sunnyd53 Posted August 19, 2011 ID:467162 Share Posted August 19, 2011 OK, so I'm not even sure how or when I got infected, but two days ago I had a pop up of "Security Protection". I tried a system restore to no avail. I booted to safe mode, ran Malwarebytes and deleted like 16 files. I rebooted and I got a pop up from malwarebytes IP Blocked 208.xxx.xxx.xxx (not sure) svchost.exe and then a blue screen. I reboot, and now Security Protection is back. Back to safe mode - and Malwarebytes detects more infected files...Logs -Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7494Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/17/2011 8:40:07 PMmbam-log-2011-08-17 (20-40-07).txtScan type: Quick scanObjects scanned: 164343Time elapsed: 2 minute(s), 52 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 2Registry Data Items Infected: 0Folders Infected: 0Files Infected: 14Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kximuneburi (Trojan.Hiloti) -> Value: Kximuneburi -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Protection (Trojan.FakeAlert) -> Value: Security Protection -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\Windows\System32\config\systemprofile\AppData\Local\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\0.038495194601316784.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\0.15650728480928044.exe (Trojan.Downloader) -> Quarantined and deleted successfully.c:\Windows\Temp\0.1844032401464989.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\2ED3.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\4D7C.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\4F20.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\jar_cache7106412428970004528.tmp (Trojan.Agent) -> Quarantined and deleted successfully.c:\Windows\Temp\srv1A8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\oxx.exe (Trojan.Agent) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\application data\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\application data\oxx.exe (Trojan.Agent) -> Quarantined and deleted successfully.c:\programdata\defender.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.Second Scan - Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7494Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/17/2011 10:18:25 PMmbam-log-2011-08-17 (22-18-25).txtScan type: Full scan (C:\|)Objects scanned: 289423Time elapsed: 27 minute(s), 10 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 2Registry Data Items Infected: 0Folders Infected: 0Files Infected: 9Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gA01602KhDgC01602 (Trojan.FakeAlert) -> Value: gA01602KhDgC01602 -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Protection (Trojan.FakeAlert) -> Value: Security Protection -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\programdata\ga01602khdgc01602\ga01602khdgc01602.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\deployment\cache\6.0\62\45c923be-6fbbe832 (Trojan.Ransom.Gen) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\mmc232.exe (VirTool.Obfuscator) -> Quarantined and deleted successfully.c:\Windows\Temp\0.053151268680833086.exe (Trojan.Ransom.Gen) -> Quarantined and deleted successfully.c:\Windows\Temp\0.5753256391106913.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\7898.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\jar_cache8530220809430180293.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\programdata\defender.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.Third Scan -Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7502Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/18/2011 7:21:35 PMmbam-log-2011-08-18 (19-21-35).txtScan type: Full scan (C:\|)Objects scanned: 289371Time elapsed: 28 minute(s), 1 second(s)Memory Processes Infected: 0Memory Modules Infected: 2Registry Keys Infected: 0Registry Values Infected: 3Registry Data Items Infected: 0Folders Infected: 0Files Infected: 11Memory Processes Infected:(No malicious items detected)Memory Modules Infected:c:\Windows\System32\config\systemprofile\AppData\Local\ima027.dll (Trojan.Hiloti) -> Delete on reboot.c:\Windows\System32\config\systemprofile\AppData\Local\ubufivuta.dll (IPH.Trojan.Hiloti.7B) -> Delete on reboot.Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kximuneburi (Trojan.Hiloti) -> Value: Kximuneburi -> Delete on reboot.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rjoxizuxa (IPH.Trojan.Hiloti.7B) -> Value: Rjoxizuxa -> Delete on reboot.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Protection (Trojan.FakeAlert) -> Value: Security Protection -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\Windows\System32\config\systemprofile\AppData\Local\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\AppData\Local\ubufivuta.dll (IPH.Trojan.Hiloti.7B) -> Quarantined and deleted successfully.c:\Windows\Temp\0.7354424438864159.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\0.7785120250179365.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\19C6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.c:\Windows\Temp\695C.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.c:\Windows\Temp\B7E2.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.c:\Windows\Temp\srv4DC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.c:\Windows\Temp\srv5BC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.c:\programdata\defender.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.c:\Windows\Temp\0.62959696463532.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.4th Scan -Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7502Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/18/2011 8:02:41 PMmbam-log-2011-08-18 (20-02-41).txtScan type: Quick scanObjects scanned: 167468Time elapsed: 1 minute(s), 37 second(s)Memory Processes Infected: 0Memory Modules Infected: 1Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 0Files Infected: 4Memory Processes Infected:(No malicious items detected)Memory Modules Infected:c:\Windows\System32\config\systemprofile\AppData\Local\ima027.dll (Trojan.Hiloti) -> Delete on reboot.Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kximuneburi (Trojan.Hiloti) -> Value: Kximuneburi -> Delete on reboot.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\Windows\System32\config\systemprofile\AppData\Local\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\Temp\0.9916966340127285.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.c:\Windows\System32\config\systemprofile\local settings\application data\ima027.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.THEN ran ComboFix and it deleted two files. I rebooted and ran MalwarebytesLOGMalwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7502Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/18/2011 8:07:47 PMmbam-log-2011-08-18 (20-07-47).txtScan type: Quick scanObjects scanned: 165744Time elapsed: 2 minute(s), 57 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)Then Combofix again -ComboFix 11-08-18.03 - Shane 08/18/2011 20:11:42.2.2 - x86 NETWORKMicrosoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3582.2586 [GMT -4:00]Running from: c:\users\Shane\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}* Created a new restore point..((((((((((((((((((((((((( Files Created from 2011-07-19 to 2011-08-19 )))))))))))))))))))))))))))))))..2011-08-19 00:15 . 2011-08-19 00:15 -------- d-----w- c:\users\Default\AppData\Local\temp2011-08-18 01:26 . 2011-08-18 01:26 50176 ---ha-w- c:\windows\system32\fingdate.dll2011-08-18 01:25 . 2011-08-18 02:18 -------- d-----w- c:\programdata\gA01602KhDgC016022011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\users\Shane\AppData\Roaming\Malwarebytes2011-08-18 00:35 . 2011-07-08 11:55 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\programdata\Malwarebytes2011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-08-18 00:35 . 2011-07-08 11:55 22712 ----a-w- c:\windows\system32\drivers\mbam.sys2011-08-17 01:42 . 2011-06-15 09:04 86016 ----a-w- c:\windows\system32\odbccu32.dll2011-08-17 01:42 . 2011-06-15 09:04 81920 ----a-w- c:\windows\system32\odbccr32.dll2011-08-17 01:42 . 2011-06-15 09:04 122880 ----a-w- c:\windows\system32\odbccp32.dll2011-08-17 01:21 . 2011-08-17 23:54 53248 ---ha-w- c:\windows\system32\chglutil.dll2011-08-17 01:09 . 2011-08-17 01:09 -------- d-----w- c:\windows\Sun2011-08-09 22:40 . 2011-06-15 09:04 319488 ----a-w- c:\windows\system32\odbcjt32.dll2011-08-09 22:40 . 2011-06-15 09:04 163840 ----a-w- c:\windows\system32\odbctrac.dll2011-08-09 22:40 . 2011-06-15 09:04 94208 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-06-30 01:51 . 2011-06-24 04:48 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2011-06-11 02:37 . 2011-07-13 01:54 2332672 ----a-w- c:\windows\system32\win32k.sys2011-06-02 05:59 . 2011-07-13 01:54 169984 ----a-w- c:\windows\system32\winsrv.dll2011-06-02 05:58 . 2011-07-13 01:54 290816 ----a-w- c:\windows\system32\KernelBase.dll2011-06-02 05:55 . 2011-07-13 01:54 271872 ----a-w- c:\windows\system32\conhost.exe2011-06-02 05:45 . 2011-07-13 01:54 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll2011-05-28 03:00 . 2011-06-16 23:33 1638912 ----a-w- c:\windows\system32\mshtml.tlb2011-05-24 10:35 . 2011-06-28 22:07 294912 ----a-w- c:\windows\system32\umpnpmgr.dll..((((((((((((((((((((((((((((( SnapShot@2011-08-18_23.52.26 ))))))))))))))))))))))))))))))))))))))))).+ 2011-08-17 01:09 . 2011-08-19 00:03 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat- 2011-08-17 01:09 . 2011-08-18 23:29 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat- 2011-08-18 23:24 . 2011-08-18 23:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat+ 2011-08-19 00:03 . 2011-08-19 00:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat+ 2011-08-19 00:03 . 2011-08-19 00:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat- 2011-08-18 23:24 . 2011-08-18 23:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat+ 2010-09-25 01:21 . 2011-08-19 00:03 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat- 2010-09-25 01:21 . 2011-08-18 23:38 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat+ 2010-09-25 04:18 . 2011-08-19 00:03 114688 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat- 2010-09-25 04:18 . 2011-08-18 23:48 114688 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat+ 2009-07-14 04:41 . 2011-08-19 00:03 196608 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat- 2009-07-14 04:41 . 2011-08-18 23:48 196608 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat- 2010-09-25 04:18 . 2011-08-18 23:48 1703936 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat+ 2010-09-25 04:18 . 2011-08-19 00:03 1703936 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]2011-03-18 12:11 2471240 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2011-03-14 2071904]"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 1797008]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]"V0650Mon.exe"="c:\windows\V0650Mon.exe" [2010-02-23 28672]"Rocket Live! Central 2"="c:\program files\Rocketfish HD Webcam\Live! Central\RFLVCentral2.exe" [2010-02-24 430247]"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2009-09-13 103768]"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-01-08 288872]"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-08 1047656].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"GrpConv"="grpconv -o" [X]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-08 449584].c:\users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-3-10 576000].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 5.0 HD Edition.lnk - c:\program files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe [2010-12-25 172544].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\srv1A8]@="service".R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-09-25 216400]R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2009-09-08 65584]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-09-25 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-09-25 308136]R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-08 366640]R2 MicrosoftDynamicsNavServer;Microsoft Dynamics NAV Server;c:\program files\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [2009-08-14 141184]R2 srv1A8;srv1A8;c:\windows\system32\svchost.exe [2009-07-14 20992]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-08 378984]R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-03-18 947528]R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-03-26 144640]R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2010-07-07 44432]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-08 22712]R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]R3 MicrosoftDynamicsNavWS;Microsoft Dynamics NAV Business Web Services;c:\program files\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [2009-08-14 141184]R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]R3 V0650Vid;Rocketfish HD Webcam Driver;c:\windows\system32\DRIVERS\V0650Vid.sys [2010-03-31 322176]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-25 1343400]S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2011-05-06 243152]S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]..[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]WindowsMobile REG_MULTI_SZ wcescomm rapimgrLocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcssrv1A8..------- Supplementary Scan -------.uInternet Settings,ProxyOverride = *.localIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105TCP: DhcpNameServer = 209.18.47.61 209.18.47.62Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll..[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv1A8]"servicedll"="\\?\globalroot\Device\HarddiskVolume2\Windows\Temp\srv1A8.tmp".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2011-08-18 20:16:52ComboFix-quarantined-files.txt 2011-08-19 00:16ComboFix2.txt 2011-08-18 23:53.Pre-Run: 134,619,508,736 bytes freePost-Run: 134,541,299,712 bytes free.- - End Of File - - 796AFE0614655634B5F0EE33A4ABD25BAfter all of this, I boot up in normal, and bam - Malwarebytes blocks some IP (svchost.exe) and I get the blue screen.HELP!! Quickscan in Safe Mode just now -Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7503Windows 6.1.7600 (Safe Mode)Internet Explorer 8.0.7600.163858/18/2011 8:48:08 PMmbam-log-2011-08-18 (20-48-08).txtScan type: Quick scanObjects scanned: 167100Time elapsed: 2 minute(s), 28 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) DDS (Ver_2011-06-23.01) - NTFSx86 NETWORKInternet Explorer: 8.0.7600.16385Run by Shane at 21:14:28 on 2011-08-18Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3582.2331 [GMT -4:00].AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\WUDFHost.