Phillefann15 Posted October 10, 2011 ID:484324 Share Posted October 10, 2011 So about a week ago I had a av thing downloaded to my desktop called opencloud security, I got rkill and malwarebites and got that off the desktop, but now (and with opencloud) i get redirected on google pages and can't access anti malware programs because it can't find the file or I don't have permission to access it. I have avg free and that doesn't catch it. I also have spybot, superantimalware, and malwarebites but can't acces them either. My comp also freezes and runs reaaaaaalllly slow after about an hour of being on it, task manager shows no differences in comp usage. So I'm stuck ecausr anything I try to do fails, I've read every sticky and none have helped, anyoe know what to do???? Running on xp Link to post Share on other sites More sharing options...
Staff screen317 Posted October 12, 2011 Staff ID:485107 Share Posted October 12, 2011 Hi and welcome to Malwarebytes.Download the file TDSSKiller.zip and extract it into a folder on the infected PC.Execute the file TDSSKiller.exe by double-clicking on it.Wait for the scan and disinfection process to be over.When its work is over, the utility prompts for a reboot to complete the disinfection.By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).The log is like UtilityName.Version_Date_Time_log.txt.for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.Please post that log here.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.-screen317 Link to post Share on other sites More sharing options...
Phillefann15 Posted October 13, 2011 Author ID:485401 Share Posted October 13, 2011 .DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702Run by Marty at 15:48:44 on 2011-10-13Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1013.370 [GMT -5:00].AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}AV: Norton AntiVirus *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}.============== Running Processes ===============.C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupsvchost.exesvchost.exeC:\WINDOWS\System32\wltrysvc.exeC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\spoolsv.exesvchost.exeC:\Program Files\SUPERAntiSpyware\SASCORE.EXEC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Program Files\Dell Network Assistant\hnm_svc.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exeC:\WINDOWS\system32\lxddcoms.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\WINDOWS\system32\wltray.exeC:\Program Files\Lexmark 2500 Series\lxddmon.exeC:\Program Files\Lexmark 2500 Series\lxddamon.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exeC:\WINDOWS\System32\svchost.exe -k HTTPFilterC:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeC:\Program Files\RocketFish\RF5.1\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\PowerISO\PWRISOVM.EXEC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\AVG\AVG2012\avgtray.exeC:\Program Files\AVG Secure Search\vprot.exeC:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Dell Network Assistant\ezi_hnm2.exeC:\Program Files\Dynex Enhanced G Desktop Card Adapter\DynexWCUI.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\iPod\bin\iPodService.exeC:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\taskmgr.exeC:\Program Files\Internet Explorer\iexplore.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.yahoo.com/uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.comuSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.htmluSearchMigratedDefaultURL = hxxp://windiwsfsearch.com/search?q={searchTerms}mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.commSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.commStart Page = hxxp://www.yahoo.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://windiwsfsearch.comuSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.commSearchURL = hxxp://windiwsfsearch.comBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: {3b7aaeb1-9f3d-4491-9c06-c7165ca8d058} - c:\program files\applications\iebt.dllBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dllBHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dllBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dllBHO: VResLabWarningBHO Class: {b494e7bb-1e33-4922-a947-f74eff4e714f} - c:\program files\vreslab\VResLabWarning.dllBHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dllTB: Internet Service: {144a6b24-0ebc-4d89-bf09-a06a718e57b5} - c:\program files\applications\iebr.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dllTB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dllTB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dllTB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No FileEB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No FileuRun: [DellAutomatedPCTuneUp] "c:\program files\dellautomatedpctuneup\PTAgnt.exe" /startupuRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quietuRun: [VResLab] "c:\program files\vreslab\VResLab.exe"uRun: [wblogon] c:\windows\system32\algg.exeuRun: [ANTIVIRUS] c:\program files\aav\AAV.exeuRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe"uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [setDefaultMIDI] MIDIDef.exeuRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exemRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [RTHDCPL] RTHDCPL.EXEmRun: [Alcmtr] ALCMTR.EXEmRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"mRun: [broadcom Wireless Manager] c:\windows\system32\wltray.exemRun: [lxddmon.exe] "c:\program files\lexmark 2500 series\lxddmon.exe"mRun: [lxddamon] "c:\program files\lexmark 2500 series\lxddamon.exe"mRun: [ANTIVIRUS] c:\program files\aav\AAV.exemRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startupmRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exemRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resumemRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [CTSysVol] c:\program files\rocketfish\rf5.1\surround mixer\CTSysVol.exe /rmRun: [P17Helper] Rundll32 P17.dll,P17HelpermRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXEmRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exemRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbyloginmRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [OpenCloud Security] c:\documents and settings\marty\application data\opencloud security\OpenCloud Security.exemRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"mRun: [vProt] "c:\program files\avg secure search\vprot.exe"mRunOnce: [AvgRemover] c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\r6n771j4\avg_remover_stf_x86_2012_1796[1].exe /run_number=2 /avgdir="c:\program files\avg\avg9" /avgdatadir="c:\documents and settings\all users\application data\avg9" /ndis_nextstep=1mExplorerRun: [smile] c:\program files\applications\wcs.exeStartupFolder: c:\docume~1\marty\startm~1\programs\startup\billmi~1.lnk - c:\quickenw\billmind.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellne~1.lnk - c:\windows\installer\{0240bdfb-2995-4a3f-8c96-18d41282b716}\Icon0240BDFB3.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dynexw~1.lnk - c:\program files\dynex enhanced g desktop card adapter\DynexWCUI.exeIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dllIE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLLSP: mswsock.dllDPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{418B4E6C-D257-415F-B747-C1EEAB893852} : DhcpNameServer = 192.168.0.1TCP: Interfaces\{C1C904E7-A977-4024-AA68-A2BF60484A17} : DhcpNameServer = 192.168.0.1Filter: text/html - {f800bfeb-aff2-4418-aee4-d5381175e8f8} - Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dllHandler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\8.0.1\ViProtocol.dllNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLLNotify: igfxcui - igfxdev.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSTS: bismuthiferous: {d04bbe06-7ce7-405e-8730-cd56d9531cbb} - c:\windows\system32\vimhx.dllSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL.============= SERVICES / DRIVERS ===============.R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-7-11 32592]R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 229840]R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2007-4-26 99248]R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\8.0.1\ToolbarUpdater.exe [2011-10-4 246600]R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608]R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-7-11 16720]S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-9-12 5265248]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-8 135664]S3 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]S3 cpuz132;cpuz132;\??\c:\docume~1\marty\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\marty\locals~1\temp\cpuz132\cpuz132_x32.sys [?]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-8 135664]S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096].=============== Created Last 30 ================.2011-10-13 20:40:07 -------- d-----w- C:\TDSSKiller_Quarantine2011-10-10 20:52:39 -------- d-----w- c:\documents and settings\marty\application data\SUPERAntiSpyware.com2011-10-10 20:52:12 -------- d-----w- c:\program files\SUPERAntiSpyware2011-10-10 20:52:12 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com2011-10-04 22:55:45 -------- d-----w- c:\documents and settings\marty\application data\AVG20122011-10-04 22:54:00 -------- d-----w- c:\documents and settings\marty\application data\AVG Secure Search2011-10-04 22:53:55 -------- d-----w- c:\program files\common files\AVG Secure Search2011-10-04 22:53:54 -------- d-----w- c:\program files\AVG Secure Search2011-10-04 22:52:53 -------- d-----w- c:\windows\system32\drivers\AVG2011-10-04 22:52:53 -------- d-----w- c:\documents and settings\all users\application data\AVG20122011-09-29 22:07:12 -------- d--h--w- c:\documents and settings\all users\application data\Common Files2011-09-29 22:06:59 -------- d-----w- c:\documents and settings\all users\application data\MFAData2011-09-29 21:48:34 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-09-29 21:48:28 -------- d-----w- c:\documents and settings\marty\application data\Malwarebytes2011-09-29 21:48:19 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes2011-09-26 16:42:16 -------- d-----w- c:\documents and settings\marty\application data\OpenCloud Security2011-09-26 16:41:20 220160 ------w- c:\windows\system32\dllcache\oleacc.dll2011-09-26 16:41:14 20480 ------w- c:\windows\system32\dllcache\oleaccrc.dll2011-09-26 15:43:30 -------- d-----w- c:\program files\iPod2011-09-26 15:43:24 -------- d-----w- c:\program files\iTunes2011-09-26 15:38:24 -------- d-----w- c:\program files\Bonjour2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll.==================== Find3M ====================.2011-10-13 20:42:23 162816 ----a-w- c:\windows\system32\drivers\netbt.sys2011-09-26 16:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll2011-09-26 16:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll2011-09-26 16:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll2011-09-13 11:30:10 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys2011-08-22 23:48:55 916480 ----a-w- c:\windows\system32\wininet.dll2011-08-22 23:48:54 43520 ----a-w- c:\windows\system32\licmgr10.dll2011-08-22 23:48:54 1469440 ------w- c:\windows\system32\inetcpl.cpl2011-08-22 11:56:39 385024 ----a-w- c:\windows\system32\html.iec2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys2011-08-11 21:04:41 517 --sha-w- c:\windows\system32\ipsmsnap32.dll2011-08-11 20:03:50 517 --sha-w- c:\windows\system32\inetpp32.dll2011-08-11 16:10:17 517 --sha-w- c:\windows\system32\wowfaxui32.dll2011-08-07 17:08:02 517 --sha-w- c:\windows\system32\MFPLAT32.dll2011-08-04 16:34:18 517 --sha-w- c:\windows\system32\kbdhela332.dll2011-08-03 19:02:36 517 --sha-w- c:\windows\system32\MFC71u32.dll2011-08-03 17:56:39 517 --sha-w- c:\windows\system32\mimefilt32.dll2011-08-02 20:59:05 517 --sha-w- c:\windows\system32\wpdtrace32.dll2011-08-02 19:54:58 517 --sha-w- c:\windows\system32\mll_qic32.dll2011-08-02 18:54:08 517 --sha-w- c:\windows\system32\mll_mtf32.dll2011-08-01 19:29:32 517 --sha-w- c:\windows\system32\kbdinbe132.dll2011-08-01 18:23:34 517 --sha-w- c:\windows\system32\modex32.dll2011-08-01 17:19:33 517 --sha-w- c:\windows\system32\mmcfxcommon32.dll2011-08-01 04:08:34 517 --sha-w- c:\windows\system32\kbdsl3232.dll2011-08-01 03:02:56 517 --sha-w- c:\windows\system32\jobexec32.dll2011-08-01 02:01:57 517 --sha-w- c:\windows\system32\kbdest32.dll2011-08-01 01:01:24 517 --sha-w- c:\windows\system32\wstdecod32.dll2011-08-01 00:00:59 517 --sha-w- c:\windows\system32\kbdla32.dll2011-07-31 23:00:32 517 --sha-w- c:\windows\system32\msctfp32.dll2011-07-31 16:06:22 517 --sha-w- c:\windows\system32\moricons32.dll2011-07-27 19:08:53 517 --sha-w- c:\windows\system32\windowscodecsext32.dll2011-07-27 17:53:34 517 --sha-w- c:\windows\system32\mspmsp32.dll2011-07-27 16:53:12 517 --sha-w- c:\windows\system32\cic32.dll2011-07-27 04:26:53 517 --sha-w- c:\windows\system32\samlib32.dll2011-07-27 03:26:32 517 --sha-w- c:\windows\system32\ptpusd32.dll2011-07-27 00:50:03 517 --sha-w- c:\windows\system32\kbdfi32.dll2011-07-26 23:49:42 517 --sha-w- c:\windows\system32\kbdsl32.dll2011-07-25 21:52:08 517 --sha-w- c:\windows\system32\xmlprovi32.dll2011-07-25 20:46:30 517 --sha-w- c:\windows\system32\kbdnepr32.dll2011-07-25 02:27:11 517 --sha-w- c:\windows\system32\msorcl3232.dll2011-07-25 01:21:33 517 --sha-w- c:\windows\system32\msacm3232.dll2011-07-23 15:20:02 517 --sha-w- c:\windows\system32\audiodev32.dll2011-07-23 01:48:35 517 --sha-w- c:\windows\system32\kbdhu132.dll2011-07-23 00:16:57 517 --sha-w- c:\windows\system32\localsec32.dll2011-07-22 23:12:12 517 --sha-w- c:\windows\system32\accesor32.dll2011-07-22 05:48:31 517 --sha-w- c:\windows\system32\kbdsf32.dll2011-07-22 04:42:54 517 --sha-w- c:\windows\system32\msvcirt32.dll2011-07-22 03:37:16 517 --sha-w- c:\windows\system32\mscpxl3232.dll2011-07-22 02:31:38 517 --sha-w- c:\windows\system32\audiosrv32.dll2011-07-19 17:28:34 517 --sha-w- c:\windows\system32\Q_COMM32.dll2011-07-17 21:53:25 517 --sha-w- c:\windows\system32\mciseq32.dll2011-07-17 20:53:01 517 --sha-w- c:\windows\system32\kbdmon32.dll2011-07-17 19:52:34 517 --sha-w- c:\windows\system32\mchgrcoi32.dll2011-07-17 18:52:13 517 --sha-w- c:\windows\system32\asferror32.dll2011-07-17 17:50:52 517 --sha-w- c:\windows\system32\kbdukx32.dll2011-07-17 16:50:04 517 --sha-w- c:\windows\system32\narrhook32.dll2011-07-16 20:42:53 517 --sha-w- c:\windows\system32\msfeeds32.dll2011-07-16 20:19:19 0 ---ha-w- c:\documents and settings\marty\puvdeoczhw.tmp.============= FINISH: 15:50:00.15 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted October 13, 2011 Staff ID:485406 Share Posted October 13, 2011 Hi,I notice that you are using more than one antivirus program (AVG and Norton). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.Download the file TDSSKiller.zip and extract it into a folder on the infected PC.Execute the file TDSSKiller.exe by double-clicking on it.Wait for the scan and disinfection process to be over.When its work is over, the utility prompts for a reboot to complete the disinfection.By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).The log is like UtilityName.Version_Date_Time_log.txt.for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.Please post that log here.Please update MBAM, run a Quick Scan, and post its log.Next, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Phillefann15 Posted October 14, 2011 Author ID:485802 Share Posted October 14, 2011 12:40:49.0046 3928 TDSS rootkit removing tool 2.6.8.0 Oct 12 2011 07:30:5412:40:53.0390 3928 ============================================================12:40:53.0390 3928 Current date / time: 2011/10/14 12:40:53.039012:40:53.0390 3928 SystemInfo:12:40:53.0390 3928 12:40:53.0390 3928 OS Version: 5.1.2600 ServicePack: 3.012:40:53.0390 3928 Product type: Workstation12:40:53.0390 3928 ComputerName: D6LF4HF112:40:53.0390 3928 UserName: Marty12:40:53.0390 3928 Windows directory: C:\WINDOWS12:40:53.0390 3928 System windows directory: C:\WINDOWS12:40:53.0390 3928 Processor architecture: Intel x8612:40:53.0390 3928 Number of processors: 212:40:53.0390 3928 Page size: 0x100012:40:53.0390 3928 Boot type: Normal boot12:40:53.0390 3928 ============================================================12:40:55.0234 3928 Initialize success12:40:57.0140 3716 ============================================================12:40:57.0140 