Infected with Antivirus Plus

BarbW · July 7, 2011

My pc recently got infected with Antivirus Plus. I found some instructions for using Malwarebytes Pro to remove it, but that didn't work as a Malwarebytes scan didn't find anything. I am still getting annoying popups asking me to purchase Antivirus Plus, the whole PC is running really slowly and strange things are coming up in Firefox when visiting pages.

Logs attached as per your instructions.

Any help would be much appreciated.

ark.zip

Attach.zip

DDS.txt

mbam-log-2011-07-06 (19-16-37).txt

D-FRED-BROWN · July 10, 2011

Hello BarbW and welcome to Malwarebytes! :welcome:

I am D-FRED-BROWN and I will be helping you.

Please print or save this topic: it will make it easier for you to follow the instructions and complete all of the necessary steps.

**For future reference, please post the logs rather than attaching them- it makes it easier for me to read them this way

-------------

Please download to your Desktop:

TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

Click on the Start Scan button and wait for the scan and disinfection process to be over.
If an infected file is detected, the default action will be Cure, click on Continue
If a suspicious file is detected, the default action will be Skip, click on Continue
If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.

In your next reply, please include the following (you may need to use two posts to get it all in):

TDSSKiller_log.txt

how the PC is running now?
-------------
Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
***IMPORTANT: save ComboFix to your Desktop***
* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Please go here to see a list of programs that should be disabled.
**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**
Please include the C:\ComboFix.txt in your next reply for further review.
Also, please let me know if any problems still remain.
-------------
Please download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-------------

In your next reply, please include:

C:\ComboFix.txt
TDSSKiller log
Security Check checkup.txt

How is your computer running now?

BarbW · July 11, 2011

Hi D-FRED-BROWN,

Thanks for your response. I just wanted to mention, that since posting Vista came up with a message saying it had blocked some programs, though I couldn't tell what they were. After this the Antivirus Plus popups stopped and the PC is running as it should. I don't know if this means vista has taken care of anything. I have followed you instructions and the log files follow. Tdskiller didn't find anything, but I have run this before, following some instructions I found elsewhere on the internet, but I'll post the log anyway.

TDSkiller

2011/07/11 17:08:41.0613 5732 TDSS rootkit removing tool 2.5.9.0 Jul 1 2011 18:45:21

2011/07/11 17:08:42.0392 5732 ================================================================================

2011/07/11 17:08:42.0392 5732 SystemInfo:

2011/07/11 17:08:42.0392 5732

2011/07/11 17:08:42.0392 5732 OS Version: 6.0.6002 ServicePack: 2.0

2011/07/11 17:08:42.0392 5732 Product type: Workstation

2011/07/11 17:08:42.0392 5732 ComputerName: DELL

2011/07/11 17:08:42.0392 5732 UserName: Gary

2011/07/11 17:08:42.0392 5732 Windows directory: C:\Windows

2011/07/11 17:08:42.0392 5732 System windows directory: C:\Windows

2011/07/11 17:08:42.0393 5732 Processor architecture: Intel x86

2011/07/11 17:08:42.0393 5732 Number of processors: 2

2011/07/11 17:08:42.0393 5732 Page size: 0x1000

2011/07/11 17:08:42.0393 5732 Boot type: Normal boot

2011/07/11 17:08:42.0393 5732 ================================================================================

2011/07/11 17:08:45.0042 5732 Initialize success

2011/07/11 17:08:52.0837 5220 ================================================================================

2011/07/11 17:08:52.0837 5220 Scan started

2011/07/11 17:08:52.0837 5220 Mode: Manual;

2011/07/11 17:08:52.0837 5220 ================================================================================

2011/07/11 17:08:54.0138 5220 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2011/07/11 17:08:54.0421 5220 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2011/07/11 17:08:54.0728 5220 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2011/07/11 17:08:55.0040 5220 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2011/07/11 17:08:55.0215 5220 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2011/07/11 17:08:55.0326 5220 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

2011/07/11 17:08:55.0477 5220 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

2011/07/11 17:08:55.0531 5220 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2011/07/11 17:08:55.0622 5220 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

2011/07/11 17:08:55.0823 5220 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2011/07/11 17:08:56.0042 5220 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

2011/07/11 17:08:56.0231 5220 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2011/07/11 17:08:56.0293 5220 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

2011/07/11 17:08:56.0587 5220 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2011/07/11 17:08:56.0805 5220 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2011/07/11 17:08:57.0033 5220 ASPI (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys

2011/07/11 17:08:57.0183 5220 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/07/11 17:08:57.0254 5220 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2011/07/11 17:08:57.0628 5220 atikmdag (7db96c2801a78513bdc133c25d07929e) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/07/11 17:08:57.0986 5220 AtiPcie (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys

2011/07/11 17:08:58.0164 5220 bckd (7cfd6d37aba7006148abbf4f629b2d2a) C:\Windows\system32\drivers\bckd.sys

2011/07/11 17:08:58.0365 5220 BCM43XV (abd543e555bc0453bf52664936df4dcd) C:\Windows\system32\DRIVERS\bcmwl6.sys

2011/07/11 17:08:58.0439 5220 BCM43XX (abd543e555bc0453bf52664936df4dcd) C:\Windows\system32\DRIVERS\bcmwl6.sys

2011/07/11 17:08:58.0651 5220 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\Windows\system32\DRIVERS\bcm4sbxp.sys

2011/07/11 17:08:58.0887 5220 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2011/07/11 17:08:59.0231 5220 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2011/07/11 17:08:59.0324 5220 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2011/07/11 17:08:59.0385 5220 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2011/07/11 17:08:59.0577 5220 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2011/07/11 17:08:59.0764 5220 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2011/07/11 17:08:59.0970 5220 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2011/07/11 17:09:00.0155 5220 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2011/07/11 17:09:00.0260 5220 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2011/07/11 17:09:00.0342 5220 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/07/11 17:09:00.0460 5220 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2011/07/11 17:09:00.0542 5220 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2011/07/11 17:09:00.0610 5220 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2011/07/11 17:09:00.0822 5220 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

2011/07/11 17:09:01.0003 5220 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

2011/07/11 17:09:01.0183 5220 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2011/07/11 17:09:01.0397 5220 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2011/07/11 17:09:01.0618 5220 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2011/07/11 17:09:01.0866 5220 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

2011/07/11 17:09:02.0112 5220 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2011/07/11 17:09:02.0337 5220 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys

2011/07/11 17:09:02.0545 5220 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys

2011/07/11 17:09:02.0655 5220 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys

2011/07/11 17:09:02.0752 5220 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2011/07/11 17:09:02.0820 5220 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2011/07/11 17:09:03.0096 5220 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/07/11 17:09:03.0435 5220 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2011/07/11 17:09:03.0751 5220 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2011/07/11 17:09:04.0322 5220 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2011/07/11 17:09:04.0561 5220 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2011/07/11 17:09:04.0616 5220 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

2011/07/11 17:09:04.0692 5220 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2011/07/11 17:09:04.0878 5220 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2011/07/11 17:09:05.0075 5220 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/07/11 17:09:05.0208 5220 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2011/07/11 17:09:05.0360 5220 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

2011/07/11 17:09:05.0465 5220 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2011/07/11 17:09:05.0535 5220 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2011/07/11 17:09:05.0608 5220 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

2011/07/11 17:09:05.0693 5220 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

2011/07/11 17:09:05.0936 5220 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/07/11 17:09:06.0119 5220 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2011/07/11 17:09:06.0257 5220 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2011/07/11 17:09:06.0321 5220 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2011/07/11 17:09:06.0392 5220 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2011/07/11 17:09:06.0628 5220 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys

2011/07/11 17:09:06.0825 5220 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

2011/07/11 17:09:07.0033 5220 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys

2011/07/11 17:09:07.0389 5220 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2011/07/11 17:09:07.0576 5220 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/07/11 17:09:07.0753 5220 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2011/07/11 17:09:07.0966 5220 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2011/07/11 17:09:08.0163 5220 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

2011/07/11 17:09:08.0249 5220 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

2011/07/11 17:09:08.0308 5220 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/07/11 17:09:08.0509 5220 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2011/07/11 17:09:08.0565 5220 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2011/07/11 17:09:08.0628 5220 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2011/07/11 17:09:08.0813 5220 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2011/07/11 17:09:09.0034 5220 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/07/11 17:09:09.0185 5220 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2011/07/11 17:09:09.0265 5220 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2011/07/11 17:09:09.0324 5220 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/07/11 17:09:09.0446 5220 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/07/11 17:09:09.0524 5220 kl1 (ce3958f58547454884e97bda78cd7040) C:\Windows\system32\DRIVERS\kl1.sys

2011/07/11 17:09:09.0602 5220 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2011/07/11 17:09:09.0851 5220 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/07/11 17:09:10.0065 5220 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2011/07/11 17:09:10.0199 5220 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2011/07/11 17:09:10.0271 5220 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2011/07/11 17:09:10.0328 5220 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2011/07/11 17:09:10.0530 5220 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\Windows\system32\drivers\mbam.sys

2011/07/11 17:09:10.0737 5220 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

2011/07/11 17:09:10.0913 5220 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2011/07/11 17:09:11.0130 5220 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2011/07/11 17:09:11.0330 5220 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2011/07/11 17:09:11.0447 5220 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2011/07/11 17:09:11.0507 5220 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2011/07/11 17:09:11.0563 5220 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2011/07/11 17:09:11.0787 5220 mozyFilter (19cb6b226733843817d607c46fdb310c) C:\Windows\system32\DRIVERS\mozy.sys

2011/07/11 17:09:12.0035 5220 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\Windows\system32\DRIVERS\MpFilter.sys

2011/07/11 17:09:12.0204 5220 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2011/07/11 17:09:12.0346 5220 MpKsl0f2b2235 (5f53edfead46fa7adb78eee9ecce8fdf) c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys

2011/07/11 17:09:12.0617 5220 MpNWMon (f32e2d6a1640a469a9ed4f1929a4a861) C:\Windows\system32\DRIVERS\MpNWMon.sys

2011/07/11 17:09:12.0825 5220 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2011/07/11 17:09:13.0009 5220 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2011/07/11 17:09:13.0180 5220 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2011/07/11 17:09:13.0386 5220 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/07/11 17:09:13.0562 5220 mrxsmb10 (d4a3c7c580c4ccb5c06f2ada933ad507) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/07/11 17:09:13.0613 5220 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/07/11 17:09:13.0671 5220 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

2011/07/11 17:09:13.0750 5220 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2011/07/11 17:09:13.0952 5220 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2011/07/11 17:09:14.0154 5220 MSHUSBVideo (5119ffc2a6b51089cdb0efdc75808c97) C:\Windows\system32\Drivers\nx6000.sys

2011/07/11 17:09:14.0385 5220 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2011/07/11 17:09:14.0571 5220 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2011/07/11 17:09:14.0787 5220 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/07/11 17:09:14.0957 5220 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2011/07/11 17:09:15.0140 5220 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2011/07/11 17:09:15.0327 5220 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/07/11 17:09:15.0469 5220 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2011/07/11 17:09:15.0537 5220 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2011/07/11 17:09:15.0836 5220 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2011/07/11 17:09:16.0078 5220 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2011/07/11 17:09:16.0247 5220 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/07/11 17:09:16.0291 5220 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/07/11 17:09:16.0348 5220 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/07/11 17:09:16.0422 5220 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2011/07/11 17:09:16.0595 5220 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2011/07/11 17:09:16.0807 5220 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2011/07/11 17:09:17.0083 5220 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2011/07/11 17:09:17.0255 5220 NisDrv (17e2c08c5ecfbe94a7c67b1c275ee9d9) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

2011/07/11 17:09:17.0344 5220 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2011/07/11 17:09:17.0526 5220 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2011/07/11 17:09:17.0765 5220 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2011/07/11 17:09:17.0960 5220 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2011/07/11 17:09:18.0163 5220 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2011/07/11 17:09:18.0376 5220 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

2011/07/11 17:09:18.0504 5220 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

2011/07/11 17:09:18.0564 5220 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2011/07/11 17:09:18.0711 5220 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys

2011/07/11 17:09:18.0952 5220 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2011/07/11 17:09:19.0122 5220 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2011/07/11 17:09:19.0311 5220 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2011/07/11 17:09:19.0506 5220 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2011/07/11 17:09:19.0575 5220 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

2011/07/11 17:09:19.0633 5220 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2011/07/11 17:09:19.0882 5220 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2011/07/11 17:09:20.0226 5220 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2011/07/11 17:09:20.0406 5220 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2011/07/11 17:09:20.0633 5220 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2011/07/11 17:09:20.0879 5220 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2011/07/11 17:09:21.0072 5220 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2011/07/11 17:09:21.0256 5220 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2011/07/11 17:09:21.0585 5220 R300 (7db96c2801a78513bdc133c25d07929e) C:\Windows\system32\DRIVERS\atikmdag.sys

2011/07/11 17:09:21.0792 5220 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2011/07/11 17:09:22.0006 5220 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/07/11 17:09:22.0254 5220 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/07/11 17:09:22.0428 5220 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2011/07/11 17:09:22.0587 5220 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2011/07/11 17:09:22.0643 5220 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/07/11 17:09:22.0728 5220 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2011/07/11 17:09:22.0926 5220 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2011/07/11 17:09:23.0134 5220 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2011/07/11 17:09:23.0337 5220 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys

2011/07/11 17:09:23.0474 5220 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\drivers\rimsptsk.sys

2011/07/11 17:09:23.0525 5220 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\drivers\rixdptsk.sys

2011/07/11 17:09:23.0587 5220 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2011/07/11 17:09:23.0693 5220 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\program files\SUPERAntiSpyware\SASDIFSV.SYS

2011/07/11 17:09:23.0758 5220 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

2011/07/11 17:09:23.0939 5220 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2011/07/11 17:09:24.0173 5220 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

2011/07/11 17:09:24.0376 5220 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/07/11 17:09:24.0578 5220 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

2011/07/11 17:09:24.0786 5220 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2011/07/11 17:09:24.0961 5220 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2011/07/11 17:09:25.0180 5220 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

2011/07/11 17:09:25.0361 5220 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2011/07/11 17:09:25.0495 5220 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

2011/07/11 17:09:25.0541 5220 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2011/07/11 17:09:25.0602 5220 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

2011/07/11 17:09:25.0646 5220 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2011/07/11 17:09:25.0843 5220 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2011/07/11 17:09:26.0048 5220 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2011/07/11 17:09:26.0253 5220 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2011/07/11 17:09:26.0448 5220 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2011/07/11 17:09:26.0577 5220 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

2011/07/11 17:09:26.0632 5220 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

2011/07/11 17:09:26.0748 5220 STHDA (6a2a5e809c2c0178326d92b19ee4aad3) C:\Windows\system32\drivers\stwrt.sys

2011/07/11 17:09:26.0949 5220 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2011/07/11 17:09:27.0156 5220 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2011/07/11 17:09:27.0347 5220 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2011/07/11 17:09:27.0476 5220 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2011/07/11 17:09:27.0576 5220 SynTP (1f5192248a364d4ab68db063d18a2139) C:\Windows\system32\DRIVERS\SynTP.sys

2011/07/11 17:09:27.0712 5220 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys

2011/07/11 17:09:27.0947 5220 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys

2011/07/11 17:09:28.0132 5220 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys

2011/07/11 17:09:28.0292 5220 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2011/07/11 17:09:28.0333 5220 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2011/07/11 17:09:28.0387 5220 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2011/07/11 17:09:28.0516 5220 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2011/07/11 17:09:28.0615 5220 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/07/11 17:09:28.0660 5220 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2011/07/11 17:09:28.0702 5220 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2011/07/11 17:09:28.0902 5220 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

2011/07/11 17:09:29.0105 5220 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2011/07/11 17:09:29.0321 5220 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2011/07/11 17:09:29.0450 5220 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2011/07/11 17:09:29.0509 5220 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2011/07/11 17:09:29.0557 5220 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2011/07/11 17:09:29.0619 5220 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2011/07/11 17:09:30.0013 5220 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

2011/07/11 17:09:30.0199 5220 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/07/11 17:09:30.0421 5220 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2011/07/11 17:09:30.0641 5220 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2011/07/11 17:09:30.0836 5220 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2011/07/11 17:09:31.0020 5220 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

2011/07/11 17:09:31.0192 5220 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2011/07/11 17:09:31.0388 5220 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

2011/07/11 17:09:31.0571 5220 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/07/11 17:09:31.0757 5220 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/07/11 17:09:31.0966 5220 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

2011/07/11 17:09:32.0202 5220 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/07/11 17:09:32.0399 5220 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2011/07/11 17:09:32.0588 5220 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2011/07/11 17:09:32.0788 5220 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2011/07/11 17:09:32.0965 5220 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

2011/07/11 17:09:33.0141 5220 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2011/07/11 17:09:33.0333 5220 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2011/07/11 17:09:33.0463 5220 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2011/07/11 17:09:33.0530 5220 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2011/07/11 17:09:33.0602 5220 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2011/07/11 17:09:33.0658 5220 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/07/11 17:09:33.0688 5220 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/07/11 17:09:33.0951 5220 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2011/07/11 17:09:34.0147 5220 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2011/07/11 17:09:34.0388 5220 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

2011/07/11 17:09:34.0685 5220 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

2011/07/11 17:09:34.0926 5220 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/07/11 17:09:35.0087 5220 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/07/11 17:09:35.0157 5220 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys

2011/07/11 17:09:35.0246 5220 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

2011/07/11 17:09:35.0289 5220 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3

2011/07/11 17:09:35.0419 5220 Boot (0x1200) (26d676eb2feab456b1a6d599a053a53d) \Device\Harddisk0\DR0\Partition0

2011/07/11 17:09:35.0464 5220 Boot (0x1200) (48560e0ee128b161c08a1c1cef29e326) \Device\Harddisk0\DR0\Partition1

2011/07/11 17:09:35.0497 5220 Boot (0x1200) (9756d9e664577e4b7b5f616758b9160b) \Device\Harddisk1\DR3\Partition0

2011/07/11 17:09:35.0511 5220 ================================================================================

2011/07/11 17:09:35.0511 5220 Scan finished

2011/07/11 17:09:35.0511 5220 ================================================================================

2011/07/11 17:09:35.0556 3352 Detected object count: 0

2011/07/11 17:09:35.0556 3352 Actual detected object count: 0

Combofix

ComboFix 11-07-11.02 - Gary 07/11/2011 17:19:27.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.61.1033.18.2685.1079 [GMT 2:00]

Running from: c:\users\Gary\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2011-06-11 to 2011-07-11 )))))))))))))))))))))))))))))))

.

2011-07-11 15:30 . 2011-07-11 15:30 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-11 12:25 . 2011-07-11 12:26 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys

2011-07-11 12:25 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\mpengine.dll

2011-07-06 16:49 . 2011-07-06 16:49 711728 ----a-w- c:\windows\isRS-000.tmp

2011-07-06 16:47 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 16:47 . 2011-07-07 12:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-07-06 16:47 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-05 14:16 . 2011-07-05 14:17 -------- d-----w- c:\programdata\rukohay

2011-07-05 13:55 . 2011-07-05 13:56 -------- d-----w- c:\programdata\paporor

2011-07-05 13:54 . 2011-07-06 01:22 -------- d-----w- c:\programdata\bozagud

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\GNU

2011-07-02 20:54 . 2011-07-02 20:54 -------- d-----w- c:\program files\CoreAAC

2011-07-02 20:51 . 2011-07-02 20:52 -------- d-----w- c:\users\Administrator

2011-07-02 20:51 . 2011-07-05 13:46 -------- d-----w- c:\program files\GRETECH

2011-07-02 20:41 . 2011-07-02 20:41 -------- d-----w- c:\program files\Webteh

2011-07-02 16:28 . 2011-07-02 16:59 -------- d-----w- c:\program files\VLC

2011-07-02 16:07 . 2011-07-02 16:07 -------- d-----w- c:\users\Gary\AppData\Local\DDMSettings

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\programdata\W3i

2011-07-02 10:28 . 2011-07-02 10:28 -------- d-----w- c:\program files\W3i

2011-06-30 16:44 . 2011-07-02 16:29 -------- d-----w- c:\program files\Xvid

2011-06-30 09:42 . 2011-04-29 15:59 276992 ----a-w- c:\windows\system32\schannel.dll

2011-06-28 13:59 . 2011-06-28 13:59 -------- d-----w- c:\programdata\HP Product Assistant

2011-06-20 15:55 . 2011-04-14 16:26 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-06-16 15:41 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 15:41 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 15:41 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 15:37 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-16 15:37 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-16 15:37 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-16 15:37 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-16 15:37 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-16 15:36 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-06-16 15:36 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-16 15:35 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-16 15:35 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-16 15:35 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-15 07:33 . 2011-07-02 16:40 -------- d-----w- c:\users\Gary\AppData\Roaming\vlc

2011-06-15 07:32 . 2011-07-02 16:33 -------- d-----w- c:\program files\VideoLAN

2011-06-15 07:29 . 2011-06-15 07:31 19657194 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\vlc-1.1.4-win32.exe

2011-06-14 18:03 . 2011-06-14 18:03 -------- d-----w- c:\program files\hjsplit

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Roaming\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\users\Gary\AppData\Local\ATI

2011-06-14 12:22 . 2011-06-14 12:22 -------- d-----w- c:\programdata\ATI

2011-06-14 12:17 . 2011-06-14 12:17 0 ----a-w- c:\windows\ativpsrm.bin

2011-06-14 10:17 . 2011-06-14 10:22 -------- d-----w- c:\users\Gary\AppData\Local\Deployment

2011-06-14 10:17 . 2011-06-14 10:17 -------- d-----w- c:\users\Gary\AppData\Local\Apps

2011-06-14 08:45 . 2011-06-14 08:45 -------- d-----w- c:\users\Gary\AppData\Local\ElevatedDiagnostics

2011-06-14 08:43 . 2011-06-14 08:43 -------- d-----w- c:\program files\Microsoft ATS

2011-06-14 08:42 . 2011-06-14 08:42 554264 ----a-w- c:\program files\Mats_Run.power.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-25 09:15 . 2011-05-20 10:42 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-10 21:41 . 2011-06-10 21:41 86544 ----a-w- c:\windows\system32\drivers\bckd.sys

2011-06-09 11:24 . 2011-06-09 11:24 1110476 ----a-w- c:\program files\7z920.exe

2011-06-07 15:55 . 2010-12-24 11:48 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-06-06 19:14 . 2011-06-06 19:11 20388104 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXWebPlayerBetaInstaller.exe

2011-06-04 17:53 . 2011-06-04 17:53 2652884 ----a-w- c:\program files\ac3filter_1_62b.exe

2011-06-02 18:16 . 2011-06-02 18:16 1448993 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\wrar401.exe

2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\system32\dpl100.dll

2011-05-31 14:05 . 2011-05-31 14:05 327752 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\ChannelFilmsInstaller.exe

2011-05-27 08:41 . 2011-05-27 08:41 6140360 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\megakey.exe

2011-05-20 10:40 . 2011-05-20 10:39 3081376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player(1).exe

2011-05-11 20:53 . 2011-05-11 20:53 2010888 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\iLividSetupV1.exe

2011-05-10 07:36 . 2011-05-10 07:35 7354435 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\FotoSketcher.exe

2011-05-08 16:36 . 2011-05-08 16:35 915296 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\DivXInstaller.exe

2011-05-07 13:28 . 2011-05-07 13:27 2832544 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\install_flash_player.exe

2011-05-05 06:09 . 2011-05-05 06:08 4157856 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\GarminMapUpdater_v2.6.8.exe

2011-04-28 18:29 . 2011-04-28 18:27 12855600 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\yahoo_firefox_4.0-rc2_setup_au.exe

2011-04-27 07:04 . 2011-04-27 07:02 30459048 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\asc4-setup-cnet.exe

2011-04-24 08:21 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-04-16 08:13 . 2011-04-16 08:10 38147376 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\QuickTimeInstaller.exe

2011-04-13 08:53 . 2011-04-13 08:53 299288 ----a-w- c:\users\Gary\AppData\Roaming\Microsoft\Installer\GmailInstaller.exe

2011-04-14 16:26 . 2011-06-20 15:55 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77F4E711-789B-447F-9614-96759B2F83C6}]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-05-17 11:29 1490312 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]

@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"

[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]

@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"

[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]

2010-09-28 08:58 3412792 ----a-w- c:\program files\MozyHome\mozyshell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote Table Of Contents.onetoc2 [2011-6-7 3656]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer6"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]

backup=c:\windows\pss\Google Updater.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MozyHome Status.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MozyHome Status.lnk

backup=c:\windows\pss\MozyHome Status.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PHOTOfunSTUDIO -viewer-.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO -viewer-.lnk

backup=c:\windows\pss\PHOTOfunSTUDIO -viewer-.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]

backup=c:\windows\pss\QuickSet.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Easy Notification.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Easy Notification.lnk

backup=c:\windows\pss\Easy Notification.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ePrompter.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ePrompter.lnk

backup=c:\windows\pss\ePrompter.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]

backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup

backupExtension=.Startup

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk

.

[HKLM\~\startupfolder\C:^Users^Barb^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SAM.lnk]

path=c:\users\Barb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SAM.lnk

backup=c:\windows\pss\SAM.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]

2011-05-17 11:29 395144 ----a-w- c:\program files\Ask.com\Updater\Updater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]

2007-12-08 12:34 3444736 ----a-w- c:\windows\System32\WLTRAY.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2011-04-12 08:10 136176 ----atw- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 09:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-10-14 19:17 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallIQUpdater]

2011-06-22 11:34 2408448 ----a-w- c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2006-10-03 03:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-10-03 03:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Megakey]

2011-05-27 08:43 2593280 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\Megakey.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MegakeyUpdater]

2011-05-27 08:43 64000 ----a-w- c:\users\Gary\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-11-10 00:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]

2009-06-23 01:37 745472 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2009-06-25 05:12 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2006-10-20 09:23 118784 ----a-w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2006-11-02 12:34 1196032 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2007-09-13 12:44 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2011-04-18 15:30 15146376 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-04-16 02:30 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2011-06-11 11:03 2424192 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2006-11-20 17:51 815104 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2006-11-02 12:33 1004136 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2006-11-02 12:34 201728 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\yojomel]

2011-04-05 14:16 923648 --sha-w- c:\programdata\rukohay\rukohay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]

2005-07-15 21:48 479232 ----a-w- c:\program files\Google\Gmail Notifier\gnotify.exe

.

R1 fsacciis;fsacciis;c:\windows\system32\drivers\fsacciis.sys [x]

R1 MpKsl721c7d55;MpKsl721c7d55;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B3EFF03-70A6-4B6A-B1DF-5BB9DFC6909A}\MpKsl721c7d55.sys [x]

R1 MpKsle8d8f78d;MpKsle8d8f78d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18CB7924-4BDF-4DB3-A50E-2114F022C0D8}\MpKsle8d8f78d.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 wappstackApache;wappstackApache;c:\progra~1\BITNAM~2\apache2\bin\httpd.exe [2010-10-17 20549]

R2 wappstackPostgreSQL;wappstackPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N wappstackPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]

R3 bsusbser;Basecom USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\bsusbser.sys [x]

R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-05-20 30576]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S1 bckd;bckd;c:\windows\system32\drivers\bckd.sys [2011-06-10 86544]

S1 MpKsl0f2b2235;MpKsl0f2b2235;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{60D1805F-E8E4-43DF-A3DA-3C2446E6FA00}\MpKsl0f2b2235.sys [2011-07-11 28752]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [2011-06-10 1575184]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 postgresqlPostgreSQL;postgresqlPostgreSQL;C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N postgresqlPostgreSQL -D C:/PROGRA~1/BITNAM~2/POSTGR~1/data [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - 15250999

*NewlyCreated* - FXLDAPOD

*NewlyCreated* - MPKSL0F2B2235

*NewlyCreated* - MPKSLE808F833

*Deregistered* - 15250999

*Deregistered* - eeCtrl

*Deregistered* - fxldapod

*Deregistered* - klbg

*Deregistered* - KLIF

*Deregistered* - MpKsle808f833

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005Core.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2958332866-2026460733-2266450084-1005UA.job

- c:\users\Gary\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-12 08:10]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.usatoday.com/

uInternet Settings,ProxyServer = http=127.0.0.1:63111

IE: Capture Web Page - c:\users\Gary\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Fetch to Megaupload - c:\users\Gary\AppData\Local\Megamedia\Megakey\MegaUpload.htm

LSP: c:\programdata\Megamedia\Megakey\msadm.dll

Trusted Zone: garmin.com

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\wd6t9fi5.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://www.usatoday.com/

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FKR&o=100000013&locale=en_FR&apn_uid=a070c667-a2ef-4ea0-baf4-8473914551ba&apn_ptnrs=2T&apn_sauid=53DAF7D5-5107-4ED7-AD15-13701CBBC70E&apn_dtid=YYYYYYYYFR&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - (no file)

Toolbar-Locked - (no file)

HKLM-Run-hpqSRMon - (no file)

MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-Chrysanth Email Notifier - c:\program files\Chrysanth\NETime\Email Notifier\CSMailManager.exe

MSConfigStartUp-conhost - c:\users\Gary\AppData\Roaming\Microsoft\conhost.exe

MSConfigStartUp-DellSupport - c:\program files\DellSupport\DSAgnt.exe

MSConfigStartUp-Escritorio movistar - c:\program files\Movistar\Escritorio movistar\EMMSN.exe

MSConfigStartUp-FileBack PC - c:\progra~1\FILEBA~1\FileBack.exe

MSConfigStartUp-Free Download Manager - c:\program files\Free Download Manager\fdm.exe

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

MSConfigStartUp-osCheck - c:\program files\Norton Internet Security\osCheck.exe

MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe

MSConfigStartUp-Uniblue SpeedUpMyPC - c:\program files\Uniblue\SpeedUpMyPC\SpeedUpMyPC.exe

AddRemove-E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84 - c:\progra~1\DIFX\270581355A767BF1\dpinst.exe

AddRemove-F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7 - c:\progra~1\DIFX\270581355A767BF1\dpinst.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-11 17:30

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

--

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresqlPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"postgresqlPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wappstackPostgreSQL]

"ImagePath"="C:/PROGRA~1/BITNAM~2/POSTGR~1/bin/pg_ctl.exe runservice -N \"wappstackPostgreSQL\" -D \"C:/PROGRA~1/BITNAM~2/POSTGR~1/data\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

"NoChange"="1"

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

"Installed"="1"

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG11.00.00.01WORKSTATION"="85B6D6D58E1FF206F1F52E2C13842E354D08F87C8717B8085A3536B5CA331B796572F0F9B60DF0A4DF991B85646C25FBC8AAB7293C7A0C8DE128DCD6D8A1C64C3EFBFCBC31FEF60115E97F6B9ED9C1AEEC1BB615AB3AA79E12B293D4330127EDE4F3B40BD218323269F946C7ABB4EE2CB77C2B43F09FD207AEA7F86BCA9981B00102C7F902C404B48AE14AA68726CBB8FB78BD58C0360973CDE0A5F5A678CC4910CD583FB93181E77BBB5A36C11F2A7CE1388B9B5D4DF876DD3A2478E0FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A2D97226D213B555A6171C11EC38DE3D061509460847F9E8B891084BE430F9F88B770284BD256ACF5100B7F6343D936241C391C3E034A48247D7DE5EAFE4BC445EAA2A1E4017832981BA9F8A611CD727AB1E778E953A877063D2FCE8A5681B1D5A6525F9CE5D30141C66A7DBF4ECE0D0CBAB3B46682DC370F5684ECC3C7CF015E88EE3E330C7A315A9856D3925AA5BF9EC2E415F21561D532A361F43EBD7BB5537BDBCF5AD18B4CAF84D6D43AB4596D51E16D39E0EF37CFE710AA05731239C15B740EA2114075F629CA68CF1C8218626B20B9C21FA35F0EAFEE8E7690D7D5BA39D168B2C35BCC01F6A30138CBC17C34440662E53BE40A826CB896F2C04F9DE646373222EE8DA1C597CBA2B32D072899CA4B7FA782FAE79D1925793291F1DB64C45C094158574D97BB14BE3534DF3B82E7D41DDA7280CDDA2D4F1953AE9E09465C59B2DA06B8E8385AA1DB13803CDD38F2EF910CC0A5A71E2572D1C1076B34FCF29D39AE5F9A5C70ACE1C6A78C2A903E6DD0B35A4B88E73ED2090AF2E58F75FBBF76E6FCC99A97A30C76ACB82642493F077D350C21A91CB367DD6BE6DA803E3F000A2A294B17A923504DDF398C2CA74FEAA67490F1CBF02417DF09877831F1DC852DF0DCBAF722AE5367F66503BA3B873698B6D432C6B43A8F581F44E8A0BF231C4C26ED7075A00A5538C0A9332271A49ECBB6C6DBFD8DF19FDDF6BC462F76E2E6FA2E7F1AC73F7ED95F62B1F0CBEF28A2FA5DA724EC0CCD3F2187A82B28B3C5430068126996E98C77CE47885B5CCC258EEABB007D150A3AD74E98204286030CEA82CA3564C738DD448AE85AC1DA4AFE630E3CBB64B29A090E5C7CA977505BFDBBC039EB5C61DA3C58163CACE340F007E391BEAE03EDF25796F5A7BE2CBFA044C95B0244E8CFA4F637042227871C620FB164D34B6B27EB57AFE7CA1DB67B8BB89218DCA7CA910270823C2CA0C50FB9FCD152E2E41B37FFB3742BD2ECE82A7488A11A48BF0AAD2E5A4EC0F6ABE5053B2F9C9A44659D056C36BAFE278DC5E26AF5FD838C631A12F6BBAE381069CF1E431188B4A4DAE1E687EE17EE0B87840059BAA33BBBD"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000001

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(5228)

c:\program files\MozyHome\mozyshell.dll

c:\program files\MozyHome\LIBEAY32.dll

.

Completion time: 2011-07-11 17:35:25

ComboFix-quarantined-files.txt 2011-07-11 15:35

.

Pre-Run: 5,021,110,272 bytes free

Post-Run: 6,523,977,728 bytes free

.

- - End Of File - - 29BA70C9A01B7C3CADC91F2A363D927E

Security Check

Results of screen317's Security Check version 0.99.17

Windows Vista Service Pack 2 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

Microsoft Security Essentials

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 13

Java SE Runtime Environment 6

Java 6 Update 3

Java 6 Update 5

Java 6 Update 7

Out of date Java installed!

Adobe Flash Player 10.3.181.26

Mozilla Firefox (x86 en-US..)

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSMpEng.exe

Malwarebytes' Anti-Malware mbamservice.exe

Malwarebytes' Anti-Malware mbamgui.exe

Microsoft Security Essentials msseces.exe

``````````End of Log````````````

D-FRED-BROWN · July 11, 2011

Thanks for your response. I just wanted to mention, that since posting Vista came up with a message saying it had blocked some programs, though I couldn't tell what they were. After this the Antivirus Plus popups stopped and the PC is running as it should. I don't know if this means vista has taken care of anything. I have followed you instructions and the log files follow. Tdskiller didn't find anything, but I have run this before, following some instructions I found elsewhere on the internet, but I'll post the log anyway.

We still have some more cleanup to do :

First, please BackupYour Registry with ERUNT

Please go here, scroll down to ERUNT, and download.
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your Registry to the folder of your choice.

Note: To restore your Registry, go to the folder and start ERDNT.exe

-------

Please do the following:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KILLALL::
Reglock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
Regnull::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
Driver::
15250999
fsacciis
File::
C:\windows\system32\drivers\15250999.sys
c:\windows\system32\drivers\fsacciis.sys
c:\programdata\rukohay\rukohay.dll
Folder::
c:\programdata\rukohay
c:\programdata\paporor
c:\programdata\bozagud

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I shall require in your next reply.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please include the newly-created C:\ComboFix.txt in your next reply, and let me know how things are running now

BarbW · July 12, 2011

I tried running combofix according to your instructions but it stopped at the following point, and even though I left it running overnight, still nothing happened and I had to power the laptop off forcibly to get rid of it.

"This typically doesn't take more than 10 minutes...."

D-FRED-BROWN · July 12, 2011

Let's try running ComboFix in Safe Mode:

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Once you are in Safe Mode, please locate the CFScript.txt on your Desktop, and drag it onto ComboFix.exe. Please post the log that it creates in your next reply

BarbW · July 13, 2011

Log file follows

ComboFix 11-07-12.04 - Gary 07/12/2011 19:40:20.2.2 - x86 MINIMAL

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.61.1033.18.2685.2180 [GMT 2:00]

Running from: c:\users\Gary\Desktop\ComboFix.exe

Command switches used :: c:\users\Gary\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\programdata\rukohay\rukohay.dll"

"c:\windows\system32\drivers\15250999.sys"

"c:\windows\system32\drivers\fsacciis.sys"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\bozagud

c:\programdata\paporor

c:\programdata\paporor\berewej.ico

c:\programdata\paporor\paporor.dll

c:\programdata\paporor\paporor.dll.manifest

c:\programdata\rukohay

c:\programdata\rukohay\berewej.ico

c:\programdata\rukohay\rukohay.dll

c:\programdata\rukohay\rukohay.dll.manifest

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_15250999

-------\Service_fsacciis

.

((((((((((((((((((((((((( Files Created from 2011-06-12 to 2011-07-12 )))))))))))))))))))))))))))))))

.

2011-07-12 17:51 . 2011-07-12 17:54 -------- d-----w- c:\users\Gary\AppData\Local\temp

2011-07-12 17:51 . 2011-07-12 17:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-12 13:21 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AA263DEF-5CDC-47EF-B765-7A2D8E716533}\mpengine.dll