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\Explorer.EXEC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\system32\ctfmon.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exeC:\Windows\system32\conhost.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uInternet Settings,ProxyOverride = *.localmURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dllBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office14\GROOVEEX.DLLBHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLLBHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllTB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dllmRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exemRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServicesmRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [V0650Mon.exe] c:\windows\V0650Mon.exemRun: [Rocket Live! Central 2] "c:\program files\rocketfish hd webcam\live! central\RFLVCentral2.exe" /mode2mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startupmRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exemRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,StartmRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquietmRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscriptmRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silentmRunOnce: [GrpConv] grpconv -odRun: [Kximuneburi] rundll32.exe "c:\windows\system32\config\systemprofile\appdata\local\ima027.dll",StartupStartupFolder: c:\users\shane\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\photof~1.lnk - c:\program files\common files\panasonic\photofunstudio autostart\AutoStartupService.exemPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dllIE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dllIE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 209.18.47.61 209.18.47.62TCP: Interfaces\{09E9C12D-B854-4F27-BBA9-0425849B4188} : DhcpNameServer = 209.18.47.61 209.18.47.62TCP: Interfaces\{C1EEF202-5EBC-4682-A820-E45D6359DE9B} : DhcpNameServer = 10.1.0.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLLHandler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dllHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLAppInit_DLLs: c:\windows\system32\avgrsstx.dllSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office14\GROOVEEX.DLL.============= SERVICES / DRIVERS ===============.R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-24 243152]R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-24 216400]S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-24 29584]S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2009-9-8 65584]S2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-9-24 921952]S2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-9-24 308136]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-17 366640]S2 MicrosoftDynamicsNavServer;Microsoft Dynamics NAV Server;c:\program files\microsoft dynamics nav\60\service\Microsoft.Dynamics.Nav.Server.exe [2009-8-14 141184]S2 srv1A8;srv1A8;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-1-7 378984]S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 947528]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2011-1-20 144640]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-17 22712]S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208]S3 MicrosoftDynamicsNavWS;Microsoft Dynamics NAV Business Web Services;c:\program files\microsoft dynamics nav\60\service\Microsoft.Dynamics.Nav.Server.exe [2009-8-14 141184]S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]S3 V0650Vid;Rocketfish HD Webcam Driver;c:\windows\system32\drivers\V0650Vid.sys [2011-1-16 322176]S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-9-25 1343400].=============== Created Last 30 ================.2011-08-19 00:16:31 -------- d-sh--w- C:\$RECYCLE.BIN2011-08-18 23:53:27 -------- d-----w- c:\users\shane\appdata\local\temp2011-08-18 23:46:12 98816 ----a-w- c:\windows\sed.exe2011-08-18 23:46:12 518144 ----a-w- c:\windows\SWREG.exe2011-08-18 23:46:12 256000 ----a-w- c:\windows\PEV.exe2011-08-18 23:46:12 208896 ----a-w- c:\windows\MBR.exe2011-08-18 01:26:05 50176 ---ha-w- c:\windows\system32\fingdate.dll2011-08-18 01:25:37 -------- d-----w- c:\programdata\gA01602KhDgC016022011-08-18 00:35:52 -------- d-----w- c:\users\shane\appdata\roaming\Malwarebytes2011-08-18 00:35:47 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-08-18 00:35:46 -------- d-----w- c:\programdata\Malwarebytes2011-08-18 00:35:43 22712 ----a-w- c:\windows\system32\drivers\mbam.sys2011-08-18 00:35:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-08-17 01:42:58 86016 ----a-w- c:\windows\system32\odbccu32.dll2011-08-17 01:42:58 81920 ----a-w- c:\windows\system32\odbccr32.dll2011-08-17 01:42:58 122880 ----a-w- c:\windows\system32\odbccp32.dll2011-08-17 01:21:56 53248 ---ha-w- c:\windows\system32\chglutil.dll2011-08-09 22:40:53 94208 ----a-w- c:\program files\common files\system\ole db\msdaosp.dll2011-08-09 22:40:53 319488 ----a-w- c:\windows\system32\odbcjt32.dll2011-08-09 22:40:53 163840 ----a-w- c:\windows\system32\odbctrac.dll.==================== Find3M ====================.2011-06-30 01:51:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2011-06-11 02:37:19 2332672 ----a-w- c:\windows\system32\win32k.sys2011-06-02 05:59:55 169984 ----a-w- c:\windows\system32\winsrv.dll2011-06-02 05:58:05 290816 ----a-w- c:\windows\system32\KernelBase.dll2011-06-02 05:55:31 271872 ----a-w- c:\windows\system32\conhost.exe2011-06-02 03:45:49 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll2011-06-02 03:45:49 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2011-06-02 03:45:49 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll2011-06-02 03:45:49 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll2011-05-28 03:00:02 1638912 ----a-w- c:\windows\system32\mshtml.tlb2011-05-24 10:35:34 294912 ----a-w- c:\windows\system32\umpnpmgr.dll.============= FINISH: 21:15:09.48 =============== GMERGMER 1.0.15.15641 - http://www.gmer.netRootkit scan 2011-08-18 22:45:06Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdePort1 Hitachi_HTS723225L9A362 rev.FCDOC30FRunning: ovkilr1p.exe; Driver: C:\Users\Shane\AppData\Local\Temp\kwdirkow.sys---- Kernel code sections - GMER 1.0.15 ----.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 81E7E569 1 Byte [06].text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 81EA3092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}? C:\Users\Shane\AppData\Local\Temp\mbr.sys The system cannot find the file specified. !---- User code sections - GMER 1.0.15 ----.text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!UnhookWindowsHookEx 76E9CC7B 5 Bytes JMP 6EEB83AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!CallNextHookEx 76E9CC8F 5 Bytes JMP 6EE99D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!CreateWindowExW 76EA0E51 5 Bytes JMP 6EEA8187 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!SetWindowsHookExW 76EA210A 5 Bytes JMP 6EE5460B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!DialogBoxIndirectParamW 76EC4AA7 5 Bytes JMP 6EFD0240 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!DialogBoxParamW 76EC564A 5 Bytes JMP 6EDC4B87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!DialogBoxParamA 76EDCF6A 5 Bytes JMP 6EFD01DD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!DialogBoxIndirectParamA 76EDD29C 5 Bytes JMP 6EFD02A3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!MessageBoxIndirectA 76EEE8C9 5 Bytes JMP 6EFD0172 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!MessageBoxIndirectW 76EEE9C3 5 Bytes JMP 6EFD0107 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!MessageBoxExA 76EEEA29 5 Bytes JMP 6EFD00A5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] USER32.dll!MessageBoxExW 76EEEA4D 5 Bytes JMP 6EFD0043 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] ole32.dll!OleLoadFromStream 766C5BF6 5 Bytes JMP 6EFD059E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[276] ole32.dll!CoCreateInstance 7671590C 5 Bytes JMP 6EEA8C75 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Windows\system32\svchost.exe[848] USER32.dll!GetCursorPos 76E9C198 5 Bytes JMP 00BB000A .text C:\Windows\system32\svchost.exe[848] USER32.dll!GetForegroundWindow 76EA565D 5 Bytes JMP 00BD000A .text C:\Windows\system32\svchost.exe[848] USER32.dll!WindowFromPoint 76EC6D0C 5 Bytes JMP 00BC000A .text C:\Windows\system32\svchost.exe[848] ole32.dll!CoCreateInstance 7671590C 5 Bytes JMP 001A000A .text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!CreateWindowExW 76EA0E51 5 Bytes JMP 6EEA8187 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!DialogBoxIndirectParamW 76EC4AA7 5 Bytes JMP 6EFD0240 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!DialogBoxParamW 76EC564A 5 Bytes JMP 6EDC4B87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!DialogBoxParamA 76EDCF6A 5 Bytes JMP 6EFD01DD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!DialogBoxIndirectParamA 76EDD29C 5 Bytes JMP 6EFD02A3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!MessageBoxIndirectA 76EEE8C9 5 Bytes JMP 6EFD0172 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!MessageBoxIndirectW 76EEE9C3 5 Bytes JMP 6EFD0107 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!MessageBoxExA 76EEEA29 5 Bytes JMP 6EFD00A5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2012] USER32.dll!MessageBoxExW 76EEEA4D 5 Bytes JMP 6EFD0043 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!UnhookWindowsHookEx 76E9CC7B 5 Bytes JMP 6EEB83AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!CallNextHookEx 76E9CC8F 5 Bytes JMP 6EE99D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!CreateWindowExW 76EA0E51 5 Bytes JMP 6EEA8187 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!SetWindowsHookExW 76EA210A 5 Bytes JMP 6EE5460B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!DialogBoxIndirectParamW 76EC4AA7 5 Bytes JMP 6EFD0240 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!DialogBoxParamW 76EC564A 5 Bytes JMP 6EDC4B87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!DialogBoxParamA 76EDCF6A 5 Bytes JMP 6EFD01DD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!DialogBoxIndirectParamA 76EDD29C 5 Bytes JMP 6EFD02A3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!MessageBoxIndirectA 76EEE8C9 5 Bytes JMP 6EFD0172 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!MessageBoxIndirectW 76EEE9C3 5 Bytes JMP 6EFD0107 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!MessageBoxExA 76EEEA29 5 Bytes JMP 6EFD00A5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] USER32.dll!MessageBoxExW 76EEEA4D 5 Bytes JMP 6EFD0043 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] ole32.dll!OleLoadFromStream 766C5BF6 5 Bytes JMP 6EFD059E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2100] ole32.dll!CoCreateInstance 7671590C 5 Bytes JMP 6EEA8C75 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!UnhookWindowsHookEx 76E9CC7B 5 Bytes JMP 6EEB83AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!CallNextHookEx 76E9CC8F 5 Bytes JMP 6EE99D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!CreateWindowExW 76EA0E51 5 Bytes JMP 6EEA8187 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!SetWindowsHookExW 76EA210A 5 Bytes JMP 6EE5460B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamW 76EC4AA7 5 Bytes JMP 6EFD0240 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamW 76EC564A 5 Bytes JMP 6EDC4B87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamA 76EDCF6A 5 Bytes JMP 6EFD01DD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamA 76EDD29C 5 Bytes JMP 6EFD02A3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectA 76EEE8C9 5 Bytes JMP 6EFD0172 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectW 76EEE9C3 5 Bytes JMP 6EFD0107 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExA 76EEEA29 5 Bytes JMP 6EFD00A5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExW 76EEEA4D 5 Bytes JMP 6EFD0043 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] ole32.dll!OleLoadFromStream 766C5BF6 5 Bytes JMP 6EFD059E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3692] ole32.dll!CoCreateInstance 7671590C 5 Bytes JMP 6EEA8C75 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!UnhookWindowsHookEx 76E9CC7B 5 Bytes JMP 6EEB83AA C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!CallNextHookEx 76E9CC8F 5 Bytes JMP 6EE99D94 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!CreateWindowExW 76EA0E51 5 Bytes JMP 6EEA8187 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!SetWindowsHookExW 76EA210A 5 Bytes JMP 6EE5460B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxIndirectParamW 76EC4AA7 5 Bytes JMP 6EFD0240 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxParamW 76EC564A 5 Bytes JMP 6EDC4B87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxParamA 76EDCF6A 5 Bytes JMP 6EFD01DD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxIndirectParamA 76EDD29C 5 Bytes JMP 6EFD02A3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxIndirectA 76EEE8C9 5 Bytes JMP 6EFD0172 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxIndirectW 76EEE9C3 5 Bytes JMP 6EFD0107 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxExA 76EEEA29 5 Bytes JMP 6EFD00A5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxExW 76EEEA4D 5 Bytes JMP 6EFD0043 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] ole32.dll!OleLoadFromStream 766C5BF6 5 Bytes JMP 6EFD059E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3804] ole32.dll!CoCreateInstance 7671590C 5 Bytes JMP 6EEA8C75 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)---- Devices - GMER 1.0.15 ----AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)Device \Driver\ACPI_HAL \Device\0000004a halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)Device \FileSystem\fastfat \Fat 9438E130AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)---- Disk sectors - GMER 1.0.15 ----Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior---- Files - GMER 1.0.15 ----File C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@scorecardresearch[2].txt 108 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adnxs[5].txt 802 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pro-market[1].txt 761 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pubmatic[6].txt 2726 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@ad.yieldmanager[4].txt 4114 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@mathtag[5].txt 0 bytesFile C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@exelator[6].txt 2373 bytesFile C:\Windows\temp\fla8E77.tmp 1410198 bytes---- EOF - GMER 1.0.15 ---- Link to post Share on other sites More sharing options...