3716 Scan started12:40:57.0140 3716 Mode: Manual; 12:40:57.0140 3716 ============================================================12:40:59.0203 3716 Abiosdsk - ok12:40:59.0250 3716 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS12:40:59.0265 3716 abp480n5 - ok12:40:59.0328 3716 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys12:40:59.0343 3716 ACPI - ok12:40:59.0390 3716 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys12:40:59.0390 3716 ACPIEC - ok12:40:59.0421 3716 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys12:40:59.0421 3716 adpu160m - ok12:40:59.0484 3716 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys12:40:59.0484 3716 aec - ok12:40:59.0546 3716 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys12:40:59.0546 3716 AFD - ok12:40:59.0593 3716 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys12:40:59.0593 3716 agp440 - ok12:40:59.0656 3716 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys12:40:59.0656 3716 agpCPQ - ok12:40:59.0671 3716 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys12:40:59.0671 3716 Aha154x - ok12:40:59.0687 3716 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys12:40:59.0687 3716 aic78u2 - ok12:40:59.0703 3716 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys12:40:59.0703 3716 aic78xx - ok12:40:59.0718 3716 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys12:40:59.0718 3716 AliIde - ok12:40:59.0734 3716 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys12:40:59.0734 3716 alim1541 - ok12:40:59.0781 3716 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys12:40:59.0781 3716 amdagp - ok12:40:59.0796 3716 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys12:40:59.0796 3716 amsint - ok12:40:59.0812 3716 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys12:40:59.0828 3716 asc - ok12:40:59.0843 3716 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys12:40:59.0843 3716 asc3350p - ok12:40:59.0859 3716 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys12:40:59.0859 3716 asc3550 - ok12:40:59.0968 3716 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys12:41:00.0015 3716 AsyncMac - ok12:41:00.0312 3716 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys12:41:00.0312 3716 atapi - ok12:41:00.0437 3716 Atdisk - ok12:41:00.0562 3716 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys12:41:00.0578 3716 Atmarpc - ok12:41:00.0609 3716 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys12:41:00.0609 3716 audstub - ok12:41:00.0750 3716 AVGIDSDriver (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys12:41:00.0750 3716 AVGIDSDriver - ok12:41:00.0937 3716 AVGIDSEH (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys12:41:00.0937 3716 AVGIDSEH - ok12:41:01.0000 3716 AVGIDSFilter (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys12:41:01.0000 3716 AVGIDSFilter - ok12:41:01.0046 3716 AVGIDSShim (07eba0c11fa1d73b82ecc3255ddfe34d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys12:41:01.0046 3716 AVGIDSShim - ok12:41:01.0093 3716 Avgldx86 (f4dbbc8d3c5338693da23c59a50f8abc) C:\WINDOWS\system32\DRIVERS\avgldx86.sys12:41:01.0109 3716 Avgldx86 - ok12:41:01.0109 3716 Avgmfx86 (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys12:41:01.0125 3716 Avgmfx86 - ok12:41:01.0140 3716 Avgrkx86 (f2038ed7284b79dcef581468121192a9) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys12:41:01.0140 3716 Avgrkx86 - ok12:41:01.0187 3716 Avgtdix (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys12:41:01.0187 3716 Avgtdix - ok12:41:01.0265 3716 BCM43XX (e679fe7890c366f3418963e289d273cf) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys12:41:01.0296 3716 BCM43XX - ok12:41:01.0312 3716 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys12:41:01.0312 3716 Beep - ok12:41:01.0328 3716 catchme - ok12:41:01.0359 3716 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys12:41:01.0359 3716 cbidf - ok12:41:01.0375 3716 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys12:41:01.0375 3716 cbidf2k - ok12:41:01.0390 3716 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys12:41:01.0390 3716 cd20xrnt - ok12:41:01.0421 3716 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys12:41:01.0437 3716 Cdaudio - ok12:41:01.0453 3716 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys12:41:01.0453 3716 Cdfs - ok12:41:01.0484 3716 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys12:41:01.0484 3716 Cdrom - ok12:41:01.0500 3716 Changer - ok12:41:01.0546 3716 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys12:41:01.0546 3716 CmdIde - ok12:41:01.0578 3716 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys12:41:01.0578 3716 Cpqarray - ok12:41:01.0718 3716 cpuz132 - ok12:41:01.0765 3716 ctsfm2k (8db84de3aab34a8b4c2f644eff41cd76) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys12:41:01.0765 3716 ctsfm2k - ok12:41:01.0828 3716 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys12:41:01.0828 3716 dac2w2k - ok12:41:01.0843 3716 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys12:41:01.0843 3716 dac960nt - ok12:41:01.0890 3716 datunidr (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\datunidr.sys12:41:01.0890 3716 datunidr - ok12:41:01.0953 3716 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys12:41:01.0953 3716 Disk - ok12:41:02.0062 3716 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys12:41:02.0078 3716 dmboot - ok12:41:02.0125 3716 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys12:41:02.0125 3716 dmio - ok12:41:02.0250 3716 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys12:41:02.0250 3716 dmload - ok12:41:02.0296 3716 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys12:41:02.0312 3716 DMusic - ok12:41:02.0343 3716 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys12:41:02.0343 3716 dpti2o - ok12:41:02.0390 3716 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys12:41:02.0390 3716 drmkaud - ok12:41:02.0437 3716 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys12:41:02.0437 3716 E100B - ok12:41:02.0484 3716 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys12:41:02.0484 3716 e1express - ok12:41:02.0531 3716 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys12:41:02.0531 3716 Fastfat - ok12:41:02.0562 3716 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys12:41:02.0562 3716 Fdc - ok12:41:02.0593 3716 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys12:41:02.0593 3716 Fips - ok12:41:02.0640 3716 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys12:41:02.0640 3716 Flpydisk - ok12:41:02.0687 3716 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys12:41:02.0703 3716 FltMgr - ok12:41:02.0703 3716 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys12:41:02.0718 3716 Fs_Rec - ok12:41:02.0718 3716 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys12:41:02.0718 3716 Ftdisk - ok12:41:02.0765 3716 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys12:41:02.0765 3716 GEARAspiWDM - ok12:41:02.0812 3716 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys12:41:02.0812 3716 Gpc - ok12:41:02.0828 3716 HDAudBus - ok12:41:02.0875 3716 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys12:41:02.0875 3716 HidUsb - ok12:41:02.0937 3716 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys12:41:02.0937 3716 hpn - ok12:41:03.0000 3716 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys12:41:03.0000 3716 HTTP - ok12:41:03.0031 3716 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys12:41:03.0031 3716 i2omgmt - ok12:41:03.0062 3716 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys12:41:03.0062 3716 i2omp - ok12:41:03.0078 3716 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys12:41:03.0078 3716 i8042prt - ok12:41:03.0343 3716 ialm (28423512370705aeda6a652fedb25468) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys12:41:03.0546 3716 ialm - ok12:41:03.0578 3716 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\drivers\iaStor.sys12:41:03.0578 3716 iaStor - ok12:41:03.0609 3716 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys12:41:03.0609 3716 Imapi - ok12:41:03.0656 3716 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys12:41:03.0656 3716 ini910u - ok12:41:03.0828 3716 IntcAzAudAddService (17bbbabb21f86b650b2626045a9d016c) C:\WINDOWS\system32\drivers\RtkHDAud.sys12:41:03.0953 3716 IntcAzAudAddService - ok12:41:04.0187 3716 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys12:41:04.0218 3716 IntelIde - ok12:41:04.0390 3716 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys12:41:04.0390 3716 intelppm - ok12:41:04.0421 3716 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys12:41:04.0421 3716 Ip6Fw - ok12:41:04.0468 3716 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys12:41:04.0468 3716 IpFilterDriver - ok12:41:04.0500 3716 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys12:41:04.0500 3716 IpInIp - ok12:41:04.0546 3716 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys12:41:04.0546 3716 IpNat - ok12:41:04.0562 3716 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys12:41:04.0562 3716 IPSec - ok12:41:04.0593 3716 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys12:41:04.0593 3716 IRENUM - ok12:41:04.0609 3716 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys12:41:04.0609 3716 isapnp - ok12:41:04.0625 3716 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys12:41:04.0625 3716 Kbdclass - ok12:41:04.0625 3716 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys12:41:04.0625 3716 kbdhid - ok12:41:04.0671 3716 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys12:41:04.0671 3716 kmixer - ok12:41:04.0734 3716 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys12:41:04.0734 3716 KSecDD - ok12:41:04.0750 3716 lbrtfdc - ok12:41:04.0796 3716 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys12:41:04.0796 3716 MBAMProtector - ok12:41:04.0812 3716 MCSTRM - ok12:41:04.0828 3716 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys12:41:04.0843 3716 mnmdd - ok12:41:04.0890 3716 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys12:41:04.0890 3716 Modem - ok12:41:04.0937 3716 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys12:41:04.0953 3716 Mouclass - ok12:41:05.0000 3716 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys12:41:05.0000 3716 mouhid - ok12:41:05.0031 3716 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys12:41:05.0031 3716 MountMgr - ok12:41:05.0078 3716 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys12:41:05.0078 3716 mraid35x - ok12:41:05.0109 3716 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys12:41:05.0109 3716 MRxDAV - ok12:41:05.0156 3716 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys12:41:05.0171 3716 MRxSmb - ok12:41:05.0187 3716 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys12:41:05.0187 3716 Msfs - ok12:41:05.0250 3716 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys12:41:05.0250 3716 MSKSSRV - ok12:41:05.0265 3716 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys12:41:05.0265 3716 MSPCLOCK - ok12:41:05.0281 3716 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys12:41:05.0281 3716 MSPQM - ok12:41:05.0328 3716 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys12:41:05.0328 3716 mssmbios - ok12:41:05.0500 3716 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys12:41:05.0500 3716 Mup - ok12:41:05.0500 3716 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys12:41:05.0500 3716 NDIS - ok12:41:05.0546 3716 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys12:41:05.0546 3716 NdisTapi - ok12:41:05.0593 3716 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys12:41:05.0593 3716 Ndisuio - ok12:41:05.0593 3716 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys12:41:05.0593 3716 NdisWan - ok12:41:05.0625 3716 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys12:41:05.0625 3716 NDProxy - ok12:41:05.0640 3716 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys12:41:05.0640 3716 NetBIOS - ok12:41:05.0671 3716 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys12:41:05.0671 3716 NetBT - ok12:41:05.0687 3716 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys12:41:05.0703 3716 Npfs - ok12:41:05.0734 3716 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys12:41:05.0750 3716 Ntfs - ok12:41:05.0765 3716 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys12:41:05.0781 3716 Null - ok12:41:05.0875 3716 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys12:41:05.0921 3716 nv - ok12:41:05.0953 3716 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys12:41:05.0953 3716 NwlnkFlt - ok12:41:05.0984 3716 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys12:41:06.0000 3716 NwlnkFwd - ok12:41:06.0062 3716 ossrv (103a9b117a7d9903111955cdafe65ac6) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys12:41:06.0062 3716 ossrv - ok12:41:06.0187 3716 P17 (4988ac8b88c9814ccb0b2f93869af1e0) C:\WINDOWS\system32\drivers\P17.sys12:41:06.0234 3716 P17 - ok12:41:06.0265 3716 Packet (8f856dae19383bd69db444004d5d4f50) C:\WINDOWS\system32\DRIVERS\packet.sys12:41:06.0265 3716 Packet - ok12:41:06.0296 3716 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys12:41:06.0296 3716 Parport - ok12:41:06.0328 3716 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys12:41:06.0328 3716 PartMgr - ok12:41:06.0375 3716 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys12:41:06.0375 3716 ParVdm - ok12:41:06.0375 3716 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys12:41:06.0375 3716 PCI - ok12:41:06.0390 3716 PCIDump - ok12:41:06.0406 3716 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys12:41:06.0406 3716 PCIIde - ok12:41:06.0437 3716 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys12:41:06.0437 3716 Pcmcia - ok12:41:06.0437 3716 PDCOMP - ok12:41:06.0453 3716 PDFRAME - ok12:41:06.0453 3716 PDRELI - ok12:41:06.0468 3716 PDRFRAME - ok12:41:06.0484 3716 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys12:41:06.0484 3716 perc2 - ok12:41:06.0640 3716 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys12:41:06.0640 3716 perc2hib - ok12:41:06.0734 3716 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys12:41:06.0734 3716 PptpMiniport - ok12:41:06.0765 3716 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys12:41:06.0765 3716 PSched - ok12:41:06.0781 3716 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys12:41:06.0781 3716 Ptilink - ok12:41:06.0953 3716 PTproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys12:41:06.0953 3716 PTproct - ok12:41:06.0984 3716 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys12:41:06.0984 3716 ql1080 - ok12:41:07.0015 3716 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys12:41:07.0031 3716 Ql10wnt - ok12:41:07.0062 3716 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys12:41:07.0062 3716 ql12160 - ok12:41:07.0062 3716 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys12:41:07.0078 3716 ql1240 - ok12:41:07.0093 3716 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys12:41:07.0093 3716 ql1280 - ok12:41:07.0156 3716 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys12:41:07.0156 3716 RasAcd - ok12:41:07.0234 3716 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys12:41:07.0234 3716 Rasl2tp - ok12:41:07.0250 3716 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys12:41:07.0250 3716 RasPppoe - ok12:41:07.0265 3716 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys12:41:07.0265 3716 Raspti - ok12:41:07.0312 3716 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys12:41:07.0312 3716 Rdbss - ok12:41:07.0328 3716 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys12:41:07.0328 3716 RDPCDD - ok12:41:07.0375 3716 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys12:41:07.0375 3716 rdpdr - ok12:41:07.0437 3716 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys12:41:07.0453 3716 RDPWD - ok12:41:07.0484 3716 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys12:41:07.0484 3716 redbook - ok12:41:07.0562 3716 SCDEmu (20b2751cd4c8f3fd989739ca661b9f30) C:\WINDOWS\system32\drivers\SCDEmu.sys12:41:07.0562 3716 SCDEmu - ok12:41:07.0609 3716 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys12:41:07.0609 3716 Secdrv - ok12:41:07.0656 3716 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys12:41:07.0656 3716 serenum - ok12:41:07.0703 3716 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys12:41:07.0703 3716 Serial - ok12:41:07.0734 3716 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys12:41:07.0734 3716 Sfloppy - ok12:41:07.0750 3716 Simbad - ok12:41:07.0812 3716 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys12:41:07.0812 3716 sisagp - ok12:41:07.0843 3716 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys12:41:07.0843 3716 Sparrow - ok12:41:07.0890 3716 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys12:41:07.0890 3716 splitter - ok12:41:07.0984 3716 sptd (614deea4bdcec3fd5a07bdc705723ad7) C:\WINDOWS\System32\Drivers\sptd.sys12:41:07.0984 3716 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\sptd.sys. md5: 614deea4bdcec3fd5a07bdc705723ad712:41:08.0000 3716 sptd ( LockedFile.Multi.Generic ) - warning12:41:08.0000 3716 sptd - detected LockedFile.Multi.Generic (1)12:41:08.0000 3716 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys12:41:08.0000 3716 sr - ok12:41:08.0046 3716 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys12:41:08.0062 3716 Srv - ok12:41:08.0218 3716 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys12:41:08.0218 3716 swenum - ok12:41:08.0281 3716 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys12:41:08.0281 3716 swmidi - ok12:41:08.0328 3716 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys12:41:08.0328 3716 symc810 - ok12:41:08.0359 3716 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys12:41:08.0359 3716 symc8xx - ok12:41:08.0390 3716 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys12:41:08.0390 3716 sym_hi - ok12:41:08.0406 3716 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys12:41:08.0406 3716 sym_u3 - ok12:41:08.0437 3716 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys12:41:08.0437 3716 sysaudio - ok12:41:08.0500 3716 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys12:41:08.0500 3716 Tcpip - ok12:41:08.0562 3716 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys12:41:08.0562 3716 TDPIPE - ok12:41:08.0609 3716 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys12:41:08.0609 3716 TDTCP - ok12:41:08.0656 3716 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys12:41:08.0656 3716 TermDD - ok12:41:08.0718 3716 TIEHDUSB (a1124ebc672aa3ae1b327096c1dcc346) C:\WINDOWS\system32\drivers\tiehdusb.sys12:41:08.0718 3716 TIEHDUSB - ok12:41:08.0734 3716 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys12:41:08.0734 3716 TosIde - ok12:41:08.0765 3716 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys12:41:08.0765 3716 Udfs - ok12:41:08.0781 3716 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys12:41:08.0781 3716 ultra - ok12:41:08.0828 3716 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys12:41:08.0843 3716 Update - ok12:41:08.0906 3716 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys12:41:08.0906 3716 USBAAPL - ok12:41:08.0968 3716 usbbus (d9f3bb7c292f194f3b053ce295754eb8) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys12:41:08.0968 3716 usbbus - ok12:41:09.0031 3716 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys12:41:09.0031 3716 usbccgp - ok12:41:09.0093 3716 UsbDiag (c4f77da649f99fad116ea585376fc164) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys12:41:09.0093 3716 UsbDiag - ok12:41:09.0125 3716 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys12:41:09.0125 3716 usbehci - ok12:41:09.0140 3716 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys12:41:09.0140 3716 usbhub - ok12:41:09.0187 3716 USBModem (c0613ce45e617bc671de8ebb1b30d175) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys12:41:09.0187 3716 USBModem - ok12:41:09.0218 3716 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys12:41:09.0218 3716 usbprint - ok12:41:09.0250 3716 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys12:41:09.0265 3716 usbscan - ok12:41:09.0296 3716 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS12:41:09.0296 3716 USBSTOR - ok12:41:09.0421 3716 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys12:41:09.0421 3716 usbuhci - ok12:41:09.0500 3716 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys12:41:09.0500 3716 VgaSave - ok12:41:09.0562 3716 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys12:41:09.0562 3716 viaagp - ok12:41:09.0578 3716 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys12:41:09.0578 3716 ViaIde - ok12:41:09.0625 3716 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys12:41:09.0625 3716 VolSnap - ok12:41:09.0656 3716 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys12:41:09.0656 3716 Wanarp - ok12:41:09.0656 3716 WDICA - ok12:41:09.0687 3716 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys12:41:09.0687 3716 wdmaud - ok12:41:09.0765 3716 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys12:41:09.0765 3716 WpdUsb - ok12:41:09.0812 3716 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys12:41:09.0812 3716 WudfPf - ok12:41:09.0812 3716 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys12:41:09.0812 3716 WudfRd - ok12:41:09.0875 3716 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR012:41:10.0015 3716 \Device\Harddisk0\DR0 - ok12:41:10.0015 3716 Boot (0x1200) (91629b6e96fb0a4afda12ff125df158e) \Device\Harddisk0\DR0\Partition012:41:10.0031 3716 \Device\Harddisk0\DR0\Partition0 - ok12:41:10.0031 3716 ============================================================12:41:10.0031 3716 Scan finished12:41:10.0031 3716 ============================================================12:41:10.0031 3504 Detected object count: 112:41:10.0031 3504 Actual detected object count: 112:41:22.0296 3504 sptd ( LockedFile.Multi.Generic ) - skipped by user12:41:22.0296 3504 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 12:41:24.0796 3892 Deinitialize success12:25:09 Marty MESSAGE Protection started successfully12:25:16 Marty MESSAGE IP Protection started successfully12:25:17 Marty MESSAGE IP Protection stoppedComboFix 11-10-13.05 - Marty 10/13/2011 19:20:16.1.2 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1013.268 [GMT -5:00]Running from: c:\documents and settings\Marty\Desktop\ComboFix.exeAV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}AV: Norton AntiVirus *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\documents and settings\All Users\SPL3.tmpc:\documents and settings\All Users\SPL4.tmpc:\documents and settings\Marty\Application Data\Mozilla\Firefox\Profiles\2c0zpddr.default\extensions\{5787493a-d295-4162-9c7b-351471eb4bf5}c:\documents and settings\Marty\Application Data\Mozilla\Firefox\Profiles\2c0zpddr.default\extensions\{5787493a-d295-4162-9c7b-351471eb4bf5}\chrome.manifestc:\documents and settings\Marty\Application Data\Mozilla\Firefox\Profiles\2c0zpddr.default\extensions\{5787493a-d295-4162-9c7b-351471eb4bf5}\chrome\xulcache.jarc:\documents and settings\Marty\Application Data\Mozilla\Firefox\Profiles\2c0zpddr.default\extensions\{5787493a-d295-4162-9c7b-351471eb4bf5}\defaults\preferences\xulcache.jsc:\documents and settings\Marty\Application Data\Mozilla\Firefox\Profiles\2c0zpddr.default\extensions\{5787493a-d295-4162-9c7b-351471eb4bf5}\install.rdfc:\documents and settings\Marty\Application Data\OpenCloud Securityc:\documents and settings\Marty\My Documents\My Documents.urlc:\documents and settings\Marty\My Documents\My Music\My Music.urlc:\documents and settings\Marty\My Documents\My Pictures\My Pictures.urlc:\documents and settings\Marty\My Documents\My Videos\My Video.urlc:\documents and settings\Marty\puvdeoczhw.tmpc:\documents and settings\Marty\WINDOWSc:\program files\Applications\myd.icoc:\program files\Applications\mym.icoc:\program files\Applications\myp.icoc:\program files\Applications\myv.icoc:\program files\Applications\ot.icoc:\program files\Applications\ts.icoc:\program files\Commonc:\program files\Sharedc:\program files\Shared\shared.sigc:\windows\621819276c:\windows\settings.regc:\windows\system32\512686c:\windows\system32\accesor32.dllc:\windows\system32\asferror32.dllc:\windows\system32\audiodev32.dllc:\windows\system32\audiosrv32.dllc:\windows\system32\cic32.dllc:\windows\system32\d3d9caps.datc:\windows\system32\inetpp32.dllc:\windows\system32\ipsmsnap32.dllc:\windows\system32\jobexec32.dllc:\windows\system32\kbdest32.dllc:\windows\system32\kbdfi32.dllc:\windows\system32\kbdhela332.dllc:\windows\system32\kbdhu132.dllc:\windows\system32\kbdinbe132.dllc:\windows\system32\kbdla32.dllc:\windows\system32\kbdmon32.dllc:\windows\system32\kbdnepr32.dllc:\windows\system32\kbdsf32.dllc:\windows\system32\kbdsl32.dllc:\windows\system32\kbdsl3232.dllc:\windows\system32\kbdukx32.dllc:\windows\system32\localsec32.dllc:\windows\system32\mchgrcoi32.dllc:\windows\system32\mciseq32.dllc:\windows\system32\MFC71u32.dllc:\windows\system32\MFPLAT32.dllc:\windows\system32\mimefilt32.dllc:\windows\system32\mll_mtf32.dllc:\windows\system32\mll_qic32.dllc:\windows\system32\mmcfxcommon32.dllc:\windows\system32\modex32.dllc:\windows\system32\moricons32.dllc:\windows\system32\msacm3232.dllc:\windows\system32\mscpxl3232.dllc:\windows\system32\msctfp32.dllc:\windows\system32\msfeeds32.dllc:\windows\system32\msorcl3232.dllc:\windows\system32\mspmsp32.dllc:\windows\system32\msvcirt32.dllc:\windows\system32\narrhook32.dllc:\windows\system32\ptpusd32.dllc:\windows\system32\Q_COMM32.dllc:\windows\system32\rnaph.dllc:\windows\system32\samlib32.dllc:\windows\system32\windowscodecsext32.dllc:\windows\system32\wowfaxui32.dllc:\windows\system32\wpdtrace32.dllc:\windows\system32\wstdecod32.dllc:\windows\system32\xmlprovi32.dll..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_8c351025..((((((((((((((((((((((((( Files Created from 2011-09-14 to 2011-10-14 )))))))))))))))))))))))))))))))..2011-10-13 21:54 . 2011-10-13 21:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-10-13 21:54 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-10-13 20:40 . 2011-10-13 21:49 -------- d-----w- C:\TDSSKiller_Quarantine2011-10-10 20:52 . 2011-10-10 20:52 -------- d-----w- c:\documents and settings\Marty\Application Data\SUPERAntiSpyware.com2011-10-10 20:52 . 2011-10-10 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com2011-10-10 00:09 . 2011-10-10 00:13 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe2011-10-04 22:55 . 2011-10-04 22:55 -------- d-----w- c:\documents and settings\Marty\Application Data\AVG20122011-10-04 22:54 . 2011-10-04 22:54 -------- d-----w- c:\documents and settings\Marty\Application Data\AVG Secure Search2011-10-04 22:53 . 2011-10-04 22:53 -------- d-----w- c:\program files\Common Files\AVG Secure Search2011-10-04 22:53 . 2011-10-04 22:54 -------- d-----w- c:\program files\AVG Secure Search2011-10-04 22:52 . 2011-10-07 19:53 -------- d-----w- c:\windows\system32\drivers\AVG2011-10-04 22:52 . 2011-10-04 23:09 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG20122011-10-04 22:21 . 2011-10-04 22:24 -------- d-----w- c:\documents and settings\Administrator2011-09-29 22:07 . 2011-09-29 22:07 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files2011-09-29 22:06 . 2011-10-09 18:30 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData2011-09-29 21:48 . 2011-09-29 21:48 -------- d-----w- c:\documents and settings\Marty\Application Data\Malwarebytes2011-09-29 21:48 . 2011-09-29 21:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2011-09-26 16:41 . 2011-09-26 16:41 220160 ------w- c:\windows\system32\dllcache\oleacc.dll2011-09-26 16:41 . 2011-09-26 16:41 20480 ------w- c:\windows\system32\dllcache\oleaccrc.dll2011-09-26 16:24 . 2011-09-26 16:24 -------- d-----w- c:\documents and settings\LocalService\Application Data\Apple Computer2011-09-26 15:43 . 2011-09-26 15:43 -------- d-----w- c:\program files\iPod2011-09-26 15:43 . 2011-09-26 15:44 -------- d-----w- c:\program files\iTunes2011-09-26 15:38 . 2011-09-26 15:38 -------- d-----w- c:\program files\Bonjour2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll2011-09-26 15:36 . 2011-09-26 15:36 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll2011-09-26 15:35 . 2011-09-26 15:36 -------- d-----w- c:\program files\QuickTime...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-10-13 20:42 . 2004-08-10 18:51 162816 ----a-w- c:\windows\system32\drivers\netbt.sys2011-09-26 16:41 . 2008-07-30 01:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll2011-09-26 16:41 . 2004-08-10 18:51 220160 ----a-w- c:\windows\system32\oleacc.dll2011-09-26 16:41 . 2004-08-10 18:51 20480 ----a-w- c:\windows\system32\oleaccrc.dll2011-09-13 11:30 . 2011-07-11 06:13 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys2011-09-09 09:12 . 2004-08-10 18:50 599040 ----a-w- c:\windows\system32\crypt32.dll2011-09-06 13:20 . 2004-08-10 18:51 1858944 ----a-w- c:\windows\system32\win32k.sys2011-08-22 23:48 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll2011-08-22 23:48 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll2011-08-22 23:48 . 2004-08-10 18:51 1469440 ------w- c:\windows\system32\inetcpl.cpl2011-08-22 11:56 . 2004-08-10 18:51 385024 ----a-w- c:\windows\system32\html.iec2011-08-17 13:49 . 2004-08-10 18:50 138496 ----a-w- c:\windows\system32\drivers\afd.sys2011-08-08 11:08 . 2011-08-08 11:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]2011-10-04 22:53 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-10-04 1451336].[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}][HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1][HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj].[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DellAutomatedPCTuneUp"="c:\program files\DellAutomatedPCTuneUp\PTAgnt.exe" [2007-10-11 465136]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-26 39408]"SetDefaultMIDI"="MIDIDef.exe" [2002-12-03 49152].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-14 142104]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-14 162584]"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-14 138008]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]"RTHDCPL"="RTHDCPL.EXE" [2007-04-26 16132608]"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]"Broadcom Wireless Manager"="c:\windows\system32\wltray.exe" [2007-03-02 1282048]"lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 291760]"lxddamon"="c:\program files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 20480]"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-14 221184]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-14 81920]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]"CTSysVol"="c:\program files\RocketFish\RF5.1\Surround Mixer\CTSysVol.exe" [2007-09-05 57344]"P17Helper"="P17.dll" [2009-02-26 65536]"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-19 421736]"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-09-23 2404704]"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-10-04 218440]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608].c:\documents and settings\Marty\Start Menu\Programs\Startup\Billminder.lnk - c:\quickenw\billmind.exe [2009-4-19 33280].c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-1-15 7168]Dynex Wireless Networking Utility.lnk - c:\program files\Dynex Enhanced G Desktop Card Adapter\DynexWCUI.exe [2008-4-11 1462272].[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart.[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusOverride"=dword:00000001.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"="c:\\Program Files\\Lexmark 2500 Series\\App4R.exe"="c:\\WINDOWS\\system32\\lxddcoms.exe"="c:\\Program Files\\Pocket Tanks Deluxe\\pockettanks.exe"="c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\WINDOWS\\system32\\dplaysvr.exe"="c:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"="c:\\Program Files\\Firefly Studios\\Stronghold\\Stronghold.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddwbgw.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddjswx.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"="c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"="c:\\Program Files\\FrostWire\\FrostWire.exe"="c:\\Program Files\\uTorrent\\uTorrent.exe"="c:\\Documents and Settings\\Marty\\My Documents\\My Games\\Halo\\Halo\\halo.exe"="c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"="c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"="c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"="c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"="c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"=.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol"10426:UDP"= 10426:UDP:SingleClick ICC"135:TCP"= 135:TCP:TCP Port 135"5000:TCP"= 5000:TCP:TCP Port 5000"5001:TCP"= 5001:TCP:TCP Port 5001"5002:TCP"= 5002:TCP:TCP Port 5002"5003:TCP"= 5003:TCP:TCP Port 5003"5004:TCP"= 5004:TCP:TCP Port 5004"5005:TCP"= 5005:TCP:TCP Port 5005"5006:TCP"= 5006:TCP:TCP Port 5006"5007:TCP"= 5007:TCP:TCP Port 5007"5008:TCP"= 5008:TCP:TCP Port 5008"5009:TCP"= 5009:TCP:TCP Port 5009"5010:TCP"= 5010:TCP:TCP Port 5010"5011:TCP"= 5011:TCP:TCP Port 5011"5012:TCP"= 5012:TCP:TCP Port 5012"5013:TCP"= 5013:TCP:TCP Port 5013"5014:TCP"= 5014:TCP:TCP Port 5014"5015:TCP"= 5015:TCP:TCP Port 5015"5016:TCP"= 5016:TCP:TCP Port 5016"5017:TCP"= 5017:TCP:TCP Port 5017"5018:TCP"= 5018:TCP:TCP Port 5018"5019:TCP"= 5019:TCP:TCP Port 5019"5020:TCP"= 5020:TCP:TCP Port 5020"3461:UDP"= 3461:UDP:Windows Media Format SDK (iexplore.exe)"3460:UDP"= 3460:UDP:Windows Media Format SDK (iexplore.exe)"3476:UDP"= 3476:UDP:Windows Media Format SDK (iexplore.exe)"58377:TCP"= 58377:TCP:Pando Media Booster"58377:UDP"= 58377:UDP:Pando Media Booster"3074:TCP"= 3074:TCP:xboxTCP3074"88:UDP"= 88:UDP:xboxUDP88"3074:UDP"= 3074:UDP:xboxUDP3074"53:UDP"= 53:UDP:xboxUDP53"53:TCP"= 53:TCP:xboxTCP53.R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7/11/2011 1:13 AM 32592]R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/11/2011 1:13 AM 229840]R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [4/26/2007 12:21 AM 99248]R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/13/2011 4:54 PM 366152]R2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [10/4/2011 5:53 PM 246600]R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [7/11/2011 1:14 AM 16720]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/13/2011 4:54 PM 22216]S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [9/12/2011 6:23 AM 5265248]S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/8/2010 10:22 PM 135664]S3 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/8/2010 10:22 PM 135664]S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 2:37 PM 517096].Contents of the 'Scheduled Tasks' folder.2011-10-03 c:\windows\Tasks\AdobeAAMUpdater-1.0-D6LF4HF1-Marty.job- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-03-09 09:44].2011-09-26 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 18:34].2011-10-14 c:\windows\Tasks\Google Software Updater.job- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-26 16:53].2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-09 03:22].2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-09 03:22]..------- Supplementary Scan -------.uStart Page = hxxp://www.yahoo.com/uSearchMigratedDefaultURL = hxxp://windiwsfsearch.com/search?q={searchTerms}mStart Page = hxxp://www.yahoo.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://windiwsfsearch.comuSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.commSearchURL = hxxp://windiwsfsearch.comTCP: DhcpNameServer = 192.168.0.1Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll.- - - - ORPHANS REMOVED - - - -.Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)Toolbar-Locked - (no file)HKCU-Run-VResLab - c:\program files\VResLab\VResLab.exeHKCU-Run-wblogon - c:\windows\system32\algg.exeHKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exeHKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exeHKLM-Run-ANTIVIRUS - c:\program files\AAV\AAV.exeHKLM-RunOnce-AvgRemover - c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\R6N771J4\avg_remover_stf_x86_2012_1796[1].exeSafeBoot-65634666.sys...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2011-10-14 12:24Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]"ImagePath"="c:\windows\system32\GameMon.des -service".--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'winlogon.exe'(968)c:\windows\System32\BCMLogon.dll.- - - - - - - > 'explorer.exe'(2132)c:\windows\system32\WININET.dllc:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\windows\System32\wltrysvc.exec:\windows\System32\bcmwltry.exec:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Dell Network Assistant\hnm_svc.exec:\program files\Java\jre6\bin\jqs.exec:\windows\system32\lxddcoms.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEc:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\windows\system32\igfxsrvc.exec:\windows\system32\Rundll32.exec:\program files\Dell Network Assistant\ezi_hnm2.exec:\program files\iPod\bin\iPodService.exe.**************************************************************************.Completion time: 2011-10-14 12:35:53 - machine was rebootedComboFix-quarantined-files.txt 2011-10-14 17:35.Pre-Run: 19,189,657,600 bytes freePost-Run: 21,966,082,048 bytes free.- - End Of File - - B4EE895B179F9F1462BC3ECE043D63B3 Link to post Share on other sites More sharing options...
Phillefann15 Posted October 14, 2011 Author ID:485805 Share Posted October 14, 2011 Malwarebytes...Database version: 7941Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.1870210/14/2011 1:04:12 PMmbam-log-2011-10-14 (13-03-51).txtScan type: Quick scanObjects scanned: 220427Time elapsed: 8 minute(s), 31 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 4Registry Values Infected: 2Registry Data Items Infected: 5Folders Infected: 1Files Infected: 3Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\AppID\{A0E1054B-01EE-4D57-A059-4D99F339709F} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\Typelib\{8E3C68CD-F500-4A2A-8CB9-132BB38C3573} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\Interface\{986A8AC1-AB4D-4F41-9068-4B01C0197867} (Trojan.BHO) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} (Search.Hijacker) -> No action taken.Registry Values Infected:HKEY_CLASSES_ROOT\AppID\main.DLL\AppID (Adware.DeepDive) -> Value: AppID -> No action taken.HKEY_CLASSES_ROOT\main.BHO.1\CLSID\(default) (Adware.DeepDive) -> Value: (default) -> No action taken.Registry Data Items Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.SearchPage) -> Bad: (http://windiwsfsearch.com) Good: (http://www.Google.com/) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.SearchPage) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.Google.com/) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.SearchPage) -> Bad: (http://windiwsfsearch.com) Good: (http://www.Google.com/) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.SearchPage) -> Bad: (http://windiwsfsearch.com) Good: (http://www.Google.com/) -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\(default) (Hijack.SearchPage) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.Google.com/) -> No action taken.Folders Infected:c:\documents and settings\Conner\start menu\Programs\opencloud security (Rogue.OpenCloudSecurity) -> No action taken.Files Infected:c:\documents and settings\Marty\favorites\antivirus scan.url (Rogue.Link) -> No action taken.c:\documents and settings\Conner\Desktop\opencloud security.lnk (Rogue.OpenCloudSecurity) -> No action taken.c:\documents and settings\Conner\start menu\Programs\opencloud security\opencloud security.lnk (Rogue.OpenCloudSecurity) -> No action taken.DDS.....DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702Run by Marty at 12:56:51 on 2011-10-14Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1013.141 [GMT -5:00].AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}AV: Norton AntiVirus *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}.============== Running Processes ===============.C:\WINDOWS\system32\svchost.exe -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupsvchost.exesvchost.exeC:\WINDOWS\System32\wltrysvc.exeC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\spoolsv.exesvchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Dell Network Assistant\hnm_svc.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exeC:\WINDOWS\system32\lxddcoms.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\WINDOWS\system32\wltray.exeC:\Program Files\Lexmark 2500 Series\lxddmon.exeC:\Program Files\Lexmark 2500 Series\lxddamon.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\svchost.exe -k HTTPFilterC:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeC:\Program Files\RocketFish\RF5.1\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\PowerISO\PWRISOVM.EXEC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\AVG\AVG2012\avgtray.exeC:\Program Files\AVG Secure Search\vprot.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\DellAutomatedPCTuneUp\PTAgnt.exeC:\Program Files\Dell Network Assistant\ezi_hnm2.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Dynex Enhanced G Desktop Card Adapter\DynexWCUI.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\notepad.exeC:\Program Files\internet explorer\iexplore.exeC:\Program Files\internet explorer\iexplore.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\WINDOWS\system32\taskmgr.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.yahoo.com/uSearchMigratedDefaultURL = hxxp://windiwsfsearch.com/search?q={searchTerms}mStart Page = hxxp://www.yahoo.com/uInternet Settings,ProxyOverride = *.local;<local>uSearchAssistant = hxxp://windiwsfsearch.comuSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.commSearchURL = hxxp://windiwsfsearch.comBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dllBHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dllBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dllBHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dllTB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\8.0.0.34\AVG Secure Search_toolbar.dllTB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No FileuRun: [DellAutomatedPCTuneUp] "c:\program files\dellautomatedpctuneup\PTAgnt.exe" /startupuRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [setDefaultMIDI] MIDIDef.exemRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [RTHDCPL] RTHDCPL.EXEmRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"mRun: [broadcom Wireless Manager] c:\windows\system32\wltray.exemRun: [lxddmon.exe] "c:\program files\lexmark 2500 series\lxddmon.exe"mRun: [lxddamon] "c:\program files\lexmark 2500 series\lxddamon.exe"mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startupmRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exemRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resumemRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [CTSysVol] c:\program files\rocketfish\rf5.1\surround mixer\CTSysVol.exe /rmRun: [P17Helper] Rundll32 P17.dll,P17HelpermRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXEmRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exemRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbyloginmRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"mRun: [vProt] "c:\program files\avg secure search\vprot.exe"mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttrayStartupFolder: c:\docume~1\marty\startm~1\programs\startup\billmi~1.lnk - c:\quickenw\billmind.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellne~1.lnk - c:\windows\installer\{0240bdfb-2995-4a3f-8c96-18d41282b716}\Icon0240BDFB3.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dynexw~1.lnk - c:\program files\dynex enhanced g desktop card adapter\DynexWCUI.exeIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dllIE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLDPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{418B4E6C-D257-415F-B747-C1EEAB893852} : DhcpNameServer = 192.168.0.1TCP: Interfaces\{C1C904E7-A977-4024-AA68-A2BF60484A17} : DhcpNameServer = 192.168.0.1Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dllHandler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\8.0.1\ViProtocol.dllNotify: igfxcui - igfxdev.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll.============= SERVICES / DRIVERS ===============.R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-7-11 32592]R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 229840]R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2007-4-26 99248]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-10-13 366152]R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\8.0.1\ToolbarUpdater.exe [2011-10-4 246600]R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608]R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-7-11 16720]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-10-13 22216]R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-10-14 41272]S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-9-12 5265248]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-8 135664]S3 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]S3 cpuz132;cpuz132;\??\c:\docume~1\marty\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\marty\locals~1\temp\cpuz132\cpuz132_x32.sys [?]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-8 135664]S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096].=============== Created Last 30 ================.2011-10-14 17:42:49 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-10-13 22:03:59 -------- d-sha-r- C:\cmdcons2011-10-13 21:59:47 98816 ----a-w- c:\windows\sed.exe2011-10-13 21:59:47 518144 ----a-w- c:\windows\SWREG.exe2011-10-13 21:59:47 256000 ----a-w- c:\windows\PEV.exe2011-10-13 21:59:47 208896 ----a-w- c:\windows\MBR.exe2011-10-13 21:54:33 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-10-13 21:54:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-10-13 20:40:07 -------- d-----w- C:\TDSSKiller_Quarantine2011-10-10 20:52:39 -------- d-----w- c:\documents and settings\marty\application data\SUPERAntiSpyware.com2011-10-10 20:52:12 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com2011-10-04 22:55:45 -------- d-----w- c:\documents and settings\marty\application data\AVG20122011-10-04 22:54:00 -------- d-----w- c:\documents and settings\marty\application data\AVG Secure Search2011-10-04 22:53:55 -------- d-----w- c:\program files\common files\AVG Secure Search2011-10-04 22:53:54 -------- d-----w- c:\program files\AVG Secure Search2011-10-04 22:52:53 -------- d-----w- c:\windows\system32\drivers\AVG2011-10-04 22:52:53 -------- d-----w- c:\documents and settings\all users\application data\AVG20122011-09-29 22:07:12 -------- d--h--w- c:\documents and settings\all users\application data\Common Files2011-09-29 22:06:59 -------- d-----w- c:\documents and settings\all users\application data\MFAData2011-09-29 21:48:28 -------- d-----w- c:\documents and settings\marty\application data\Malwarebytes2011-09-29 21:48:19 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes2011-09-26 16:41:20 220160 ------w- c:\windows\system32\dllcache\oleacc.dll2011-09-26 16:41:14 20480 ------w- c:\windows\system32\dllcache\oleaccrc.dll2011-09-26 15:43:30 -------- d-----w- c:\program files\iPod2011-09-26 15:43:24 -------- d-----w- c:\program files\iTunes2011-09-26 15:38:24 -------- d-----w- c:\program files\Bonjour2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll2011-09-26 15:36:05 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll.==================== Find3M ====================.2011-10-13 20:42:23 162816 ----a-w- c:\windows\system32\drivers\netbt.sys2011-09-26 16:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll2011-09-26 16:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll2011-09-26 16:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll2011-09-13 11:30:10 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys2011-08-22 23:48:55 916480 ----a-w- c:\windows\system32\wininet.dll2011-08-22 23:48:54 43520 ----a-w- c:\windows\system32\licmgr10.dll2011-08-22 23:48:54 1469440 ------w- c:\windows\system32\inetcpl.cpl2011-08-22 11:56:39 385024 ----a-w- c:\windows\system32\html.iec2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys.============= FINISH: 13:04:20.78 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted October 18, 2011 Staff ID:486799 Share Posted October 18, 2011 Did you uninstall AVG or Norton?Next, please run a free online scan with the ESET Online ScannerNote: You will need to use Internet Explorer for this scan.Tick the box next to YES, I accept the Terms of Use.Click StartWhen asked, allow the ActiveX control to installClick StartMake sure that the options Remove found threats and the option Scan unwanted applications is checkedClick ScanWait for the scan to finishUse Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topicNext, download my Security Check from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.Let me know how things are running now and what issues remain.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted October 31, 2011 Staff ID:490569 Share Posted October 31, 2011 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff screen317 Posted November 5, 2011 Staff ID:492070 Share Posted November 5, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts