (5575faf8f97ce5e713d108c2a58d7c7c)

C:\WINDOWS\system32\DRIVERS\parport.sys

2011/06/03 21:10:37.0858 3088 PartMgr (beb3ba25197665d82ec7065b724171c6)

C:\WINDOWS\system32\drivers\PartMgr.sys

2011/06/03 21:10:38.0186 3088 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1)

C:\WINDOWS\system32\drivers\ParVdm.sys

2011/06/03 21:10:38.0311 3088 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8)

C:\WINDOWS\system32\Drivers\PCASp50.sys

2011/06/03 21:10:38.0452 3088 PCI (a219903ccf74233761d92bef471a07b1)

C:\WINDOWS\system32\DRIVERS\pci.sys

2011/06/03 21:10:38.0593 3088 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0)

C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/06/03 21:10:38.0702 3088 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1)

C:\WINDOWS\system32\DRIVERS\pcmcia.sys

2011/06/03 21:10:38.0905 3088 pcouffin (5b6c11de7e839c05248ced8825470fef)

C:\WINDOWS\system32\Drivers\pcouffin.sys

2011/06/03 21:10:39.0140 3088 PCTINDIS5 (1e715247efffdda938c085913045d599)

C:\WINDOWS\system32\PCTINDIS5.SYS

2011/06/03 21:10:39.0593 3088 perc2 (6c14b9c19ba84f73d3a86dba11133101)

C:\WINDOWS\system32\DRIVERS\perc2.sys

2011/06/03 21:10:39.0733 3088 perc2hib (f50f7c27f131afe7beba13e14a3b9416)

C:\WINDOWS\system32\DRIVERS\perc2hib.sys

2011/06/03 21:10:39.0905 3088 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99)

C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/06/03 21:10:40.0077 3088 PSched (09298ec810b07e5d582cb3a3f9255424)

C:\WINDOWS\system32\DRIVERS\psched.sys

2011/06/03 21:10:40.0155 3088 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd)

C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/06/03 21:10:40.0265 3088 PxHelp20 (30cbae0a34359f1cd19d1576245149ed)

C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/06/03 21:10:40.0436 3088 ql1080 (0a63fb54039eb5662433caba3b26dba7)

C:\WINDOWS\system32\DRIVERS\ql1080.sys

2011/06/03 21:10:40.0577 3088 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706)

C:\WINDOWS\system32\DRIVERS\ql10wnt.sys

2011/06/03 21:10:40.0686 3088 ql12160 (156ed0ef20c15114ca097a34a30d8a01)

C:\WINDOWS\system32\DRIVERS\ql12160.sys

2011/06/03 21:10:40.0811 3088 ql1240 (70f016bebde6d29e864c1230a07cc5e6)

C:\WINDOWS\system32\DRIVERS\ql1240.sys

2011/06/03 21:10:40.0936 3088 ql1280 (907f0aeea6bc451011611e732bd31fcf)

C:\WINDOWS\system32\DRIVERS\ql1280.sys

2011/06/03 21:10:41.0046 3088 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c)

C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/06/03 21:10:41.0218 3088 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6)

C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/06/03 21:10:41.0343 3088 RasPppoe (5bc962f2654137c9909c3d4603587dee)

C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/06/03 21:10:41.0436 3088 Raspti (fdbb1d60066fcfbb7452fd8f9829b242)

C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/06/03 21:10:41.0577 3088 Rdbss (7ad224ad1a1437fe28d89cf22b17780a)

C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/06/03 21:10:41.0671 3088 RDPCDD (4912d5b403614ce99c28420f75353332)

C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/06/03 21:10:41.0811 3088 rdpdr (15cabd0f7c00c47c70124907916af3f1)

C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/06/03 21:10:42.0046 3088 RDPWD (6728e45b66f93c08f11de2e316fc70dd)

C:\WINDOWS\system32\drivers\RDPWD.sys

2011/06/03 21:10:42.0155 3088 redbook (f828dd7e1419b6653894a8f97a0094c5)

C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/06/03 21:10:42.0280 3088 RimUsb (0f6756ef8bda6dfa7be50465c83132bb)

C:\WINDOWS\system32\Drivers\RimUsb.sys

2011/06/03 21:10:42.0436 3088 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d)

C:\WINDOWS\system32\DRIVERS\RimSerial.sys

2011/06/03 21:10:42.0561 3088 ROOTMODEM

(d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys

2011/06/03 21:10:42.0733 3088 s24trans (81aa6f0d6a2be1c550f814b036215888)

C:\WINDOWS\system32\DRIVERS\s24trans.sys

2011/06/03 21:10:42.0890 3088 sdbus (8d04819a3ce51b9eb47e5689b44d43c4)

C:\WINDOWS\system32\DRIVERS\sdbus.sys

2011/06/03 21:10:43.0171 3088 Secdrv (90a3935d05b494a5a39d37e71f09a677)

C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/06/03 21:10:43.0327 3088 serenum (0f29512ccd6bead730039fb4bd2c85ce)

C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/06/03 21:10:43.0483 3088 Serial (cca207a8896d4c6a0c9ce29a4ae411a7)

C:\WINDOWS\system32\DRIVERS\serial.sys

2011/06/03 21:10:43.0624 3088 sffdisk (0fa803c64df0914b41f807ea276bf2a6)

C:\WINDOWS\system32\DRIVERS\sffdisk.sys

2011/06/03 21:10:43.0749 3088 sffp_sd (c17c331e435ed8737525c86a7557b3ac)

C:\WINDOWS\system32\DRIVERS\sffp_sd.sys

2011/06/03 21:10:43.0858 3088 Sfloppy (8e6b8c671615d126fdc553d1e2de5562)

C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/06/03 21:10:44.0280 3088 sisagp (6b33d0ebd30db32e27d1d78fe946a754)

C:\WINDOWS\system32\DRIVERS\sisagp.sys

2011/06/03 21:10:44.0436 3088 SLIP (866d538ebe33709a5c9f5c62b73b7d14)

C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/06/03 21:10:44.0655 3088 Sparrow (83c0f71f86d3bdaf915685f3d568b20e)

C:\WINDOWS\system32\DRIVERS\sparrow.sys

2011/06/03 21:10:44.0796 3088 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f)

C:\WINDOWS\system32\drivers\splitter.sys

2011/06/03 21:10:44.0968 3088 sr (76bb022c2fb6902fd5bdd4f78fc13a5d)

C:\WINDOWS\system32\DRIVERS\sr.sys

2011/06/03 21:10:45.0249 3088 SRTSP (83726cf02eced69138948083e06b6eac)

C:\WINDOWS\System32\Drivers\NIS\1206000.01D\SRTSP.SYS

2011/06/03 21:10:45.0421 3088 SRTSPX (4e7eab2e5615d39cf1f1df9c71e5e225)

C:\WINDOWS\system32\drivers\NIS\1206000.01D\SRTSPX.SYS

2011/06/03 21:10:45.0546 3088 Srv (47ddfc2f003f7f9f0592c6874962a2e7)

C:\WINDOWS\system32\DRIVERS\srv.sys

2011/06/03 21:10:45.0640 3088 sscdbhk5 (d7968049be0adbb6a57cee3960320911)

C:\WINDOWS\system32\drivers\sscdbhk5.sys

2011/06/03 21:10:45.0765 3088 ssrtln (c3ffd65abfb6441e7606cf74f1155273)

C:\WINDOWS\system32\drivers\ssrtln.sys

2011/06/03 21:10:45.0983 3088 STAC97 (305cc42945a713347f978d78566113f3)

C:\WINDOWS\system32\drivers\STAC97.sys

2011/06/03 21:10:46.0140 3088 streamip (77813007ba6265c4b6098187e6ed79d2)

C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/06/03 21:10:46.0265 3088 swenum (3941d127aef12e93addf6fe6ee027e0f)

C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/06/03 21:10:46.0468 3088 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01)

C:\WINDOWS\system32\drivers\swmidi.sys

2011/06/03 21:10:46.0593 3088 swmsflt (eda7336cd2e334b4db321bc60b7da11e)

C:\WINDOWS\System32\drivers\swmsflt.sys

2011/06/03 21:10:46.0780 3088 symc810 (1ff3217614018630d0a6758630fc698c)

C:\WINDOWS\system32\DRIVERS\symc810.sys

2011/06/03 21:10:46.0874 3088 symc8xx (070e001d95cf725186ef8b20335f933c)

C:\WINDOWS\system32\DRIVERS\symc8xx.sys

2011/06/03 21:10:47.0140 3088 SymDS (9bbeb8c6258e72d62e7560e6667aad39)

C:\WINDOWS\system32\drivers\NIS\1206000.01D\SYMDS.SYS

2011/06/03 21:10:47.0296 3088 SymEFA (d5c02629c02a820a7e71bca3d44294a3)

C:\WINDOWS\system32\drivers\NIS\1206000.01D\SYMEFA.SYS

2011/06/03 21:10:47.0530 3088 SymEvent (ab33c3b196197ca467cbdda717860dba)

C:\WINDOWS\system32\Drivers\SYMEVENT.SYS

2011/06/03 21:10:47.0858 3088 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f)

C:\WINDOWS\system32\drivers\NIS\1206000.01D\Ironx86.SYS

2011/06/03 21:10:48.0124 3088 SYMTDI (dec35ccaf7a222df918306cd2fdfbd39)

C:\WINDOWS\System32\Drivers\NIS\1206000.01D\SYMTDI.SYS

2011/06/03 21:10:48.0280 3088 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c)

C:\WINDOWS\system32\DRIVERS\sym_hi.sys

2011/06/03 21:10:48.0421 3088 sym_u3 (bf4fab949a382a8e105f46ebb4937058)

C:\WINDOWS\system32\DRIVERS\sym_u3.sys

2011/06/03 21:10:48.0546 3088 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290)

C:\WINDOWS\system32\drivers\sysaudio.sys

2011/06/03 21:10:48.0686 3088 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d)

C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/06/03 21:10:48.0827 3088 tcpipBM (dcfeb82ca988598ceb8f83148616038e)

C:\WINDOWS\system32\drivers\tcpipBM.sys

2011/06/03 21:10:49.0202 3088 TDPIPE (6471a66807f5e104e4885f5b67349397)

C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/06/03 21:10:49.0327 3088 TDTCP (c56b6d0402371cf3700eb322ef3aaf61)

C:\WINDOWS\system32\drivers\TDTCP.sys

2011/06/03 21:10:49.0468 3088 TermDD

(88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/06/03 21:10:49.0874 3088 tfsnboio (30698355067d07da5f9eb81132c9fdd6)

C:\WINDOWS\system32\dla\tfsnboio.sys

2011/06/03 21:10:50.0390 3088 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b)

C:\WINDOWS\system32\dla\tfsncofs.sys

2011/06/03 21:10:50.0874 3088 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33)

C:\WINDOWS\system32\dla\tfsndrct.sys

2011/06/03 21:10:51.0233 3088 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485)

C:\WINDOWS\system32\dla\tfsndres.sys

2011/06/03 21:10:51.0468 3088 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad)

C:\WINDOWS\system32\dla\tfsnifs.sys

2011/06/03 21:10:51.0561 3088 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c)

C:\WINDOWS\system32\dla\tfsnopio.sys

2011/06/03 21:10:51.0640 3088 tfsnpool (bba22094f0f7c210567efdaf11f64495)

C:\WINDOWS\system32\dla\tfsnpool.sys

2011/06/03 21:10:51.0733 3088 tfsnudf (81340bef80b9811e98ce64611e67e3ff)

C:\WINDOWS\system32\dla\tfsnudf.sys

2011/06/03 21:10:51.0858 3088 tfsnudfa (c035fd116224ccc8325f384776b6a8bb)

C:\WINDOWS\system32\dla\tfsnudfa.sys

2011/06/03 21:10:52.0171 3088 TosIde (f2790f6af01321b172aa62f8e1e187d9)

C:\WINDOWS\system32\DRIVERS\toside.sys

2011/06/03 21:10:52.0327 3088 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9)

C:\WINDOWS\system32\drivers\Udfs.sys

2011/06/03 21:10:52.0436 3088 ultra (1b698a51cd528d8da4ffaed66dfc51b9)

C:\WINDOWS\system32\DRIVERS\ultra.sys

2011/06/03 21:10:52.0608 3088 Update (402ddc88356b1bac0ee3dd1580c76a31)

C:\WINDOWS\system32\DRIVERS\update.sys

2011/06/03 21:10:52.0780 3088 usbaudio (e919708db44ed8543a7c017953148330)

C:\WINDOWS\system32\drivers\usbaudio.sys

2011/06/03 21:10:52.0921 3088 usbccgp (173f317ce0db8e21322e71b7e60a27e8)

C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/06/03 21:10:53.0093 3088 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7)

C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/06/03 21:10:53.0186 3088 usbhub (1ab3cdde553b6e064d2e754efe20285c)

C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/06/03 21:10:53.0296 3088 usbprint (a717c8721046828520c9edf31288fc00)

C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/06/03 21:10:53.0468 3088 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4)

C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/06/03 21:10:53.0593 3088 USBSTOR

(a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/06/03 21:10:53.0733 3088 usbuhci (26496f9dee2d787fc3e61ad54821ffe6)

C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/06/03 21:10:53.0811 3088 VgaSave (0d3a8fafceacd8b7625cd549757a7df1)

C:\WINDOWS\System32\drivers\vga.sys

2011/06/03 21:10:53.0952 3088 viaagp (754292ce5848b3738281b4f3607eaef4)

C:\WINDOWS\system32\DRIVERS\viaagp.sys

2011/06/03 21:10:54.0280 3088 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e)

C:\WINDOWS\system32\DRIVERS\viaide.sys

2011/06/03 21:10:54.0452 3088 VolSnap (4c8fcb5cc53aab716d810740fe59d025)

C:\WINDOWS\system32\drivers\VolSnap.sys

2011/06/03 21:10:54.0749 3088 w29n51 (f0f902220910c4fbe42a51964bd33599)

C:\WINDOWS\system32\DRIVERS\w29n51.sys

2011/06/03 21:10:54.0983 3088 Wanarp (e20b95baedb550f32dd489265c1da1f6)

C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/06/03 21:10:55.0249 3088 wceusbsh (dc7f91b2ed24a738c807ea07f298928c)

C:\WINDOWS\system32\DRIVERS\wceusbsh.sys

2011/06/03 21:10:55.0421 3088 Wdf01000

(d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys

2011/06/03 21:10:55.0640 3088 wdmaud (6768acf64b18196494413695f0c3a00f)

C:\WINDOWS\system32\drivers\wdmaud.sys

2011/06/03 21:10:55.0843 3088 winachsf (2dc7c0b6175a0a8ed84a4f70199c93b5)

C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

2011/06/03 21:10:56.0061 3088 WpdUsb (cf4def1bf66f06964dc0d91844239104)

C:\WINDOWS\system32\DRIVERS\wpdusb.sys

2011/06/03 21:10:56.0140 3088 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8)

C:\WINDOWS\System32\drivers\ws2ifsl.sys

2011/06/03 21:10:56.0265 3088 WSTCODEC

(c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/06/03 21:10:56.0436 3088 WudfPf (f15feafffbb3644ccc80c5da584e6311)

C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/06/03 21:10:56.0640 3088 MBR (0x1B8)

(26a7678d74601d9e9e1d0fdca657d315) \Device\Harddisk0\DR0

2011/06/03 21:10:56.0640 3088

============================================================================

====

2011/06/03 21:10:56.0640 3088 Scan finished

2011/06/03 21:10:56.0640 3088

============================================================================

====

2011/06/03 21:10:56.0655 3992 Detected object count: 0

2011/06/03 21:10:56.0655 3992 Actual detected object count: 0

LDTate · June 4, 2011

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

dngrwill · June 4, 2011

I ran it and got the 'blue screen of death' - I have it paused on the machine if you want any info

Thanks Greatly

Will

LDTate · June 4, 2011

Lets try a different scanner.

Download Dr.Web CureIt to the desktop:

Doubleclick the drweb-cureit icon to start the program.
press start
Allow the program to run the initial express scan
This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
Once the scan is complete, the results will be displayed
on the menu bar, click file and choose report list.
Save the report to your desktop. The report will be called DrWeb.csv
Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
Close Dr.Web Cureit.
Please post the Dr.Web.txt report in your next reply

Reboot the computer in Normal Mode,

Post the Cure-it report

dngrwill · June 5, 2011

I ran the express scan of dr.web and it found two things - one EICAR which is a test file and may be a virus (the language is unclear) and that the "hosts" file had been modified and did I want to replace it (with and older version). The dr web just reported the EICAR file and not the change in the hosts file. I am now running the full scan.

LDTate · June 5, 2011

OK. Let me know how it's running after that.

dngrwill · June 6, 2011

Ok - well at least I got something with the full scan. The report is one line:

VikPev00;C:\ComboFix;Probably MACRO.SCRIPT.Virus;;

I hit 'cure' for this. What now?

Thanks!

Will

LDTate · June 6, 2011

Try combofix again

dngrwill · June 7, 2011

ok - here is the combofix log:

ComboFix 11-06-04.02 - Dan 06/06/2011 17:45:31.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1373 [GMT -4:00]

Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Dan\Application Data\inst.exe

c:\documents and settings\Dan\WINDOWS

c:\windows\system32\Device.dll

.

((((((((((((((((((((((((( Files Created from 2011-05-06 to 2011-06-06 )))))))))))))))))))))))))))))))

.

2011-06-05 02:01 . 2011-06-05 03:05 -------- d-----w- c:\documents and settings\Dan\DoctorWeb

2011-05-16 18:14 . 2002-06-20 04:00 22528 ----a-w- c:\windows\system32\esccmd.dll

2011-05-16 18:14 . 2002-06-17 04:00 86016 ----a-w- c:\windows\system32\Epfb5cpl.dll

2011-05-16 18:14 . 2002-02-08 04:00 47104 ----a-w- c:\windows\system32\escimgn.dll

2011-05-16 18:14 . 2002-02-08 04:00 23552 ----a-w- c:\windows\system32\esccmn.dll

2011-05-16 18:14 . 2001-11-15 04:00 47104 ----a-w- c:\windows\system32\escimgd.dll

2011-05-16 18:14 . 2001-11-15 04:00 33280 ----a-w- c:\windows\system32\esccm.dll

2011-05-16 18:14 . 2001-11-15 04:00 27648 ----a-w- c:\windows\system32\escimg.dll

2011-05-16 18:03 . 2006-12-28 04:00 66048 ----a-w- c:\windows\system32\escwian.dll

2011-05-16 18:03 . 2006-10-13 04:00 61952 ----a-w- c:\windows\system32\escwiad.dll

2011-05-16 18:03 . 2006-10-13 04:00 44544 ----a-w- c:\windows\system32\escwiab.dll

2011-05-16 18:03 . 2006-03-10 04:00 3584 ----a-w- c:\windows\system32\eswiaml.dll

2011-05-16 18:03 . 2002-09-04 04:00 90112 ----a-w- c:\windows\system32\epcomdd.dll

2011-05-16 18:03 . 2002-08-09 04:00 184320 ----a-w- c:\windows\system32\ESDTR.dll

2011-05-16 18:03 . 2002-01-31 04:00 126976 ----a-w- c:\windows\system32\Esint23.dll

2011-05-16 18:03 . 2001-05-21 04:00 77824 ----a-w- c:\windows\system32\Esintpl.dll

2011-05-16 18:03 . 2000-10-11 04:00 53248 ----a-w- c:\windows\system32\ESICM.dll

2011-05-16 18:03 . 2011-05-16 18:03 -------- d-----w- c:\documents and settings\Dan\Application Data\InstallShield

2011-05-16 18:03 . 2011-05-16 18:13 -------- d-----w- C:\EPSON

2011-05-09 23:31 . 2011-05-16 18:17 -------- d-----w- c:\windows\system32\drivers\NIS\1206000.01D

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-16 21:55 . 2005-10-29 14:46 89680 ----a-w- c:\documents and settings\Dan\MSSSerif120.fon

2011-05-09 23:31 . 2009-06-26 16:07 60872 ----a-w- c:\windows\system32\S32EVNT1.DLL

2011-05-09 23:31 . 2009-06-26 16:07 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-04 344064]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-06-29 1032192]

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]

"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-25 98304]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]

"Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2009-05-26 75008]

"RDVCHG"="c:\program files\Sprint\Sprint SmartView\RDVCHG.exe" [2009-05-26 316672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

.

c:\documents and settings\Dan\Start Menu\Programs\Startup\

Skyscape smARTupdate.lnk - c:\program files\Common Files\Skyscape\smARTupdate.exe [N/A]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 21:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\kav\\kis\\setup.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\SurfOffline Professional 2\\SO_PRO.exe"=

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1206000.01D\symds.sys [5/9/2011 7:31 PM 340088]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1206000.01D\symefa.sys [5/9/2011 7:31 PM 744568]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx86.sys [6/3/2011 9:19 PM 802936]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1206000.01D\ironx86.sys [5/9/2011 7:31 PM 136312]

R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe [5/9/2011 7:31 PM 130008]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [3/28/2009 7:08 PM 31896]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/16/2011 2:07 PM 105592]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110602.001\IDSXpx86.sys [6/3/2011 9:19 PM 341944]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/11/2010 10:17 AM 135664]

S3 camfilt2;camfilt2;c:\windows\system32\DRIVERS\camfilt2.sys --> c:\windows\system32\DRIVERS\camfilt2.sys [?]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [12/20/2008 1:31 AM 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [12/20/2008 1:31 AM 3072]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/11/2010 10:17 AM 135664]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - Dwsh00003884

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 14:16]

.

2011-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 14:16]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://my.yahoo.com/index.html

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

LSP: bmnet.dll

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\ki7vo4p3.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Symantec IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn

FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn

FF - user.js: yahoo.homepage.dontask - true

.

------- File Associations -------

.

.txt=

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-FolderShare - c:\program files\FolderShare\FolderShare.exe

HKCU-Run-Aim6 - (no file)

HKLM-Run-PCMService - c:\program files\Dell\Media Experience\PCMService.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-06 18:07

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-464747121-3793588185-1884838649-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F1B9C69C-2A13-6353-80C1-54C1A7F71D2B}*]

@Allowed: (Read) (RestrictedCode)

"gapeenijhkojpj"=hex:61,69,65,66,6c,6c,6d,6d,61,68,67,69,63,67,68,65,6c,70,61,

61,61,65,6b,66,68,67,6f,6b,61,65,6c,70,64,63,69,6a,68,6c,6f,67,64,6d,69,6b,\

.

[HKEY_LOCAL_MACHINE\software\Classes\.cs\PersistentHandler]

@DACL=(02 0000)

@="{5e941d80-bf96-11cd-b579-08002b30bfeb}"

.

[HKEY_LOCAL_MACHINE\software\Classes\.shtm\PersistentHandler]

@DACL=(02 0000)

@="{eec97550-47a9-11cf-b952-00aa0051fe20}"

.

[HKEY_LOCAL_MACHINE\software\Classes\.xslt\PersistentHandler]

@DACL=(02 0000)

@="{7E9D8D44-6926-426F-AA2B-217A819A5CCE}"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]

"Licence0"="REMOVED"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(964)

c:\windows\system32\Ati2evxx.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

.

- - - - - - - > 'lsass.exe'(1020)

c:\windows\system32\bmnet.dll

.

Completion time: 2011-06-06 18:13:50

ComboFix-quarantined-files.txt 2011-06-06 22:13

.

Pre-Run: 5,157,482,496 bytes free

Post-Run: 5,803,466,752 bytes free

.

- - End Of File - - A6A7BD937562C31C80046F508CBAE07D

LDTate · June 7, 2011

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

FireFox::
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\ki7vo4p3.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

dngrwill · June 7, 2011

The first time I ran it I got some error message from MS (some program had crashed) but was unable to capture it - the app continued,however, until I got to this : "Error opening file for writing: C:\bunch of numbers\License\explore.exe"

If I select "ignore" it ran for a while then was stopped by "Cannot export RegRuns00: Error opening the file. There may be a disk or file system error" - if I ignore that then Combofix finishes. The log starts below:

ComboFix 11-06-04.02 - Dan 06/07/2011 16:31:32.3.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1365 [GMT -4:00]

Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((( Files Created from 2011-05-07 to 2011-06-07 )))))))))))))))))))))))))))))))

.

2011-06-07 20:41 . 2011-06-07 20:41 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS

2011-06-07 20:41 . 2011-06-07 20:41 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS

2011-06-07 20:41 . 2011-06-07 20:41 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS

2011-06-07 20:41 . 2011-06-07 20:41 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS

2011-06-07 20:41 . 2011-06-07 20:41 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS

2011-06-07 20:41 . 2011-06-07 20:41 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS

2011-06-07 20:41 . 2011-06-07 20:41 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS

2011-06-07 20:41 . 2011-06-07 20:41 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS

2011-06-07 20:41 . 2011-06-07 20:41 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS

2011-06-07 20:41 . 2011-06-07 20:41 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS

2011-06-07 20:41 . 2011-06-07 20:41 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS

2011-06-07 20:41 . 2011-06-07 20:41 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS

2011-06-07 20:40 . 2011-06-07 20:40 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS

2011-06-07 20:40 . 2011-06-07 20:40 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS

2011-06-07 20:40 . 2011-06-07 20:40 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS

2011-06-07 20:40 . 2011-06-07 20:40 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS

2011-06-07 20:40 . 2011-06-07 20:40 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS

2011-06-07 20:23 . 2011-06-07 20:29 -------- d-----w- C:\32788R22FWJFW