Elise Posted August 20, 2011 ID:467612 Share Posted August 20, 2011 Hello and It looks like you might have a rootkit on board.Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!Double-click on TDSSKiller.exe to run the tool for known TDSS variants.Vista/Windows 7 users right-click and select Run As Administrator.If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.Click the Start Scan button.Do not use the computer during the scanIf the scan completes with nothing found, click Close to exit.If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).Copy and paste the contents of that file in your next reply. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 21, 2011 Author ID:467966 Share Posted August 21, 2011 Ok, ran it - her is the log:2011/08/21 15:07:19.0561 0512 TDSS rootkit removing tool 2.5.16.0 Aug 19 2011 17:48:172011/08/21 15:07:19.0951 0512 ================================================================================2011/08/21 15:07:19.0951 0512 SystemInfo:2011/08/21 15:07:19.0951 0512 2011/08/21 15:07:19.0951 0512 OS Version: 6.1.7600 ServicePack: 0.02011/08/21 15:07:19.0951 0512 Product type: Workstation2011/08/21 15:07:19.0951 0512 ComputerName: SHANES-LAPTOP2011/08/21 15:07:19.0951 0512 UserName: Shane2011/08/21 15:07:19.0951 0512 Windows directory: C:\Windows2011/08/21 15:07:19.0951 0512 System windows directory: C:\Windows2011/08/21 15:07:19.0951 0512 Processor architecture: Intel x862011/08/21 15:07:19.0951 0512 Number of processors: 22011/08/21 15:07:19.0951 0512 Page size: 0x10002011/08/21 15:07:19.0951 0512 Boot type: Safe boot with network2011/08/21 15:07:19.0951 0512 ================================================================================2011/08/21 15:07:21.0105 0512 Initialize success2011/08/21 15:07:32.0571 1884 ================================================================================2011/08/21 15:07:32.0571 1884 Scan started2011/08/21 15:07:32.0571 1884 Mode: Manual; 2011/08/21 15:07:32.0571 1884 ================================================================================2011/08/21 15:07:33.0507 1884 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys2011/08/21 15:07:33.0585 1884 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys2011/08/21 15:07:33.0632 1884 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys2011/08/21 15:07:33.0850 1884 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys2011/08/21 15:07:33.0975 1884 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys2011/08/21 15:07:34.0053 1884 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys2011/08/21 15:07:34.0162 1884 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys2011/08/21 15:07:34.0209 1884 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys2011/08/21 15:07:34.0365 1884 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys2011/08/21 15:07:34.0412 1884 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys2011/08/21 15:07:34.0474 1884 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys2011/08/21 15:07:34.0521 1884 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys2011/08/21 15:07:34.0584 1884 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys2011/08/21 15:07:34.0693 1884 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys2011/08/21 15:07:34.0771 1884 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys2011/08/21 15:07:34.0786 1884 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys2011/08/21 15:07:34.0864 1884 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys2011/08/21 15:07:34.0927 1884 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys2011/08/21 15:07:35.0130 1884 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys2011/08/21 15:07:35.0161 1884 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys2011/08/21 15:07:35.0239 1884 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys2011/08/21 15:07:35.0270 1884 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys2011/08/21 15:07:35.0457 1884 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\system32\Drivers\avgldx86.sys2011/08/21 15:07:35.0535 1884 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\Windows\system32\Drivers\avgmfx86.sys2011/08/21 15:07:35.0598 1884 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\Windows\system32\Drivers\avgtdix.sys2011/08/21 15:07:35.0691 1884 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys2011/08/21 15:07:35.0847 1884 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys2011/08/21 15:07:35.0910 1884 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys2011/08/21 15:07:35.0988 1884 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys2011/08/21 15:07:36.0081 1884 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys2011/08/21 15:07:36.0190 1884 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys2011/08/21 15:07:36.0222 1884 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys2011/08/21 15:07:36.0268 1884 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys2011/08/21 15:07:36.0300 1884 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys2011/08/21 15:07:36.0331 1884 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys2011/08/21 15:07:36.0346 1884 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys2011/08/21 15:07:36.0393 1884 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys2011/08/21 15:07:36.0690 1884 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys2011/08/21 15:07:36.0768 1884 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys2011/08/21 15:07:36.0861 1884 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys2011/08/21 15:07:36.0908 1884 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys2011/08/21 15:07:37.0048 1884 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys2011/08/21 15:07:37.0080 1884 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys2011/08/21 15:07:37.0095 1884 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys2011/08/21 15:07:37.0189 1884 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys2011/08/21 15:07:37.0236 1884 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys2011/08/21 15:07:37.0298 1884 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys2011/08/21 15:07:37.0454 1884 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys2011/08/21 15:07:37.0610 1884 CtClsFlt (d7d3bb3a3df1193ec0fdbb24d4540fb5) C:\Windows\system32\DRIVERS\CtClsFlt.sys2011/08/21 15:07:37.0719 1884 ctxusbm (cb6ff7012bb5d59d7c12350db795ce1f) C:\Windows\system32\DRIVERS\ctxusbm.sys2011/08/21 15:07:37.0844 1884 dc3d (91c1736e77cff029302728b431d0eedb) C:\Windows\system32\DRIVERS\dc3d.sys2011/08/21 15:07:38.0016 1884 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys2011/08/21 15:07:38.0062 1884 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys2011/08/21 15:07:38.0187 1884 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys2011/08/21 15:07:38.0281 1884 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys2011/08/21 15:07:38.0359 1884 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys2011/08/21 15:07:38.0499 1884 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys2011/08/21 15:07:38.0733 1884 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys2011/08/21 15:07:38.0764 1884 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys2011/08/21 15:07:38.0827 1884 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys2011/08/21 15:07:39.0030 1884 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys2011/08/21 15:07:39.0186 1884 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys2011/08/21 15:07:39.0217 1884 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys2011/08/21 15:07:39.0264 1884 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys2011/08/21 15:07:39.0279 1884 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys2011/08/21 15:07:39.0326 1884 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys2011/08/21 15:07:39.0373 1884 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys2011/08/21 15:07:39.0404 1884 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys2011/08/21 15:07:39.0451 1884 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys2011/08/21 15:07:39.0607 1884 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys2011/08/21 15:07:39.0669 1884 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys2011/08/21 15:07:39.0716 1884 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys2011/08/21 15:07:39.0794 1884 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys2011/08/21 15:07:39.0950 1884 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys2011/08/21 15:07:39.0966 1884 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys2011/08/21 15:07:40.0012 1884 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys2011/08/21 15:07:40.0059 1884 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys2011/08/21 15:07:40.0137 1884 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys2011/08/21 15:07:40.0231 1884 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys2011/08/21 15:07:40.0387 1884 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys2011/08/21 15:07:40.0434 1884 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys2011/08/21 15:07:40.0590 1884 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys2011/08/21 15:07:40.0699 1884 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys2011/08/21 15:07:40.0777 1884 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys2011/08/21 15:07:40.0824 1884 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys2011/08/21 15:07:40.0917 1884 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys2011/08/21 15:07:41.0011 1884 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys2011/08/21 15:07:41.0026 1884 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys2011/08/21 15:07:41.0073 1884 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys2011/08/21 15:07:41.0136 1884 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys2011/08/21 15:07:41.0182 1884 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys2011/08/21 15:07:41.0214 1884 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys2011/08/21 15:07:41.0307 1884 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys2011/08/21 15:07:41.0401 1884 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys2011/08/21 15:07:41.0432 1884 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys2011/08/21 15:07:41.0494 1884 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys2011/08/21 15:07:41.0588 1884 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys2011/08/21 15:07:41.0682 1884 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys2011/08/21 15:07:41.0713 1884 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys2011/08/21 15:07:41.0760 1884 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys2011/08/21 15:07:41.0838 1884 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys2011/08/21 15:07:41.0931 1884 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys2011/08/21 15:07:42.0009 1884 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\Windows\system32\drivers\mbam.sys2011/08/21 15:07:42.0181 1884 MBAMSwissArmy (b18225739ed9caa83ba2df966e9f43e8) C:\Windows\system32\drivers\mbamswissarmy.sys2011/08/21 15:07:42.0259 1884 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys2011/08/21 15:07:42.0306 1884 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys2011/08/21 15:07:42.0384 1884 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys2011/08/21 15:07:42.0555 1884 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys2011/08/21 15:07:42.0633 1884 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys2011/08/21 15:07:42.0696 1884 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys2011/08/21 15:07:42.0758 1884 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys2011/08/21 15:07:42.0789 1884 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys2011/08/21 15:07:42.0898 1884 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys2011/08/21 15:07:42.0930 1884 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys2011/08/21 15:07:42.0976 1884 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys2011/08/21 15:07:43.0070 1884 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys2011/08/21 15:07:43.0132 1884 mrxsmb10 (c108952d3660375dcb716b222912e868) C:\Windows\system32\DRIVERS\mrxsmb10.sys2011/08/21 15:07:43.0257 1884 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys2011/08/21 15:07:43.0288 1884 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys2011/08/21 15:07:43.0320 1884 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys2011/08/21 15:07:43.0413 1884 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys2011/08/21 15:07:43.0476 1884 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys2011/08/21 15:07:43.0522 1884 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys2011/08/21 15:07:43.0710 1884 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys2011/08/21 15:07:43.0741 1884 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys2011/08/21 15:07:43.0772 1884 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys2011/08/21 15:07:43.0819 1884 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys2011/08/21 15:07:43.0850 1884 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys2011/08/21 15:07:44.0053 1884 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys2011/08/21 15:07:44.0068 1884 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys2011/08/21 15:07:44.0084 1884 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys2011/08/21 15:07:44.0193 1884 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys2011/08/21 15:07:44.0271 1884 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys2011/08/21 15:07:44.0412 1884 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys2011/08/21 15:07:44.0474 1884 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys2011/08/21 15:07:44.0552 1884 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys2011/08/21 15:07:44.0583 1884 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys2011/08/21 15:07:44.0614 1884 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys2011/08/21 15:07:44.0755 1884 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys2011/08/21 15:07:44.0802 1884 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys2011/08/21 15:07:45.0020 1884 netw5v32 (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS\netw5v32.sys2011/08/21 15:07:45.0207 1884 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys2011/08/21 15:07:45.0285 1884 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys2011/08/21 15:07:45.0316 1884 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys2011/08/21 15:07:45.0410 1884 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys2011/08/21 15:07:45.0519 1884 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys2011/08/21 15:07:45.0847 1884 nvlddmkm (73a70f1d89c942eedd99a3f10459b051) C:\Windows\system32\DRIVERS\nvlddmkm.sys2011/08/21 15:07:46.0159 1884 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys2011/08/21 15:07:46.0206 1884 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys2011/08/21 15:07:46.0299 1884 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys2011/08/21 15:07:46.0393 1884 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys2011/08/21 15:07:46.0518 1884 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys2011/08/21 15:07:46.0564 1884 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys2011/08/21 15:07:46.0580 1884 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys2011/08/21 15:07:46.0674 1884 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys2011/08/21 15:07:46.0783 1884 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys2011/08/21 15:07:46.0814 1884 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys2011/08/21 15:07:46.0830 1884 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys2011/08/21 15:07:46.0876 1884 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys2011/08/21 15:07:47.0142 1884 Point32 (60a044879c4fa76314494f5fddc43b93) C:\Windows\system32\DRIVERS\point32.sys2011/08/21 15:07:47.0266 1884 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys2011/08/21 15:07:47.0298 1884 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys2011/08/21 15:07:47.0376 1884 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys2011/08/21 15:07:47.0438 1884 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys2011/08/21 15:07:47.0532 1884 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys2011/08/21 15:07:47.0563 1884 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys2011/08/21 15:07:47.0641 1884 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys2011/08/21 15:07:47.0703 1884 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys2011/08/21 15:07:47.0750 1884 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys2011/08/21 15:07:47.0828 1884 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys2011/08/21 15:07:47.0844 1884 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys2011/08/21 15:07:47.0890 1884 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys2011/08/21 15:07:48.0000 1884 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys2011/08/21 15:07:48.0031 1884 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys2011/08/21 15:07:48.0093 1884 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys2011/08/21 15:07:48.0140 1884 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys2011/08/21 15:07:48.0187 1884 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys2011/08/21 15:07:48.0234 1884 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys2011/08/21 15:07:48.0296 1884 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys2011/08/21 15:07:48.0421 1884 rimmptsk (355aac141b214bef1dbc1483afd9bd50) C:\Windows\system32\DRIVERS\rimmptsk.sys2011/08/21 15:07:48.0452 1884 rimsptsk (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys2011/08/21 15:07:48.0468 1884 rismxdp (d231b577024aa324af13a42f3a807d10) C:\Windows\system32\DRIVERS\rixdptsk.sys2011/08/21 15:07:48.0561 1884 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys2011/08/21 15:07:48.0592 1884 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys2011/08/21 15:07:48.0686 1884 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys2011/08/21 15:07:48.0717 1884 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys2011/08/21 15:07:48.0904 1884 sdbus (7b48cff3a475fe849dea65ec4d35c425) C:\Windows\system32\DRIVERS\sdbus.sys2011/08/21 15:07:48.0998 1884 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2011/08/21 15:07:49.0060 1884 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys2011/08/21 15:07:49.0107 1884 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys2011/08/21 15:07:49.0138 1884 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys2011/08/21 15:07:49.0201 1884 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys2011/08/21 15:07:49.0294 1884 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys2011/08/21 15:07:49.0326 1884 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys2011/08/21 15:07:49.0341 1884 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys2011/08/21 15:07:49.0419 1884 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys2011/08/21 15:07:49.0482 1884 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys2011/08/21 15:07:49.0513 1884 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys2011/08/21 15:07:49.0653 1884 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys2011/08/21 15:07:49.0762 1884 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys2011/08/21 15:07:49.0903 1884 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys2011/08/21 15:07:50.0012 1884 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys2011/08/21 15:07:50.0152 1884 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS2011/08/21 15:07:50.0199 1884 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS2011/08/21 15:07:50.0262 1884 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS2011/08/21 15:07:50.0402 1884 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys2011/08/21 15:07:50.0527 1884 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys2011/08/21 15:07:50.0620 1884 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys2011/08/21 15:07:50.0745 1884 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys2011/08/21 15:07:50.0761 1884 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys2011/08/21 15:07:50.0823 1884 SynTP (451e8037e2eb6da6bdf0a66f65d1810b) C:\Windows\system32\DRIVERS\SynTP.sys2011/08/21 15:07:50.0979 1884 Tcpip (0158d5e9982e9d6a90dfc802f618e130) C:\Windows\system32\drivers\tcpip.sys2011/08/21 15:07:51.0120 1884 TCPIP6 (0158d5e9982e9d6a90dfc802f618e130) C:\Windows\system32\DRIVERS\tcpip.sys2011/08/21 15:07:51.0166 1884 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys2011/08/21 15:07:51.0229 1884 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys2011/08/21 15:07:51.0244 1884 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys2011/08/21 15:07:51.0276 1884 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys2011/08/21 15:07:51.0322 1884 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys2011/08/21 15:07:51.0400 1884 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys2011/08/21 15:07:51.0494 1884 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys2011/08/21 15:07:51.0588 1884 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys2011/08/21 15:07:51.0619 1884 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys2011/08/21 15:07:51.0681 1884 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys2011/08/21 15:07:51.0759 1884 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys2011/08/21 15:07:51.0837 1884 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys2011/08/21 15:07:52.0024 1884 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys2011/08/21 15:07:52.0134 1884 usbaudio (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys2011/08/21 15:07:52.0196 1884 usbccgp (c31ae588e403042632dc796cf09e30b0) C:\Windows\system32\DRIVERS\usbccgp.sys2011/08/21 15:07:52.0290 1884 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys2011/08/21 15:07:52.0383 1884 usbehci (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys2011/08/21 15:07:52.0461 1884 usbhub (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys2011/08/21 15:07:52.0508 1884 usbohci (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\drivers\usbohci.sys2011/08/21 15:07:52.0539 1884 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys2011/08/21 15:07:52.0602 1884 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\Windows\system32\DRIVERS\USBSTOR.SYS2011/08/21 15:07:52.0664 1884 usbuhci (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\DRIVERS\usbuhci.sys2011/08/21 15:07:52.0820 1884 usb_rndisx (d82f43d15fdaa666856c0190cb73e7c9) C:\Windows\system32\DRIVERS\usb8023x.sys2011/08/21 15:07:52.0914 1884 utddalc (e6d35f3aa51a65eb35c1f2340154a25e) C:\Windows\system32\drivers\tkvpnqr.sys2011/08/21 15:07:53.0007 1884 V0650Vid (d52dfef8e9c947369e46c24b4fa70e9a) C:\Windows\system32\DRIVERS\V0650Vid.sys2011/08/21 15:07:53.0070 1884 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys2011/08/21 15:07:53.0194 1884 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys2011/08/21 15:07:53.0241 1884 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys2011/08/21 15:07:53.0272 1884 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys2011/08/21 15:07:53.0335 1884 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys2011/08/21 15:07:53.0444 1884 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys2011/08/21 15:07:53.0506 1884 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys2011/08/21 15:07:53.0569 1884 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys2011/08/21 15:07:53.0600 1884 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys2011/08/21 15:07:53.0631 1884 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys2011/08/21 15:07:53.0662 1884 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys2011/08/21 15:07:53.0725 1884 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys2011/08/21 15:07:53.0818 1884 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys2011/08/21 15:07:53.0850 1884 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys2011/08/21 15:07:53.0912 1884 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys2011/08/21 15:07:53.0990 1884 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2011/08/21 15:07:54.0006 1884 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2011/08/21 15:07:54.0146 1884 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys2011/08/21 15:07:54.0193 1884 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys2011/08/21 15:07:54.0427 1884 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys2011/08/21 15:07:54.0458 1884 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys2011/08/21 15:07:54.0598 1884 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUSB.sys2011/08/21 15:07:54.0630 1884 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys2011/08/21 15:07:54.0708 1884 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys2011/08/21 15:07:54.0864 1884 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys2011/08/21 15:07:54.0895 1884 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys2011/08/21 15:07:54.0988 1884 xusb21 (c26c68bcbac1f33f890c226769759209) C:\Windows\system32\DRIVERS\xusb21.sys2011/08/21 15:07:55.0051 1884 MBR (0x1B8) (d8f98fa929a3ce2707b66f8b212f5858) \Device\Harddisk0\DR02011/08/21 15:07:55.0066 1884 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.a (0)2011/08/21 15:07:55.0098 1884 Boot (0x1200) (43407d2717bd19ae07d1d16086f48444) \Device\Harddisk0\DR0\Partition02011/08/21 15:07:55.0113 1884 ================================================================================2011/08/21 15:07:55.0113 1884 Scan finished2011/08/21 15:07:55.0113 1884 ================================================================================2011/08/21 15:07:55.0144 2480 Detected object count: 12011/08/21 15:07:55.0144 2480 Actual detected object count: 12011/08/21 15:08:13.0849 2480 \Device\Harddisk0\DR0 (Rootkit.Boot.Pihar.a) - will be cured after reboot2011/08/21 15:08:13.0849 2480 \Device\Harddisk0\DR0 - ok2011/08/21 15:08:13.0849 2480 Rootkit.Boot.Pihar.a(\Device\Harddisk0\DR0) - User select action: Cure 2011/08/21 15:08:21.0072 1468 Deinitialize success Link to post Share on other sites More sharing options...
sunnyd53 Posted August 21, 2011 Author ID:467982 Share Posted August 21, 2011 Please stop posting on peoples logs - the modirators look at the last post and post count when they offer assistance. Wait patiently and they will deal with your post. Link to post Share on other sites More sharing options...
Elise Posted August 21, 2011 ID:467990 Share Posted August 21, 2011 Hello again, that took care of the rootkit. Now lets see what else is hiding there. COMBOFIX---------------Please download ComboFix from one of these locations:BleepingcomputerForoSpywareDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)Double click on Combofix.exe and follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 21, 2011 Author ID:468004 Share Posted August 21, 2011 ComboFix 11-08-21.01 - Shane 08/21/2011 17:02:11.3.2 - x86 NETWORKMicrosoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3582.3007 [GMT -4:00]Running from: c:\users\Shane\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Public\Desktop\Security Protection.lnk..((((((((((((((((((((((((( Files Created from 2011-07-21 to 2011-08-21 )))))))))))))))))))))))))))))))..2011-08-21 21:08 . 2011-08-21 21:08 -------- d-----w- c:\users\Shane\AppData\Local\temp2011-08-21 21:08 . 2011-08-21 21:08 -------- d-----w- c:\users\Default\AppData\Local\temp2011-08-19 10:55 . 2011-08-19 14:01 -------- d-----w- c:\programdata\dH01602LlDmA016022011-08-19 02:35 . 2011-08-19 02:35 -------- d-----w- c:\users\Shane\AppData\Local\ElevatedDiagnostics2011-08-18 01:26 . 2011-08-18 01:26 50176 ---ha-w- c:\windows\system32\fingdate.dll2011-08-18 01:25 . 2011-08-18 02:18 -------- d-----w- c:\programdata\gA01602KhDgC016022011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\users\Shane\AppData\Roaming\Malwarebytes2011-08-18 00:35 . 2011-07-08 11:55 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\programdata\Malwarebytes2011-08-18 00:35 . 2011-08-18 00:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-08-18 00:35 . 2011-07-08 11:55 22712 ----a-w- c:\windows\system32\drivers\mbam.sys2011-08-17 01:42 . 2011-06-15 09:04 86016 ----a-w- c:\windows\system32\odbccu32.dll2011-08-17 01:42 . 2011-06-15 09:04 81920 ----a-w- c:\windows\system32\odbccr32.dll2011-08-17 01:42 . 2011-06-15 09:04 122880 ----a-w- c:\windows\system32\odbccp32.dll2011-08-17 01:21 . 2011-08-17 23:54 53248 ---ha-w- c:\windows\system32\chglutil.dll2011-08-17 01:09 . 2011-08-17 01:09 -------- d-----w- c:\windows\Sun2011-08-09 22:40 . 2011-06-15 09:04 319488 ----a-w- c:\windows\system32\odbcjt32.dll2011-08-09 22:40 . 2011-06-15 09:04 163840 ----a-w- c:\windows\system32\odbctrac.dll2011-08-09 22:40 . 2011-06-15 09:04 94208 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-06-30 01:51 . 2011-06-24 04:48 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2011-06-11 02:37 . 2011-07-13 01:54 2332672 ----a-w- c:\windows\system32\win32k.sys2011-06-02 05:59 . 2011-07-13 01:54 169984 ----a-w- c:\windows\system32\winsrv.dll2011-06-02 05:58 . 2011-07-13 01:54 290816 ----a-w- c:\windows\system32\KernelBase.dll2011-06-02 05:55 . 2011-07-13 01:54 271872 ----a-w- c:\windows\system32\conhost.exe2011-06-02 05:45 . 2011-07-13 01:54 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll2011-06-02 05:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll2011-06-02 03:45 . 2011-07-13 01:54 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll2011-05-28 03:00 . 2011-06-16 23:33 1638912 ----a-w- c:\windows\system32\mshtml.tlb2011-05-24 10:35 . 2011-06-28 22:07 294912 ----a-w- c:\windows\system32\umpnpmgr.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]2011-03-18 12:11 2471240 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2011-03-14 2071904]"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 1797008]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]"V0650Mon.exe"="c:\windows\V0650Mon.exe" [2010-02-23 28672]"Rocket Live! Central 2"="c:\program files\Rocketfish HD Webcam\Live! Central\RFLVCentral2.exe" [2010-02-24 430247]"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2009-09-13 103768]"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-01-08 288872]"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-08 1047656]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-08 449584].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"GrpConv"="grpconv -o" [X].c:\users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-3-10 576000].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 5.0 HD Edition.lnk - c:\program files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe [2010-12-25 172544].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\srv1A8]@="service".R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-09-25 216400]R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2009-09-08 65584]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-09-25 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-09-25 308136]R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-08 366640]R2 MicrosoftDynamicsNavServer;Microsoft Dynamics NAV Server;c:\program files\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [2009-08-14 141184]R2 srv1A8;srv1A8;c:\windows\system32\svchost.exe [2009-07-14 20992]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-08 378984]R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2011-03-18 947528]R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-03-26 144640]R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2010-07-07 44432]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-08 22712]R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]R3 MicrosoftDynamicsNavWS;Microsoft Dynamics NAV Business Web Services;c:\program files\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [2009-08-14 141184]R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]R3 V0650Vid;Rocketfish HD Webcam Driver;c:\windows\system32\DRIVERS\V0650Vid.sys [2010-03-31 322176]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-25 1343400]S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2011-05-06 243152]S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]..[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]WindowsMobile REG_MULTI_SZ wcescomm rapimgrLocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcssrv1A8..------- Supplementary Scan -------.uInternet Settings,ProxyOverride = *.localIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105TCP: DhcpNameServer = 209.18.47.61 209.18.47.62Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll..[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv1A8]"servicedll"="\\?\globalroot\Device\HarddiskVolume2\Windows\Temp\srv1A8.tmp".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2011-08-21 17:10:03ComboFix-quarantined-files.txt 2011-08-21 21:10ComboFix2.txt 2011-08-19 00:16ComboFix3.txt 2011-08-18 23:53.Pre-Run: 134,453,186,560 bytes freePost-Run: 134,462,140,416 bytes free.- - End Of File - - CB543F8FD12F0D2245EF86DE7A2D5624**apparently it put it back on my desktop while I wasn't looking! LOL. Link to post Share on other sites More sharing options...
Elise Posted August 22, 2011 ID:468138 Share Posted August 22, 2011 Hi, that is looking good! Do you have any problem left?Please rerun DDS and post me attach.txt (it will be minimized when the scan is finished). Link to post Share on other sites More sharing options...
sunnyd53 Posted August 22, 2011 Author ID:468177 Share Posted August 22, 2011 2011/08/22 06:06:32.0011 2124 TDSS rootkit removing tool 2.5.16.0 Aug 19 2011 17:48:172011/08/22 06:06:32.0323 2124 ================================================================================2011/08/22 06:06:32.0323 2124 SystemInfo:2011/08/22 06:06:32.0323 2124 2011/08/22 06:06:32.0323 2124 OS Version: 6.1.7600 ServicePack: 0.02011/08/22 06:06:32.0323 2124 Product type: Workstation2011/08/22 06:06:32.0323 2124 ComputerName: SHANES-LAPTOP2011/08/22 06:06:32.0323 2124 UserName: Shane2011/08/22 06:06:32.0323 2124 Windows directory: C:\Windows2011/08/22 06:06:32.0323 2124 System windows directory: C:\Windows2011/08/22 06:06:32.0323 2124 Processor architecture: Intel x862011/08/22 06:06:32.0323 2124 Number of processors: 22011/08/22 06:06:32.0323 2124 Page size: 0x10002011/08/22 06:06:32.0323 2124 Boot type: Safe boot with network2011/08/22 06:06:32.0323 2124 ================================================================================2011/08/22 06:06:33.0415 2124 Initialize success2011/08/22 06:06:37.0284 2332 ================================================================================2011/08/22 06:06:37.0299 2332 Scan started2011/08/22 06:06:37.0299 2332 Mode: Manual; 2011/08/22 06:06:37.0299 2332 ================================================================================2011/08/22 06:06:38.0095 2332 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys2011/08/22 06:06:38.0173 2332 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys2011/08/22 06:06:38.0235 2332 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys2011/08/22 06:06:38.0313 2332 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys2011/08/22 06:06:38.0438 2332 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys2011/08/22 06:06:38.0501 2332 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys2011/08/22 06:06:38.0610 2332 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys2011/08/22 06:06:38.0641 2332 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys2011/08/22 06:06:38.0781 2332 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys2011/08/22 06:06:38.0859 2332 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys2011/08/22 06:06:38.0906 2332 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys2011/08/22 06:06:38.0953 2332 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys2011/08/22 06:06:39.0015 2332 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys2011/08/22 06:06:39.0093 2332 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys2011/08/22 06:06:39.0171 2332 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys2011/08/22 06:06:39.0218 2332 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys2011/08/22 06:06:39.0296 2332 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys2011/08/22 06:06:39.0437 2332 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys2011/08/22 06:06:39.0577 2332 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys2011/08/22 06:06:39.0608 2332 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys2011/08/22 06:06:39.0749 2332 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys2011/08/22 06:06:39.0764 2332 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys2011/08/22 06:06:39.0889 2332 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\Windows\system32\Drivers\avgldx86.sys2011/08/22 06:06:40.0045 2332 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\Windows\system32\Drivers\avgmfx86.sys2011/08/22 06:06:40.0092 2332 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\Windows\system32\Drivers\avgtdix.sys2011/08/22 06:06:40.0201 2332 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys2011/08/22 06:06:40.0341 2332 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys2011/08/22 06:06:40.0404 2332 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys2011/08/22 06:06:40.0529 2332 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys2011/08/22 06:06:40.0607 2332 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys2011/08/22 06:06:40.0700 2332 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys2011/08/22 06:06:40.0747 2332 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys2011/08/22 06:06:40.0778 2332 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys2011/08/22 06:06:40.0825 2332 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys2011/08/22 06:06:40.0856 2332 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys2011/08/22 06:06:40.0872 2332 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys2011/08/22 06:06:40.0903 2332 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys2011/08/22 06:06:41.0199 2332 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys2011/08/22 06:06:41.0309 2332 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys2011/08/22 06:06:41.0371 2332 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys2011/08/22 06:06:41.0418 2332 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys2011/08/22 06:06:41.0527 2332 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys2011/08/22 06:06:41.0574 2332 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys2011/08/22 06:06:41.0605 2332 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys2011/08/22 06:06:41.0667 2332 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys2011/08/22 06:06:41.0745 2332 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys2011/08/22 06:06:41.0823 2332 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys2011/08/22 06:06:41.0979 2332 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys2011/08/22 06:06:42.0245 2332 CtClsFlt (d7d3bb3a3df1193ec0fdbb24d4540fb5) C:\Windows\system32\DRIVERS\CtClsFlt.sys2011/08/22 06:06:42.0385 2332 ctxusbm (cb6ff7012bb5d59d7c12350db795ce1f) C:\Windows\system32\DRIVERS\ctxusbm.sys2011/08/22 06:06:42.0479 2332 dc3d (91c1736e77cff029302728b431d0eedb) C:\Windows\system32\DRIVERS\dc3d.sys2011/08/22 06:06:42.0588 2332 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys2011/08/22 06:06:42.0681 2332 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys2011/08/22 06:06:42.0837 2332 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys2011/08/22 06:06:42.0931 2332 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys2011/08/22 06:06:43.0025 2332 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys2011/08/22 06:06:43.0259 2332 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys2011/08/22 06:06:43.0477 2332 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys2011/08/22 06:06:43.0539 2332 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys2011/08/22 06:06:43.0617 2332 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys2011/08/22 06:06:43.0742 2332 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys2011/08/22 06:06:43.0805 2332 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys2011/08/22 06:06:43.0851 2332 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys2011/08/22 06:06:43.0883 2332 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys2011/08/22 06:06:43.0914 2332 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys2011/08/22 06:06:44.0054 2332 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys2011/08/22 06:06:44.0101 2332 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys2011/08/22 06:06:44.0163 2332 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys2011/08/22 06:06:44.0210 2332 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys2011/08/22 06:06:44.0273 2332 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys2011/08/22 06:06:44.0397 2332 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys2011/08/22 06:06:44.0444 2332 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys2011/08/22 06:06:44.0538 2332 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys2011/08/22 06:06:44.0569 2332 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys2011/08/22 06:06:44.0600 2332 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys2011/08/22 06:06:44.0694 2332 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys2011/08/22 06:06:44.0756 2332 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys2011/08/22 06:06:44.0834 2332 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys2011/08/22 06:06:44.0928 2332 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys2011/08/22 06:06:45.0053 2332 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys2011/08/22 06:06:45.0099 2332 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys2011/08/22 06:06:45.0240 2332 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys2011/08/22 06:06:45.0333 2332 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys2011/08/22 06:06:45.0427 2332 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys2011/08/22 06:06:45.0474 2332 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys2011/08/22 06:06:45.0630 2332 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys2011/08/22 06:06:45.0661 2332 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys2011/08/22 06:06:45.0692 2332 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys2011/08/22 06:06:45.0723 2332 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys2011/08/22 06:06:45.0801 2332 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys2011/08/22 06:06:45.0848 2332 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys2011/08/22 06:06:45.0957 2332 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys2011/08/22 06:06:46.0020 2332 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys2011/08/22 06:06:46.0082 2332 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys2011/08/22 06:06:46.0129 2332 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys2011/08/22 06:06:46.0176 2332 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys2011/08/22 06:06:46.0347 2332 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys2011/08/22 06:06:46.0457 2332 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys2011/08/22 06:06:46.0488 2332 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys2011/08/22 06:06:46.0519 2332 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys2011/08/22 06:06:46.0550 2332 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys2011/08/22 06:06:46.0628 2332 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys2011/08/22 06:06:46.0784 2332 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\Windows\system32\drivers\mbam.sys2011/08/22 06:06:46.0878 2332 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys2011/08/22 06:06:46.0925 2332 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys2011/08/22 06:06:47.0003 2332 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys2011/08/22 06:06:47.0159 2332 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys2011/08/22 06:06:47.0252 2332 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys2011/08/22 06:06:47.0283 2332 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys2011/08/22 06:06:47.0315 2332 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys2011/08/22 06:06:47.0377 2332 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys2011/08/22 06:06:47.0408 2332 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys2011/08/22 06:06:47.0502 2332 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys2011/08/22 06:06:47.0533 2332 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys2011/08/22 06:06:47.0595 2332 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys2011/08/22 06:06:47.0673 2332 mrxsmb10 (c108952d3660375dcb716b222912e868) C:\Windows\system32\DRIVERS\mrxsmb10.sys2011/08/22 06:06:47.0736 2332 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys2011/08/22 06:06:47.0783 2332 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys2011/08/22 06:06:47.0876 2332 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys2011/08/22 06:06:47.0954 2332 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys2011/08/22 06:06:47.0985 2332 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys2011/08/22 06:06:48.0048 2332 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys2011/08/22 06:06:48.0141 2332 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys2011/08/22 06:06:48.0219 2332 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys2011/08/22 06:06:48.0251 2332 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys2011/08/22 06:06:48.0282 2332 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys2011/08/22 06:06:48.0329 2332 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys2011/08/22 06:06:48.0438 2332 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys2011/08/22 06:06:48.0516 2332 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys2011/08/22 06:06:48.0563 2332 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys2011/08/22 06:06:48.0641 2332 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys2011/08/22 06:06:48.0719 2332 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys2011/08/22 06:06:48.0859 2332 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys2011/08/22 06:06:48.0875 2332 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys2011/08/22 06:06:48.0953 2332 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys2011/08/22 06:06:48.0984 2332 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys2011/08/22 06:06:49.0015 2332 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys2011/08/22 06:06:49.0202 2332 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys2011/08/22 06:06:49.0233 2332 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys2011/08/22 06:06:49.0436 2332 netw5v32 (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS\netw5v32.sys2011/08/22 06:06:49.0592 2332 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys2011/08/22 06:06:49.0670 2332 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys2011/08/22 06:06:49.0701 2332 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys2011/08/22 06:06:49.0795 2332 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys2011/08/22 06:06:49.0920 2332 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys2011/08/22 06:06:50.0232 2332 nvlddmkm (73a70f1d89c942eedd99a3f10459b051) C:\Windows\system32\DRIVERS\nvlddmkm.sys2011/08/22 06:06:50.0513 2332 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys2011/08/22 06:06:50.0544 2332 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys2011/08/22 06:06:50.0622 2332 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys2011/08/22 06:06:50.0653 2332 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys2011/08/22 06:06:50.0809 2332 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys2011/08/22 06:06:50.0840 2332 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys2011/08/22 06:06:50.0871 2332 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys2011/08/22 06:06:50.0918 2332 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys2011/08/22 06:06:50.0949 2332 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys2011/08/22 06:06:50.0996 2332 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys2011/08/22 06:06:51.0105 2332 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys2011/08/22 06:06:51.0152 2332 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys2011/08/22 06:06:51.0417 2332 Point32 (60a044879c4fa76314494f5fddc43b93) C:\Windows\system32\DRIVERS\point32.sys2011/08/22 06:06:51.0495 2332 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys2011/08/22 06:06:51.0527 2332 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys2011/08/22 06:06:51.0589 2332 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys2011/08/22 06:06:51.0761 2332 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys2011/08/22 06:06:51.0807 2332 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys2011/08/22 06:06:51.0917 2332 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys2011/08/22 06:06:51.0979 2332 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys2011/08/22 06:06:52.0026 2332 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys2011/08/22 06:06:52.0073 2332 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys2011/08/22 06:06:52.0135 2332 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys2011/08/22 06:06:52.0291 2332 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys2011/08/22 06:06:52.0556 2332 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys2011/08/22 06:06:52.0619 2332 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys2011/08/22 06:06:52.0650 2332 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys2011/08/22 06:06:52.0712 2332 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys2011/08/22 06:06:52.0853 2332 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys2011/08/22 06:06:52.0884 2332 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys2011/08/22 06:06:52.0931 2332 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys2011/08/22 06:06:53.0009 2332 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys2011/08/22 06:06:53.0071 2332 rimmptsk (355aac141b214bef1dbc1483afd9bd50) C:\Windows\system32\DRIVERS\rimmptsk.sys2011/08/22 06:06:53.0118 2332 rimsptsk (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys2011/08/22 06:06:53.0149 2332 rismxdp (d231b577024aa324af13a42f3a807d10) C:\Windows\system32\DRIVERS\rixdptsk.sys2011/08/22 06:06:53.0305 2332 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys2011/08/22 06:06:53.0336 2332 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys2011/08/22 06:06:53.0430 2332 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys2011/08/22 06:06:53.0461 2332 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys2011/08/22 06:06:53.0586 2332 sdbus (7b48cff3a475fe849dea65ec4d35c425) C:\Windows\system32\DRIVERS\sdbus.sys2011/08/22 06:06:53.0711 2332 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2011/08/22 06:06:53.0804 2332 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys2011/08/22 06:06:53.0835 2332 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys2011/08/22 06:06:53.0882 2332 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys2011/08/22 06:06:53.0960 2332 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys2011/08/22 06:06:54.0007 2332 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys2011/08/22 06:06:54.0069 2332 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys2011/08/22 06:06:54.0116 2332 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys2011/08/22 06:06:54.0163 2332 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys2011/08/22 06:06:54.0241 2332 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys2011/08/22 06:06:54.0272 2332 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys2011/08/22 06:06:54.0319 2332 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys2011/08/22 06:06:54.0444 2332 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys2011/08/22 06:06:54.0600 2332 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys2011/08/22 06:06:54.0709 2332 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys2011/08/22 06:06:54.0818 2332 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS2011/08/22 06:06:54.0865 2332 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS2011/08/22 06:06:54.0943 2332 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS2011/08/22 06:06:55.0052 2332 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys2011/08/22 06:06:55.0177 2332 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys2011/08/22 06:06:55.0255 2332 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys2011/08/22 06:06:55.0333 2332 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys2011/08/22 06:06:55.0364 2332 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys2011/08/22 06:06:55.0458 2332 SynTP (451e8037e2eb6da6bdf0a66f65d1810b) C:\Windows\system32\DRIVERS\SynTP.sys2011/08/22 06:06:55.0614 2332 Tcpip (0158d5e9982e9d6a90dfc802f618e130) C:\Windows\system32\drivers\tcpip.sys2011/08/22 06:06:55.0739 2332 TCPIP6 (0158d5e9982e9d6a90dfc802f618e130) C:\Windows\system32\DRIVERS\tcpip.sys2011/08/22 06:06:55.0801 2332 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys2011/08/22 06:06:55.0863 2332 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys2011/08/22 06:06:55.0879 2332 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys2011/08/22 06:06:55.0926 2332 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys2011/08/22 06:06:55.0941 2332 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys2011/08/22 06:06:56.0066 2332 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys2011/08/22 06:06:56.0175 2332 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys2011/08/22 06:06:56.0207 2332 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys2011/08/22 06:06:56.0285 2332 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys2011/08/22 06:06:56.0378 2332 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys2011/08/22 06:06:56.0409 2332 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys2011/08/22 06:06:56.0441 2332 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys2011/08/22 06:06:56.0581 2332 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\Windows\system32\Drivers\usbaapl.sys2011/08/22 06:06:56.0721 2332 usbaudio (2436a42aab4ad48a9b714e5b0f344627) C:\Windows\system32\drivers\usbaudio.sys2011/08/22 06:06:56.0784 2332 usbccgp (c31ae588e403042632dc796cf09e30b0) C:\Windows\system32\DRIVERS\usbccgp.sys2011/08/22 06:06:56.0831 2332 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys2011/08/22 06:06:56.0909 2332 usbehci (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys2011/08/22 06:06:56.0940 2332 usbhub (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys2011/08/22 06:06:57.0002 2332 usbohci (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\drivers\usbohci.sys2011/08/22 06:06:57.0033 2332 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys2011/08/22 06:06:57.0080 2332 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\Windows\system32\DRIVERS\USBSTOR.SYS2011/08/22 06:06:57.0158 2332 usbuhci (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\DRIVERS\usbuhci.sys2011/08/22 06:06:57.0299 2332 usb_rndisx (d82f43d15fdaa666856c0190cb73e7c9) C:\Windows\system32\DRIVERS\usb8023x.sys2011/08/22 06:06:57.0423 2332 V0650Vid (d52dfef8e9c947369e46c24b4fa70e9a) C:\Windows\system32\DRIVERS\V0650Vid.sys2011/08/22 06:06:57.0486 2332 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys2011/08/22 06:06:57.0548 2332 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys2011/08/22 06:06:57.0673 2332 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys2011/08/22 06:06:57.0704 2332 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys2011/08/22 06:06:57.0751 2332 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys2011/08/22 06:06:57.0798 2332 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys2011/08/22 06:06:57.0813 2332 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys2011/08/22 06:06:57.0860 2332 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys2011/08/22 06:06:57.0938 2332 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys2011/08/22 06:06:57.0954 2332 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys2011/08/22 06:06:58.0032 2332 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys2011/08/22 06:06:58.0079 2332 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys2011/08/22 06:06:58.0157 2332 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys2011/08/22 06:06:58.0188 2332 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys2011/08/22 06:06:58.0297 2332 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys2011/08/22 06:06:58.0391 2332 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2011/08/22 06:06:58.0422 2332 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys2011/08/22 06:06:58.0531 2332 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys2011/08/22 06:06:58.0562 2332 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys2011/08/22 06:06:58.0734 2332 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys2011/08/22 06:06:58.0796 2332 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys2011/08/22 06:06:58.0937 2332 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUSB.sys2011/08/22 06:06:58.0952 2332 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys2011/08/22 06:06:59.0046 2332 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys2011/08/22 06:06:59.0139 2332 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys2011/08/22 06:06:59.0217 2332 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys2011/08/22 06:06:59.0327 2332 xusb21 (c26c68bcbac1f33f890c226769759209) C:\Windows\system32\DRIVERS\xusb21.sys2011/08/22 06:06:59.0420 2332 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR02011/08/22 06:06:59.0436 2332 Boot (0x1200) (43407d2717bd19ae07d1d16086f48444) \Device\Harddisk0\DR0\Partition02011/08/22 06:06:59.0451 2332 ================================================================================2011/08/22 06:06:59.0451 2332 Scan finished2011/08/22 06:06:59.0451 2332 ================================================================================2011/08/22 06:06:59.0498 1896 Detected object count: 02011/08/22 06:06:59.0498 1896 Actual detected object count: 0****Looks good. Let me reboot not in safe mode and see what happens. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 22, 2011 Author ID:468183 Share Posted August 22, 2011 Ok, Malwarebytes full scan is taking longer than I thought outside of Safe Mode. No more Blue Screen or Google Redirects or blocked IP's, so that is good. My full scan is still running. 2 times during this scan AVG detected trojans:"Trojan horse BackDoor.Generic14.YFX";"c:\Windows\System32\chglutil.dll";"Moved to Virus Vault";"8/22/2011, 6:22:44 AM";"file";"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe""Trojan horse BackDoor.Generic14.YGO";"c:\Windows\System32\fingdate.dll";"Moved to Virus Vault";"8/22/2011, 7:24:27 AM";"file";"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe"I'm thinking I should have AVG off while I do this scan... Anyway, I have to head to work. Can you give me a list of things to do in normal mode? (Not Safe Mode) to ensure I am good to go? I won't be home until 10pm EST. Link to post Share on other sites More sharing options...
Elise Posted August 22, 2011 ID:468253 Share Posted August 22, 2011 Please rerun DDS and post me attach.txt (it will be minimized when the scan is finished). You posted a tdsskiller log, not a dds log. Please post me also the MBAM results. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 23, 2011 Author ID:468480 Share Posted August 23, 2011 MBAM Log Malwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7534Windows 6.1.7600Internet Explorer 8.0.7600.163858/22/2011 7:52:08 AMmbam-log-2011-08-22 (07-52-08).txtScan type: Full scan (C:\|)Objects scanned: 296414Time elapsed: 1 hour(s), 13 minute(s), 19 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
sunnyd53 Posted August 23, 2011 Author ID:468481 Share Posted August 23, 2011 .DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.7600.16385Run by Shane at 21:54:29 on 2011-08-22Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3582.2326 [GMT -4:00].AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\NVIDIA Corporation\Display\NvXDSync.exeC:\Windows\system32\nvvsvc.exeC:\Windows\system32\WUDFHost.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\taskhost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\AVG\AVG9\avgwdsvc.exeC:\Windows\System32\bgsvcgen.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exec:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\AVG\AVG9\avgtray.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Windows\V0650Mon.exeC:\Program Files\Citrix\ICA Client\concentr.exeC:\Windows\WindowsMobile\wmdc.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\Citrix\ICA Client\wfcrun32.exeC:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exeC:\Program Files\MagicDisc\MagicDisc.exeC:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeC:\Program Files\AVG\AVG9\avgnsx.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\AVG\AVG9\avgemc.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\Program Files\iPod\bin\iPodService.exeC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\svchost.exe -k WindowsMobileC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\conhost.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uInternet Settings,ProxyOverride = *.localmURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dllBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office14\GROOVEEX.DLLBHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLLBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllTB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dllmRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exemRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServicesmRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [V0650Mon.exe] c:\windows\V0650Mon.exemRun: [Rocket Live! Central 2] "c:\program files\rocketfish hd webcam\live! central\RFLVCentral2.exe" /mode2mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startupmRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exemRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,StartmRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquietmRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscriptmRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraymRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"StartupFolder: c:\users\shane\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\photof~1.lnk - c:\program files\common files\panasonic\photofunstudio autostart\AutoStartupService.exemPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dllIE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dllIE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 209.18.47.61 209.18.47.62TCP: Interfaces\{09E9C12D-B854-4F27-BBA9-0425849B4188} : DhcpNameServer = 209.18.47.61 209.18.47.62TCP: Interfaces\{C1EEF202-5EBC-4682-A820-E45D6359DE9B} : DhcpNameServer = 10.1.0.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLLHandler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dllHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLAppInit_DLLs: c:\windows\system32\avgrsstx.dllSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office14\GROOVEEX.DLL.============= SERVICES / DRIVERS ===============.R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-24 216400]R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-24 29584]R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-24 243152]R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2009-9-8 65584]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-9-24 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-9-24 308136]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-17 366640]R2 MicrosoftDynamicsNavServer;Microsoft Dynamics NAV Server;c:\program files\microsoft dynamics nav\60\service\Microsoft.Dynamics.Nav.Server.exe [2009-8-14 141184]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2011-1-7 378984]R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-17 22712]R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 srv1A8;srv1A8;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 947528]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2011-1-20 144640]S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208]S3 MicrosoftDynamicsNavWS;Microsoft Dynamics NAV Business Web Services;c:\program files\microsoft dynamics nav\60\service\Microsoft.Dynamics.Nav.Server.exe [2009-8-14 141184]S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]S3 V0650Vid;Rocketfish HD Webcam Driver;c:\windows\system32\drivers\V0650Vid.sys [2011-1-16 322176]S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-9-25 1343400].=============== Created Last 30 ================.2011-08-22 10:20:06 -------- d-----w- c:\windows\system32\SPReview2011-08-22 10:18:01 -------- d-----w- c:\windows\system32\EventProviders2011-08-21 21:10:08 -------- d-sh--w- C:\$RECYCLE.BIN2011-08-21 21:10:05 -------- d-----w- c:\users\shane\appdata\local\temp2011-08-19 10:55:21 -------- d-----w- c:\programdata\dH01602LlDmA016022011-08-19 02:35:54 -------- d-----w- c:\users\shane\appdata\local\ElevatedDiagnostics2011-08-18 23:46:12 98816 ----a-w- c:\windows\sed.exe2011-08-18 23:46:12 518144 ----a-w- c:\windows\SWREG.exe2011-08-18 23:46:12 256000 ----a-w- c:\windows\PEV.exe2011-08-18 23:46:12 208896 ----a-w- c:\windows\MBR.exe2011-08-18 01:25:37 -------- d-----w- c:\programdata\gA01602KhDgC016022011-08-18 00:35:52 -------- d-----w- c:\users\shane\appdata\roaming\Malwarebytes2011-08-18 00:35:47 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-08-18 00:35:46 -------- d-----w- c:\programdata\Malwarebytes2011-08-18 00:35:43 22712 ----a-w- c:\windows\system32\drivers\mbam.sys2011-08-18 00:35:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-08-17 01:42:58 86016 ----a-w- c:\windows\system32\odbccu32.dll2011-08-17 01:42:58 81920 ----a-w- c:\windows\system32\odbccr32.dll2011-08-17 01:42:58 122880 ----a-w- c:\windows\system32\odbccp32.dll2011-08-09 22:40:53 94208 ----a-w- c:\program files\common files\system\ole db\msdaosp.dll2011-08-09 22:40:53 319488 ----a-w- c:\windows\system32\odbcjt32.dll2011-08-09 22:40:53 163840 ----a-w- c:\windows\system32\odbctrac.dll.==================== Find3M ====================.2011-06-30 01:51:58 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2011-06-11 02:37:19 2332672 ----a-w- c:\windows\system32\win32k.sys2011-06-02 05:59:55 169984 ----a-w- c:\windows\system32\winsrv.dll2011-06-02 05:58:05 290816 ----a-w- c:\windows\system32\KernelBase.dll2011-06-02 05:55:31 271872 ----a-w- c:\windows\system32\conhost.exe2011-06-02 03:45:49 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll2011-06-02 03:45:49 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2011-06-02 03:45:49 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll2011-06-02 03:45:49 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll2011-05-28 03:00:02 1638912 ----a-w- c:\windows\system32\mshtml.tlb.============= FINISH: 21:55:01.20 =============== Link to post Share on other sites More sharing options...
Elise Posted August 23, 2011 ID:468577 Share Posted August 23, 2011 Please rerun DDS and post me attach.txt (it will be minimized when the scan is finished). Sorry, but this is DDS.txt, I need to see attach.txt, which will be minimized in the taskbar when DDS finishes scanning. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 23, 2011 Author ID:468610 Share Posted August 23, 2011 Ok - I will post this when I get home, around 6:30PM EST. Link to post Share on other sites More sharing options...
Elise Posted August 23, 2011 ID:468622 Share Posted August 23, 2011 No problem, take your time! Link to post Share on other sites More sharing options...
sunnyd53 Posted August 23, 2011 Author ID:468791 Share Posted August 23, 2011 .UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-06-23.01).Microsoft Windows 7 Professional Boot Device: \Device\HarddiskVolume2Install Date: 9/24/2010 9:20:35 PMSystem Uptime: 8/22/2011 6:55:30 PM (3 hours ago).Motherboard: Dell Inc. | | 0JM680Processor: Intel® Core2 Duo CPU T9300 @ 2.50GHz | Microprocessor | 775/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 233 GiB total, 132.937 GiB free.D: is CDROM ()E: is CDROM (CDFS).==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP122: 8/22/2011 6:19:56 AM - Windows 7 Service Pack 1.==== Installed Programs ======================.µTorrentAdobe AIRAdobe Digital EditionsAdobe Flash Player 10 ActiveXAdobe Flash Player 10 PluginAdobe Reader 9.4.0Advanced Audio FX EngineAmazon MP3 Downloader 1.0.12American Module for Microsoft Dynamics NAV Classic ClientAmerican Module for Microsoft Dynamics NAV DocumentationAmerican Module for Microsoft Dynamics NAV Outlook Add-InAmerican Module for Microsoft Dynamics NAV Role Tailored ClientAmerican Module for Microsoft Dynamics NAV ServerApple Application SupportApple Mobile Device SupportApple Software UpdateAVG Free 9.0BonjourCanadian Module for Microsoft Dynamics NAV Classic ClientCanadian Module for Microsoft Dynamics NAV DocumentationCanadian Module for Microsoft Dynamics NAV Outlook Add-InCanadian Module for Microsoft Dynamics NAV Role Tailored ClientCanadian Module for Microsoft Dynamics NAV ServerCitrix online plug-in - webCitrix online plug-in (DV)Citrix online plug-in (HDX)Citrix online plug-in (USB)Citrix online plug-in (Web)Counter-StrikeCoupon Printer for WindowsDefinition update for Microsoft Office 2010 (KB982726)Dell Driver Download ManagerDell TouchpadDocumentationFLV PlayerGMATPrepiTunesJava Auto UpdaterJava 6 Update 26Live! Cam Avatar CreatorMagic ISO Maker v5.5 (build 0281)MagicDisc 2.7.106Malwarebytes' Anti-Malware version 1.51.1.1800MediaMonkey 3.2Mexican Module for Microsoft Dynamics NAV Classic ClientMexican Module for Microsoft Dynamics NAV DocumentationMexican Module for Microsoft Dynamics NAV Outlook Add-InMexican Module for Microsoft Dynamics NAV Role Tailored ClientMexican Module for Microsoft Dynamics NAV ServerMicrosoft .NET Framework 4 Client ProfileMicrosoft Application Error ReportingMicrosoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170)Microsoft Dynamics NAV 2009 ClassicMicrosoft Dynamics NAV 2009 Outlook Add-inMicrosoft Dynamics NAV 2009 RoleTailored ClientMicrosoft Dynamics NAV 2009 ServiceMicrosoft Dynamics NAV 2009 SP1Microsoft Dynamics NAV 6-0 Database for SQL ServerMicrosoft Dynamics NAV 6.0 SetupMicrosoft Dynamics NAV Components for Microsoft SQL ServerMicrosoft IntelliPoint 8.0Microsoft Office Access MUI (English) 2010Microsoft Office Access Setup Metadata MUI (English) 2010Microsoft Office Excel MUI (English) 2010Microsoft Office Groove MUI (English) 2010Microsoft Office InfoPath MUI (English) 2010Microsoft Office OneNote MUI (English) 2010Microsoft Office Outlook MUI (English) 2010Microsoft Office PowerPoint MUI (English) 2010Microsoft Office Professional Plus 2010Microsoft Office Proof (English) 2010Microsoft Office Proof (French) 2010Microsoft Office Proof (Spanish) 2010Microsoft Office Proofing (English) 2010Microsoft Office Publisher MUI (English) 2010Microsoft Office Shared MUI (English) 2010Microsoft Office Shared Setup Metadata MUI (English) 2010Microsoft Office Word MUI (English) 2010Microsoft Report Viewer Redistributable 2008 (KB971119)Microsoft SQL Server 2005Microsoft SQL Server 2005 Express EditionMicrosoft SQL Server Compact 3.5 SP2 ENUMicrosoft SQL Server Native ClientMicrosoft SQL Server Setup Support Files (English)Microsoft SQL Server VSS WriterMicrosoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161NHL® 09NVIDIA 3D Vision Driver 266.58NVIDIA Control Panel 266.58NVIDIA Graphics Driver 266.58NVIDIA Install ApplicationNVIDIA nView 135.50NVIDIA nView Desktop ManagerNVIDIA PhysXNVIDIA PhysX System Software 9.10.0514NVIDIA Stereoscopic 3D DriverPHOTOfunSTUDIO 5.0 HD EditionPrimoPDF -- brought to you by Nitro PDF SoftwareQuickTimeRICOH R5C83x/84x Media Driver x86 Ver.3.34.03Rocketfish HD Webcam (1.00.06.00)Rocketfish Live! CentralSecurity Update for Microsoft .NET Framework 4 Client Profile (KB2446708)Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)Security Update for Microsoft Excel 2010 (KB2523021)Security Update for Microsoft InfoPath 2010 (KB2510065)Security Update for Microsoft Office 2010 (KB2289078)Security Update for Microsoft Office 2010 (KB2289161)Security Update for Microsoft PowerPoint 2010 (KB2519975)Security Update for Microsoft Publisher 2010 (KB2409055)Security Update for Microsoft Word 2010 (KB2345000)SILKYPIX Developer Studio 3.1 SESkype ToolbarsSkype™ 5.1SteamUpdate for Microsoft Office 2010 (KB2202188)Update for Microsoft Office 2010 (KB2413186)Update for Microsoft Office 2010 (KB2494150)Update for Microsoft Office 2010 (KB2523113)Update for Microsoft OneNote 2010 (KB2493983)Update for Microsoft Outlook Social Connector (KB2441641)Windows Mobile Device CenterYahoo! BrowserPlus 2.9.8Yahoo! Detect.==== Event Viewer Messages From Past Week ========.8/22/2011 6:38:59 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Windows 7 Service Pack 1 (KB976932).8/22/2011 6:35:35 AM, Error: Service Control Manager [7023] - The srv1A8 service terminated with the following error: The specified module could not be found.8/22/2011 6:26:44 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Windows Internet Explorer 9 for Windows 7.8/21/2011 5:10:14 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.8/21/2011 5:08:54 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.8/21/2011 5:08:22 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.8/21/2011 5:01:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}8/21/2011 3:09:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}8/21/2011 3:09:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}8/21/2011 3:09:24 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}8/21/2011 3:09:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}8/21/2011 3:09:12 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 ctxusbm discache spldr Wanarpv68/19/2011 8:04:34 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83347487, 0xaab4cf7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-18969-01.8/19/2011 8:00:34 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d2487, 0xab314f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-18314-01.8/19/2011 7:56:08 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0xab714f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19531-01.8/19/2011 7:51:44 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83352487, 0xaaf50f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-18704-01.8/19/2011 7:47:14 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833e3487, 0xa9d84f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19203-01.8/19/2011 7:42:45 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833db487, 0xaacf4f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-18782-01.8/19/2011 7:38:18 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d2487, 0xa8510f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19359-02.8/19/2011 7:33:52 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x831b0487, 0xaa8b8f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-18033-01.8/19/2011 7:29:27 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d4487, 0xa8ffaf7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19063-01.8/19/2011 7:25:04 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833e3487, 0xab8a8f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19016-01.8/19/2011 7:20:38 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d1487, 0xaae74f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-19328-01.8/19/2011 7:16:10 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0xa65cef7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-20186-01.8/19/2011 7:11:35 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0xa7296f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-22042-01.8/19/2011 7:06:55 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0x8217af7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-20685-01.8/19/2011 7:02:42 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The service has not been started.8/19/2011 7:02:31 AM, Error: Service Control Manager [7023] - The Server service terminated with the following error: Not enough storage is available to complete this operation.8/19/2011 7:02:16 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d5487, 0xae4a2f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081911-30529-01.8/18/2011 8:27:37 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x831ab487, 0xaa1bff7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081811-21902-01.8/18/2011 8:24:23 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83368487, 0xac12ef7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081811-25911-01.8/18/2011 7:29:16 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833c7487, 0xa8d14f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081811-23571-01.8/18/2011 6:46:05 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833e3487, 0xa8252f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081811-28782-01.8/18/2011 6:32:07 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0x9fb66f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081811-29390-01.8/18/2011 10:24:09 PM, Error: Microsoft-Windows-Smartcard-Server [610] - Smart Card Reader 'O2 O2Micro CCID SC Reader 0' rejected IOCTL GET_STATE: The handle is invalid. If this error persists, your smart card or reader may not be functioning correctly. Command Header: XX XX XX XX8/17/2011 9:36:06 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83206487, 0x8ff8cf7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081711-26691-01.8/17/2011 9:31:55 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x833d1487, 0xace96f7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081711-29359-01.8/17/2011 8:30:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service NVSvc with arguments "" in order to run the server: {DCAB0989-1301-4319-BE5F-ADE89F88581C}8/17/2011 8:15:50 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 (KB2556532).8/17/2011 8:01:46 PM, Error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).8/17/2011 8:00:16 PM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.8/17/2011 7:58:26 PM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.8/17/2011 10:32:20 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x8334f487, 0xa9b2cf7c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 081711-26956-01.8/16/2011 9:29:36 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control..==== End Of File =========================== Link to post Share on other sites More sharing options...
Elise Posted August 24, 2011 ID:468880 Share Posted August 24, 2011 Hi there,P2P WARNING-------------------Going over your logs I noticed that you have uTorrent installed. Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.It is pretty much certain that if you continue to use P2P programs, you will get infected again.I would recommend that you uninstall uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.If you wish to keep it, please do not use it until your computer is cleaned.Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Adobe components and update:Download the latest version of Adobe Reader Version X. and save it to your desktop.Uncheck the "Free McAfee Security plan Plus" option or any other Toolbar you are offeredClick the download button at the bottom. If you use Internet Explorer and do not wish to install the ActiveX element, simply click on the click here to download link on the next page.Remove all older version of Adobe Reader: Go to Add/remove and uninstall all versions of Adobe Reader, Acrobat Reader and Adobe Acrobat. If you are unsure of how to use Add or Remove Programs, the please see this tutorial:How To Remove An Installed Program From Your ComputerThen from your desktop double-click on Adobe Reader to install the newest version. If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.When the "Adobe Setup - Welcome" window opens, click the Install > button.If offered to install a Toolbar, just uncheck the box before continuing unless you want it.Your Adobe Reader is now up to date!Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Download the latest version of Java Runtime Environment (JRE) Version 7.Look for "JDK 7 (JDK or JRE).Click the "Download JRE" button at the right.Read the License Agreement, and then check the box that says: "Accept License Agreement".Select "Windows x86 Offline" and click on jre-7-windows-i586.exe [*]Save it to your desktop[*]Close any programs you may have running - especially your web browser.[*]Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).[*]Reboot your computer once all Java components are removed.[*]Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.ESET ONLINE SCANNER----------------------------I'd like us to scan your machine with ESET OnlineScanHold down Control and click on this link to open ESET OnlineScan in a new window.Click the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check "YES, I accept the Terms of Use."Click the Start button.Accept any security warnings from your browser.Under scan settings, check "Scan Archives" and "Remove found threats" Click Advanced settings and select the following:Scan potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth technology[*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.[*]When the scan completes, click List Threats[*]Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.[*]Click the Back button.[*]Click the Finish button. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 25, 2011 Author ID:469226 Share Posted August 25, 2011 Updated Adobe, Java, IE, and tried to install SP1 for windows 7 but I get this - Windows 7 SP1 Updates fails with error 80073701C:\Qoobox\Quarantine\C\ProgramData\C5C7.tmp.vir a variant of Win32/Kryptik.RST trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-11286bc6 a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-1795d424 a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-17f0f4cb a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-21c8f7d7 a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-5497d9ed a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantinedC:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\5767092-6d987f30 a variant of Java/TrojanDownloader.OpenStream.NCI trojan cleaned by deleting - quarantined Link to post Share on other sites More sharing options...
Elise Posted August 25, 2011 ID:469264 Share Posted August 25, 2011 Please try to download and install the service pack from here and see if that works. If not, let me know at which point it crashes.ALL CLEAN--------------Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean Please do the following to remove the remaining programs from your PC:Delete the tools used during the disinfection:Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.Please read these advices, in order to prevent reinfecting your PC:Install and update the following programs regularly:an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.A comprehensive tutorial and a list of possible firewalls can be found here.an AntiVirus SoftwareIt is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.an Anti-Spyware programMalware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.SUPERAntiSpyware is another good scanner with high detection and removal rates.Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.Spyware BlasterA tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.[*]Keep Windows (and your other Microsoft software) up to date!I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!![*]Keep your other software up to date as wellSoftware does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.[*]Stay up to date!The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.Some more links you might find of interest:Miekies' prevention suggestionsSo How did I get infected?Microsoft - 'Security at home'Calendar of Updates: See which updates have been released.How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:Commonly Used Freeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.osalt: Find (free) open source alternatives to known commercial software.Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards. Link to post Share on other sites More sharing options...
sunnyd53 Posted August 26, 2011 Author ID:469550 Share Posted August 26, 2011 I downloaded the Sp1 installer and ran it. After 15 minutes it failes - error_sxs_assembly _missing (0x80073701).Any other ideas to get the SP1 to install?Thanks for all your help by the way. Link to post Share on other sites More sharing options...
Elise Posted August 26, 2011 ID:469624 Share Posted August 26, 2011 Please run this tool as explained: http://support.microsoft.com/kb/947821/en-us Link to post Share on other sites More sharing options...
Elise Posted August 26, 2011 ID:469625 Share Posted August 26, 2011 Hi, it looks like you have Avira installed as Antiivrus. MBAM is not an antivirus, it is an antispyware. While the full version adds extra protection, it is not critical to not have it running (as long as you have a real time protecting antivirus like avira). I recommend to run an on demand scan once a week (you can update then as well), this is enough. You can run it more often if you suspect something might be wrong.As for CCleaner, its file cleaning component is okay, but I do not recommend to use the registry cleaner: reg cleaners usually do more harm than good and it is better to stay away from them.As for combofix, please redownload it, right click the file and select Rename. Rename combofix.exe to uninstall.exe and run it like that. That should do the trick. Link to post Share on other sites More sharing options...
Staff screen317 Posted September 8, 2011 Staff ID:474115 Share Posted September 8, 2011 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff screen317 Posted October 10, 2011 Staff ID:483853 Share Posted October 10, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts