1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved My Last Resort - 4 Days In, Cannot Fully Clean/Remove Problem

Discussion in 'Malware and Virus Removal Archive' started by tmricha, 2011/01/27.

Page 1 of 2
  1. 2011/01/27
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    [Resolved] My Last Resort - 4 Days In, Cannot Fully Clean/Remove Problem

    First time user of this site, but I've seen tons of great posts so I am turning to you for help.

    I have been working on de-crapifying an IBM T42 laptop for the last few days and there is something persistent that nothing has been able to get to/fix.

    Never before have I had this problem. Ever. (MIS degree, worked corporate IT, sm business IT, etc).

    Im very experience with all the tools and have used most of them in my attempts to no avail.

    For the most part the machine is now clean - except:
    - no windowsupdate URLS will load....says page cannot be displayed.
    - Google Search Results are still being hijacked upon click.


    Here's what Ive done more or less.

    CCLeaner
    MalwareBytes Anti Malware
    SuperAntiSpyware
    Spybot Search and Destroy

    All come up clean.

    ComboFix will not run (always hangs at "Scanning for infected... may easily double ") [side note, I have another T42 that ComboFix would never run on either...]

    Ive tried RKill to stop anything immediately followed by a renamed ComboFix. It still hangs.

    Whatever it is nothing is picking it up but the problem persists.

    I turn to you for your expertise.

    Im all ears on where to proceed from here.

    Thanks in advance
    (Im open to just reformatting the thing and starting over - but now its just a mission to catch this dang thing!!!)
     
    tmricha,
    #1
  2. 2011/01/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    Welcome to WindowsBBS :)

    Please read this as indicated at the head of the forum and post the logs requested in this thread.

    As a new member with less than 10 posts any post you make which contains a URL requires approval (moderation) before it is visible.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    Logs & Such

    Below are the logs as requested.

    One item of note: DDS & GMER would never fully run (not regular, not with disabling devices, not in Safe Mode). Some times GMER would finish the "automatic quick scan ", but it would always hang at some point after clicking Scan. The results of the "automatic quick scan" are below.

    Malwarebytes (MBAM)
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5629

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    1/28/2011 7:43:54 AM
    mbam-log-2011-01-28 (07-43-54).txt

    Scan type: Quick scan
    Objects scanned: 147928
    Time elapsed: 7 minute(s), 19 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    GMER (automatic quick scan results only)


    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-01-28 08:43:41
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 HTS424040M9AT00 rev.MA2IA75A
    Running: y6ohyvbi.exe; Driver: C:\DOCUME~1\ERICRI~1\LOCALS~1\Temp\kgldypod.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 01: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 03: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872D039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872D039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 872D039B

    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

    Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskHTS424040M9AT00_________________________MA2IA75A#5&2cae0b77&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- EOF - GMER 1.0.15 ----


    MBRCheck
    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 145):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EC000 \WINDOWS\system32\hal.dll
    0x872EF000 \WINDOWS\system32\KDCOM.DLL
    0xF7AF5000 \WINDOWS\system32\BOOTVID.dll
    0xF7692000 ACPI.sys
    0xF7BE1000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
    0xF7681000 pci.sys
    0xF76E1000 isapnp.sys
    0xF7AF9000 compbatt.sys
    0xF7AFD000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF7CA9000 pciide.sys
    0xF7961000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
    0xF7663000 pcmcia.sys
    0xF76F1000 MountMgr.sys
    0xF7644000 ftdisk.sys
    0xF7B01000 ACPIEC.sys
    0xF7CAA000 \WINDOWS\System32\DRIVERS\OPRGHDLR.SYS
    0xF7969000 PartMgr.sys
    0xF7701000 Shockprf.sys
    0xF7711000 VolSnap.sys
    0xF762C000 atapi.sys
    0xF7721000 disk.sys
    0xF7731000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    0xF760D000 fltmgr.sys
    0xF75FB000 sr.sys
    0xF7741000 PxHelp20.sys
    0xF75E4000 KSecDD.sys
    0xF7557000 Ntfs.sys
    0xF752A000 NDIS.sys
    0xF750F000 Mup.sys
    0xF7751000 agp440.sys
    0xF7921000 \SystemRoot\System32\DRIVERS\intelppm.sys
    0xF68A9000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF6895000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF79C9000 \SystemRoot\System32\DRIVERS\usbuhci.sys
    0xF6872000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
    0xF79D1000 \SystemRoot\System32\DRIVERS\usbehci.sys
    0xF6853000 \SystemRoot\System32\DRIVERS\e1000325.sys
    0xF7931000 \SystemRoot\System32\DRIVERS\i8042prt.sys
    0xF79D9000 \SystemRoot\System32\DRIVERS\kbdclass.sys
    0xF6810000 \SystemRoot\System32\DRIVERS\SynTP.sys
    0xF7C1D000 \SystemRoot\System32\DRIVERS\USBD.SYS
    0xF79E1000 \SystemRoot\System32\DRIVERS\mouclass.sys
    0xF79E9000 \SystemRoot\System32\DRIVERS\fdc.sys
    0xF77A1000 \SystemRoot\System32\DRIVERS\serial.sys
    0xF74CA000 \SystemRoot\System32\DRIVERS\serenum.sys
    0xF67FC000 \SystemRoot\System32\DRIVERS\parport.sys
    0xF79F1000 \SystemRoot\System32\DRIVERS\nscirda.sys
    0xF74C6000 \SystemRoot\System32\DRIVERS\irenum.sys
    0xF74BE000 \SystemRoot\System32\DRIVERS\CmBatt.sys
    0xF79F9000 \SystemRoot\System32\DRIVERS\ibmpmdrv.sys
    0xF7941000 \SystemRoot\System32\DRIVERS\imapi.sys
    0xF7951000 \SystemRoot\System32\DRIVERS\cdrom.sys
    0xF7781000 \SystemRoot\System32\DRIVERS\redbook.sys
    0xF67D9000 \SystemRoot\System32\DRIVERS\ks.sys
    0xF6797000 \SystemRoot\system32\drivers\smwdm.sys
    0xF6773000 \SystemRoot\system32\drivers\portcls.sys
    0xF7791000 \SystemRoot\system32\drivers\drmk.sys
    0xF6757000 \SystemRoot\system32\drivers\aeaudio.sys
    0xF6726000 \SystemRoot\system32\DRIVERS\HSFHWICH.sys
    0xF6627000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
    0xF6581000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF7A01000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7D2B000 \SystemRoot\System32\DRIVERS\audstub.sys
    0xF7C1F000 \SystemRoot\System32\Drivers\RootMdm.sys
    0xF7A09000 \SystemRoot\System32\DRIVERS\rasirda.sys
    0xF7A11000 \SystemRoot\System32\DRIVERS\TDI.SYS
    0xF77B1000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
    0xF7B7D000 \SystemRoot\System32\DRIVERS\ndistapi.sys
    0xF656A000 \SystemRoot\System32\DRIVERS\ndiswan.sys
    0xF6A14000 \SystemRoot\System32\DRIVERS\raspppoe.sys
    0xF6A04000 \SystemRoot\System32\DRIVERS\raspptp.sys
    0xF6559000 \SystemRoot\System32\DRIVERS\psched.sys
    0xF69F4000 \SystemRoot\System32\DRIVERS\msgpc.sys
    0xF7A19000 \SystemRoot\System32\DRIVERS\ptilink.sys
    0xF7A21000 \SystemRoot\System32\DRIVERS\raspti.sys
    0xF7A29000 \SystemRoot\system32\DRIVERS\RimSerial.sys
    0xF6528000 \SystemRoot\System32\DRIVERS\rdpdr.sys
    0xF69E4000 \SystemRoot\System32\DRIVERS\termdd.sys
    0xF7C21000 \SystemRoot\System32\DRIVERS\swenum.sys
    0xF64F4000 \SystemRoot\System32\DRIVERS\update.sys
    0xF6E46000 \SystemRoot\System32\DRIVERS\mssmbios.sys
    0xF77E1000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF77F1000 \SystemRoot\System32\DRIVERS\usbhub.sys
    0xF7C67000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF7C9D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7DE0000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7C9F000 \SystemRoot\System32\Drivers\Beep.SYS
    0xA9820000 \SystemRoot\System32\drivers\vga.sys
    0xF7CA1000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7CA3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xA9818000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xA9810000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF6E3E000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0xA788C000 \SystemRoot\System32\DRIVERS\ipsec.sys
    0xA7834000 \SystemRoot\System32\DRIVERS\tcpip.sys
    0xA780C000 \SystemRoot\System32\DRIVERS\netbt.sys
    0xA77EA000 \SystemRoot\System32\drivers\afd.sys
    0xF77D1000 \SystemRoot\System32\DRIVERS\netbios.sys
    0xA9808000 \SystemRoot\System32\drivers\TSMAPIP.SYS
    0xF7A31000 \SystemRoot\System32\drivers\Tppwr.sys
    0xF6E36000 \SystemRoot\System32\Drivers\TPHKDRV.SYS
    0xF7A39000 \SystemRoot\System32\drivers\TDSMAPI.SYS
    0xF7A41000 \SystemRoot\System32\drivers\Smapint.sys
    0xF7CA5000 \SystemRoot\System32\Drivers\ShockMgr.SYS
    0xA7708000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF7A49000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xA76DC000 \SystemRoot\System32\DRIVERS\rdbss.sys
    0xA766D000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
    0xF7E01000 \SystemRoot\System32\drivers\IBMBLDID.SYS
    0xF7821000 \SystemRoot\System32\Drivers\Fips.SYS
    0xA764C000 \SystemRoot\System32\DRIVERS\ipnat.sys
    0xF7831000 \SystemRoot\System32\DRIVERS\wanarp.sys
    0xF7BBD000 \SystemRoot\System32\drivers\ANC.SYS
    0xF7871000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xA760C000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7BE3000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7AB9000 \SystemRoot\System32\watchdog.sys
    0xA7F9D000 \SystemRoot\System32\drivers\Dxapi.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7D23000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF04A000 \SystemRoot\System32\ati2cqag.dll
    0xBF084000 \SystemRoot\System32\ati3duag.dll
    0xBF2A7000 \SystemRoot\System32\ativvaxx.dll
    0xF5F90000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xA5ADA000 \SystemRoot\System32\DRIVERS\irda.sys
    0xA7628000 \SystemRoot\system32\DRIVERS\s24trans.sys
    0xF6354000 \SystemRoot\System32\DRIVERS\ndisuio.sys
    0xA59E5000 \SystemRoot\System32\DRIVERS\mrxdav.sys
    0xAA242000 \??\C:\WINDOWS\system32\drivers\ibmfilter.sys
    0xA5A5E000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xA5942000 \SystemRoot\System32\DRIVERS\srv.sys
    0xF7C91000 \??\C:\WINDOWS\SYSTEM32\Drivers\PMEMNT.SYS
    0xA57C5000 \SystemRoot\system32\drivers\wdmaud.sys
    0xAA1E2000 \SystemRoot\system32\drivers\sysaudio.sys
    0xF7C33000
    0xA57A2000
    0xA93AD000
    0xA939D000
    0xA5778000 \SystemRoot\system32\drivers\kmixer.sys
    0xF7D8E000
    0xA5487000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 21):
    0 System Idle Process
    4 System
    608 C:\WINDOWS\system32\smss.exe
    676 csrss.exe
    716 C:\WINDOWS\system32\winlogon.exe
    760 C:\WINDOWS\system32\services.exe
    772 C:\WINDOWS\system32\lsass.exe
    916 C:\WINDOWS\system32\svchost.exe
    996 svchost.exe
    1032 C:\WINDOWS\system32\svchost.exe
    1124 svchost.exe
    1288 svchost.exe
    1456 C:\WINDOWS\system32\spoolsv.exe
    1532 svchost.exe
    1688 C:\WINDOWS\system32\svchost.exe
    1732 wdfmgr.exe
    1896 C:\WINDOWS\system32\wuauclt.exe
    1992 alg.exe
    424 C:\WINDOWS\explorer.exe
    1076 wmiprvse.exe
    372 C:\Documents and Settings\Eric Richardson\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: HTS424040M9AT00, Rev: MA2IA75A

    Size Device Name MBR Status
    --------------------------------------------
    37 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: 571DD7ED9C04A93C65A1B320D02BAFE55EBE3FCF


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!

    DDS
    Never Completed A Scan - Always Stopped Responding
     
    tmricha,
    #3
  5. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard :)

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================================================

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
    broni,
    #4
  6. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    Ran TDSSKiller. It found one rootkit.
    Rebooted Machine. Back at desktop.

    Log Attached:
    2011/01/28 12:32:56.0252 TDSS rootkit removing tool 2.4.15.0 Jan 22 2011 19:37:53
    2011/01/28 12:32:56.0252 ================================================================================
    2011/01/28 12:32:56.0252 SystemInfo:
    2011/01/28 12:32:56.0252
    2011/01/28 12:32:56.0252 OS Version: 5.1.2600 ServicePack: 2.0
    2011/01/28 12:32:56.0252 Product type: Workstation
    2011/01/28 12:32:56.0252 ComputerName: ETRLAPTOP
    2011/01/28 12:32:56.0252 UserName: Eric Richardson
    2011/01/28 12:32:56.0252 Windows directory: C:\WINDOWS
    2011/01/28 12:32:56.0252 System windows directory: C:\WINDOWS
    2011/01/28 12:32:56.0252 Processor architecture: Intel x86
    2011/01/28 12:32:56.0252 Number of processors: 1
    2011/01/28 12:32:56.0252 Page size: 0x1000
    2011/01/28 12:32:56.0252 Boot type: Normal boot
    2011/01/28 12:32:56.0252 ================================================================================
    2011/01/28 12:32:56.0983 Initialize success
    2011/01/28 12:33:01.0009 ================================================================================
    2011/01/28 12:33:01.0009 Scan started
    2011/01/28 12:33:01.0009 Mode: Manual;
    2011/01/28 12:33:01.0009 ================================================================================
    2011/01/28 12:33:03.0703 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
    2011/01/28 12:33:04.0404 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
    2011/01/28 12:33:05.0135 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/01/28 12:33:05.0866 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
    2011/01/28 12:33:06.0557 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
    2011/01/28 12:33:07.0258 aeaudio (75bee80a25fc7f690dcd57570dc159c1) C:\WINDOWS\system32\drivers\aeaudio.sys
    2011/01/28 12:33:07.0959 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
    2011/01/28 12:33:08.0650 AegisP (f64a0e456d08e6cda801fe13a5996e86) C:\WINDOWS\system32\DRIVERS\AegisP.sys
    2011/01/28 12:33:09.0361 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
    2011/01/28 12:33:10.0102 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2011/01/28 12:33:11.0113 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
    2011/01/28 12:33:11.0824 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
    2011/01/28 12:33:12.0495 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
    2011/01/28 12:33:13.0176 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
    2011/01/28 12:33:13.0867 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
    2011/01/28 12:33:14.0458 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\System32\DRIVERS\alim1541.sys
    2011/01/28 12:33:15.0149 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\System32\DRIVERS\amdagp.sys
    2011/01/28 12:33:15.0840 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
    2011/01/28 12:33:16.0471 ANC (11ab185a7af224800bbfb5b836974a17) C:\WINDOWS\system32\drivers\ANC.SYS
    2011/01/28 12:33:17.0132 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
    2011/01/28 12:33:18.0053 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
    2011/01/28 12:33:18.0734 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
    2011/01/28 12:33:19.0455 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/01/28 12:33:20.0146 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/01/28 12:33:21.0759 ati2mtag (f0d0b0cdec0be32d775f404cac2604bf) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
    2011/01/28 12:33:22.0420 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/01/28 12:33:23.0101 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/01/28 12:33:23.0751 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/01/28 12:33:24.0452 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
    2011/01/28 12:33:25.0083 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/01/28 12:33:25.0734 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
    2011/01/28 12:33:26.0375 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/01/28 12:33:27.0046 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/01/28 12:33:27.0767 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/01/28 12:33:28.0979 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    2011/01/28 12:33:29.0720 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\System32\DRIVERS\cmdide.sys
    2011/01/28 12:33:30.0411 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    2011/01/28 12:33:31.0062 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
    2011/01/28 12:33:31.0813 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
    2011/01/28 12:33:32.0514 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
    2011/01/28 12:33:33.0165 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/01/28 12:33:34.0126 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/01/28 12:33:35.0088 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
    2011/01/28 12:33:35.0799 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/01/28 12:33:36.0450 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/01/28 12:33:37.0111 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
    2011/01/28 12:33:37.0912 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/01/28 12:33:38.0593 E1000 (8179a01475f75417011e27e322c7e0e3) C:\WINDOWS\system32\DRIVERS\e1000325.sys
    2011/01/28 12:33:39.0314 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    2011/01/28 12:33:39.0514 EGATHDRV (12bb0f2d065e181bd356a8f60e6f1cdc) C:\WINDOWS\GATHER.KM
    2011/01/28 12:33:41.0617 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/01/28 12:33:42.0298 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/01/28 12:33:43.0019 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
    2011/01/28 12:33:43.0700 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
    2011/01/28 12:33:44.0411 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/01/28 12:33:45.0062 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/01/28 12:33:45.0803 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/01/28 12:33:46.0494 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/01/28 12:33:47.0185 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
    2011/01/28 12:33:47.0946 HSFHWICH (62003dbef083dc07e5399f44fb4e22bc) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
    2011/01/28 12:33:49.0018 HSF_DP (f41cd40b94d91edf9443a527053ec549) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
    2011/01/28 12:33:50.0109 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/01/28 12:33:50.0850 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2011/01/28 12:33:51.0481 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\System32\DRIVERS\i2omp.sys
    2011/01/28 12:33:52.0182 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/01/28 12:33:52.0853 ibmfilter (4dc41ab5aa3f96fa7f01587dd9ccf467) C:\WINDOWS\system32\drivers\ibmfilter.sys
    2011/01/28 12:33:53.0494 IBMPMDRV (b9ad9ebe354af205277fdbfce5c5daec) C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
    2011/01/28 12:33:54.0115 IBMTPCHK (e4fa96158a283618a0e1807bfdc12230) C:\WINDOWS\system32\drivers\IBMBLDID.SYS
    2011/01/28 12:33:54.0786 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/01/28 12:33:55.0447 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
    2011/01/28 12:33:56.0128 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\System32\DRIVERS\intelide.sys
    2011/01/28 12:33:56.0939 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/01/28 12:33:57.0710 ip6fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/01/28 12:33:58.0391 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/01/28 12:33:59.0052 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/01/28 12:33:59.0743 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/01/28 12:34:00.0444 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/01/28 12:34:01.0165 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
    2011/01/28 12:34:01.0856 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/01/28 12:34:02.0527 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/01/28 12:34:03.0208 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/01/28 12:34:03.0919 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/01/28 12:34:04.0700 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/01/28 12:34:06.0162 ltmodem5 (9ee18a5a45552673a67532ea37370377) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
    2011/01/28 12:34:07.0014 mdmxsdk (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
    2011/01/28 12:34:07.0655 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/01/28 12:34:08.0255 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
    2011/01/28 12:34:08.0926 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/01/28 12:34:09.0607 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/01/28 12:34:10.0409 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
    2011/01/28 12:34:11.0140 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/01/28 12:34:12.0091 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/01/28 12:34:12.0932 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/01/28 12:34:13.0553 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/01/28 12:34:14.0194 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/01/28 12:34:14.0905 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/01/28 12:34:15.0536 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/01/28 12:34:16.0227 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
    2011/01/28 12:34:17.0018 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/01/28 12:34:17.0729 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/01/28 12:34:18.0360 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/01/28 12:34:19.0091 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/01/28 12:34:19.0792 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/01/28 12:34:20.0453 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/01/28 12:34:21.0194 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/01/28 12:34:21.0945 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/01/28 12:34:22.0556 NSCIRDA (6216798d29c3ba9d0d6f40bbbab694a5) C:\WINDOWS\system32\DRIVERS\nscirda.sys
    2011/01/28 12:34:23.0437 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/01/28 12:34:24.0228 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/01/28 12:34:24.0959 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/01/28 12:34:25.0600 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/01/28 12:34:26.0251 P3 (3e16eff2a6fed2d8d7f5a66dfe65d183) C:\WINDOWS\system32\DRIVERS\p3.sys
    2011/01/28 12:34:26.0942 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/01/28 12:34:27.0573 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/01/28 12:34:28.0234 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/01/28 12:34:28.0865 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/01/28 12:34:30.0147 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/01/28 12:34:30.0818 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
    2011/01/28 12:34:33.0732 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
    2011/01/28 12:34:34.0383 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
    2011/01/28 12:34:35.0124 PMEM (fa292805788528c083f416e151b60ab6) C:\WINDOWS\SYSTEM32\Drivers\PMEMNT.SYS
    2011/01/28 12:34:35.0775 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/01/28 12:34:36.0446 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
    2011/01/28 12:34:37.0107 psadd (dc23b0d9a0282cb0d8281dbda431ac14) C:\WINDOWS\system32\Drivers\psadd.sys
    2011/01/28 12:34:37.0768 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/01/28 12:34:38.0449 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/01/28 12:34:39.0080 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2011/01/28 12:34:39.0711 QCNDISIF (2feb0da5705df73ef15027512b998223) C:\WINDOWS\system32\drivers\qcndisif.SYS
    2011/01/28 12:34:40.0422 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
    2011/01/28 12:34:41.0083 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
    2011/01/28 12:34:41.0724 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\System32\DRIVERS\ql12160.sys
    2011/01/28 12:34:42.0354 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
    2011/01/28 12:34:43.0116 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
    2011/01/28 12:34:43.0777 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/01/28 12:34:44.0457 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
    2011/01/28 12:34:45.0158 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/01/28 12:34:45.0849 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/01/28 12:34:46.0520 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/01/28 12:34:47.0181 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/01/28 12:34:47.0922 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/01/28 12:34:48.0633 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/01/28 12:34:49.0375 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/01/28 12:34:50.0176 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/01/28 12:34:50.0857 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
    2011/01/28 12:34:51.0528 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
    2011/01/28 12:34:52.0189 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
    2011/01/28 12:34:52.0809 s24trans (f8e1a385d08204a461e19cd9bca2b461) C:\WINDOWS\system32\DRIVERS\s24trans.sys
    2011/01/28 12:34:53.0490 S3SSavage (a94aa8161dd4711bc6f732f21d6407d6) C:\WINDOWS\system32\DRIVERS\s3ssavm.sys
    2011/01/28 12:34:53.0691 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    2011/01/28 12:34:53.0891 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    2011/01/28 12:34:54.0582 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/01/28 12:34:55.0874 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/01/28 12:34:56.0555 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/01/28 12:34:57.0236 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/01/28 12:34:57.0897 ShockMgr (482ddb9f0f6d88f0503910e1b9728042) C:\WINDOWS\system32\drivers\ShockMgr.sys
    2011/01/28 12:34:58.0488 Shockprf (3d593b089133f134f52d6de29b0d058b) C:\WINDOWS\system32\drivers\Shockprf.sys
    2011/01/28 12:34:59.0770 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\System32\DRIVERS\sisagp.sys
    2011/01/28 12:35:00.0440 Smapint (26341d0dd225d19fd50e0ee3c3c77502) C:\WINDOWS\system32\drivers\Smapint.sys
    2011/01/28 12:35:01.0182 smwdm (710a9684bf50e6fe7c227b9de41159da) C:\WINDOWS\system32\drivers\smwdm.sys
    2011/01/28 12:35:01.0913 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
    2011/01/28 12:35:02.0564 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
    2011/01/28 12:35:03.0265 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/01/28 12:35:04.0066 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/01/28 12:35:04.0827 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/01/28 12:35:05.0508 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/01/28 12:35:06.0239 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
    2011/01/28 12:35:06.0890 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
    2011/01/28 12:35:07.0541 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
    2011/01/28 12:35:08.0242 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
    2011/01/28 12:35:08.0973 SynTP (9f21fcb5a5bbc7d730018f6b61f638cb) C:\WINDOWS\system32\DRIVERS\SynTP.sys
    2011/01/28 12:35:09.0734 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/01/28 12:35:10.0585 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/01/28 12:35:11.0376 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/01/28 12:35:12.0007 TDSMAPI (139b4d397d51cf60d6585597b1cf2f51) C:\WINDOWS\system32\drivers\TDSMAPI.SYS
    2011/01/28 12:35:12.0708 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/01/28 12:35:13.0379 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/01/28 12:35:14.0090 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\System32\DRIVERS\toside.sys
    2011/01/28 12:35:14.0721 TPHKDRV (a7c9656b3cac47a9f786aae88259d8b9) C:\WINDOWS\system32\drivers\TPHKDRV.sys
    2011/01/28 12:35:15.0462 TPPWR (dc5c49a5f38d377f7c9a99a5b0c4d1a0) C:\WINDOWS\system32\drivers\Tppwr.sys
    2011/01/28 12:35:16.0073 TSMAPIP (f2aba3066d7921d7fcdbd66dea88be11) C:\WINDOWS\system32\drivers\TSMAPIP.SYS
    2011/01/28 12:35:16.0724 TwoTrack (17687545f77a648af7f9f1064eb61191) C:\WINDOWS\system32\DRIVERS\TwoTrack.sys
    2011/01/28 12:35:17.0435 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/01/28 12:35:18.0076 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
    2011/01/28 12:35:18.0797 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/01/28 12:35:19.0568 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/01/28 12:35:20.0269 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/01/28 12:35:20.0960 usbhub (d31e07bf822c7f2bd32714e9ddca8be2) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/01/28 12:35:21.0631 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2011/01/28 12:35:22.0302 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/01/28 12:35:22.0963 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/01/28 12:35:23.0634 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
    2011/01/28 12:35:24.0315 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\System32\DRIVERS\viaagp.sys
    2011/01/28 12:35:24.0966 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\System32\DRIVERS\viaide.sys
    2011/01/28 12:35:25.0657 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/01/28 12:35:27.0279 w70n51 (c559ad65a908d1be718dc45664197413) C:\WINDOWS\system32\DRIVERS\w70n51.sys
    2011/01/28 12:35:28.0821 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/01/28 12:35:30.0063 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/01/28 12:35:31.0044 winachsf (542a5f528a6cfebb4487b09538596d78) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
    2011/01/28 12:35:31.0385 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
    2011/01/28 12:35:31.0405 ================================================================================
    2011/01/28 12:35:31.0405 Scan finished
    2011/01/28 12:35:31.0405 ================================================================================
    2011/01/28 12:35:31.0435 Detected object count: 1
    2011/01/28 12:36:06.0345 \HardDisk0 - will be cured after reboot
    2011/01/28 12:36:06.0345 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
    2011/01/28 12:36:29.0709 Deinitialize success
     
    Last edited: 2011/01/28
    tmricha,
    #5
  7. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    .....
     
    broni,
    #6
  8. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    Found it and updated the previous post.
     
    tmricha,
    #7
  9. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very good :)
    See, if DDS will work now.
     
    broni,
    #8
  10. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    Negative.

    Still hangs in the same place (at least :::: wise) as before. Screenshot of progress below.

    [​IMG]
     
    tmricha,
    #9
  11. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    That's fine...

    We need to double check your MBR.

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
    broni,
    #10
  12. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    Bootkit Remover
    (c) 2009 eSage Lab
    www.esagelab.com

    Program version: 1.2.0.0
    OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    Boot sector MD5 is: df5b3a8c7be9ff57bec18e5afea45847

    Size Device Name MBR Status
    --------------------------------------------
    37 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Done;
    Press any key to quit...
     
    tmricha,
    #11
  13. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    We need to fix your MBR.

    Please download NTBR by noahdfear and save it to your Desktop.
    File size: 2.44 MB (2,565,432 bytes)

    • Place a blank CD in your CD drive.
    • Double click on NTBR_CD.exe file and a folder of the same name will appear.
    • Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
    • Follow the prompts to burn the CD.
    • Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
    • If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
    • Insert the newly created CD into your infected PC and reboot your computer.
    • Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
    • Read the warning and then continue as prompted.
    • You first need to select your keyboard layout - press Enter for English.
    • Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
    • On the following screen enter 5 to select Install Standard MBR code.
    • Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
    • When asked to confirm please do so.
    • Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
    • Eject the disc and then press ctrl+alt+del to reboot the PC.
    Once rebooted, run MBRCheck again and post its log.

    **Important note to Dell users - fixing the MBR may prevent access to the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. If this is Dell computer, let me know before proceeding.
     
    broni,
    #12
  14. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    CDRW was not responding. Burned to disk via other machine. Infected machine would not boot from CD.

    Created Bootable USB with image. Ran tool.

    New MBRCheck Log Below:

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 140):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EC000 \WINDOWS\system32\hal.dll
    0xF7BE1000 \WINDOWS\system32\KDCOM.DLL
    0xF7AF1000 \WINDOWS\system32\BOOTVID.dll
    0xF7692000 ACPI.sys
    0xF7BE3000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
    0xF7681000 pci.sys
    0xF76E1000 isapnp.sys
    0xF7AF5000 compbatt.sys
    0xF7AF9000 \WINDOWS\System32\DRIVERS\BATTC.SYS
    0xF7CA9000 pciide.sys
    0xF7961000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
    0xF7663000 pcmcia.sys
    0xF76F1000 MountMgr.sys
    0xF7644000 ftdisk.sys
    0xF7AFD000 ACPIEC.sys
    0xF7CAA000 \WINDOWS\System32\DRIVERS\OPRGHDLR.SYS
    0xF7969000 PartMgr.sys
    0xF7701000 Shockprf.sys
    0xF7711000 VolSnap.sys
    0xF762C000 atapi.sys
    0xF7721000 disk.sys
    0xF7731000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    0xF760D000 fltmgr.sys
    0xF75FB000 sr.sys
    0xF7741000 PxHelp20.sys
    0xF75E4000 KSecDD.sys
    0xF7557000 Ntfs.sys
    0xF752A000 NDIS.sys
    0xF750F000 Mup.sys
    0xF7751000 agp440.sys
    0xF7871000 \SystemRoot\System32\DRIVERS\intelppm.sys
    0xF6F6C000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF6F58000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF79B1000 \SystemRoot\System32\DRIVERS\usbuhci.sys
    0xF6F35000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
    0xF79B9000 \SystemRoot\System32\DRIVERS\usbehci.sys
    0xF6F16000 \SystemRoot\System32\DRIVERS\e1000325.sys
    0xF7881000 \SystemRoot\System32\DRIVERS\i8042prt.sys
    0xF79C1000 \SystemRoot\System32\DRIVERS\kbdclass.sys
    0xF6ED3000 \SystemRoot\System32\DRIVERS\SynTP.sys
    0xF7C15000 \SystemRoot\System32\DRIVERS\USBD.SYS
    0xF79C9000 \SystemRoot\System32\DRIVERS\mouclass.sys
    0xF79D1000 \SystemRoot\System32\DRIVERS\fdc.sys
    0xF7891000 \SystemRoot\System32\DRIVERS\serial.sys
    0xF74CE000 \SystemRoot\System32\DRIVERS\serenum.sys
    0xF6EBF000 \SystemRoot\System32\DRIVERS\parport.sys
    0xF79D9000 \SystemRoot\System32\DRIVERS\nscirda.sys
    0xF74CA000 \SystemRoot\System32\DRIVERS\irenum.sys
    0xF74C2000 \SystemRoot\System32\DRIVERS\CmBatt.sys
    0xF79E1000 \SystemRoot\System32\DRIVERS\ibmpmdrv.sys
    0xF78A1000 \SystemRoot\System32\DRIVERS\imapi.sys
    0xF78B1000 \SystemRoot\System32\DRIVERS\cdrom.sys
    0xF78D1000 \SystemRoot\System32\DRIVERS\redbook.sys
    0xF6E9C000 \SystemRoot\System32\DRIVERS\ks.sys
    0xF6E5A000 \SystemRoot\system32\drivers\smwdm.sys
    0xF6E36000 \SystemRoot\system32\drivers\portcls.sys
    0xF78E1000 \SystemRoot\system32\drivers\drmk.sys
    0xF6E1A000 \SystemRoot\system32\drivers\aeaudio.sys
    0xF6DE9000 \SystemRoot\system32\DRIVERS\HSFHWICH.sys
    0xF6CEA000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
    0xF6C44000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF79E9000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7D54000 \SystemRoot\System32\DRIVERS\audstub.sys
    0xF7C17000 \SystemRoot\System32\Drivers\RootMdm.sys
    0xF79F1000 \SystemRoot\System32\DRIVERS\rasirda.sys
    0xF79F9000 \SystemRoot\System32\DRIVERS\TDI.SYS
    0xF78F1000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
    0xF74B6000 \SystemRoot\System32\DRIVERS\ndistapi.sys
    0xF6C2D000 \SystemRoot\System32\DRIVERS\ndiswan.sys
    0xF7901000 \SystemRoot\System32\DRIVERS\raspppoe.sys
    0xF7921000 \SystemRoot\System32\DRIVERS\raspptp.sys
    0xF6C1C000 \SystemRoot\System32\DRIVERS\psched.sys
    0xF7931000 \SystemRoot\System32\DRIVERS\msgpc.sys
    0xF7A01000 \SystemRoot\System32\DRIVERS\ptilink.sys
    0xF7A09000 \SystemRoot\System32\DRIVERS\raspti.sys
    0xF7A11000 \SystemRoot\system32\DRIVERS\RimSerial.sys
    0xF6B4B000 \SystemRoot\System32\DRIVERS\rdpdr.sys
    0xF7941000 \SystemRoot\System32\DRIVERS\termdd.sys
    0xF7C19000 \SystemRoot\System32\DRIVERS\swenum.sys
    0xF6B17000 \SystemRoot\System32\DRIVERS\update.sys
    0xF7057000 \SystemRoot\System32\DRIVERS\mssmbios.sys
    0xF7951000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF77C1000 \SystemRoot\System32\DRIVERS\usbhub.sys
    0xF7C43000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF7C61000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7D4C000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7C63000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF7AD9000 \SystemRoot\System32\drivers\vga.sys
    0xF7C65000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7C67000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF7A89000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF7AE1000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF6B07000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0xA8EBD000 \SystemRoot\System32\DRIVERS\ipsec.sys
    0xA8E65000 \SystemRoot\System32\DRIVERS\tcpip.sys
    0xA8E3D000 \SystemRoot\System32\DRIVERS\netbt.sys
    0xA8E1B000 \SystemRoot\System32\drivers\afd.sys
    0xAA693000 \SystemRoot\System32\DRIVERS\netbios.sys
    0xF7AE9000 \SystemRoot\System32\drivers\TSMAPIP.SYS
    0xF7981000 \SystemRoot\System32\drivers\Tppwr.sys
    0xF6B03000 \SystemRoot\System32\Drivers\TPHKDRV.SYS
    0xF7989000 \SystemRoot\System32\drivers\TDSMAPI.SYS
    0xF7991000 \SystemRoot\System32\drivers\Smapint.sys
    0xF7C69000 \SystemRoot\System32\Drivers\ShockMgr.SYS
    0xA8D61000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF7999000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xA8D35000 \SystemRoot\System32\DRIVERS\rdbss.sys
    0xA8CC6000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
    0xF7D6A000 \SystemRoot\System32\drivers\IBMBLDID.SYS
    0xAA663000 \SystemRoot\System32\Drivers\Fips.SYS
    0xA8CA5000 \SystemRoot\System32\DRIVERS\ipnat.sys
    0xAA653000 \SystemRoot\System32\DRIVERS\wanarp.sys
    0xA9A99000 \SystemRoot\System32\drivers\ANC.SYS
    0xF7911000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xA8C8D000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7C03000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7AC9000 \SystemRoot\System32\watchdog.sys
    0xA8DAF000 \SystemRoot\System32\drivers\Dxapi.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7E0F000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF04A000 \SystemRoot\System32\ati2cqag.dll
    0xBF084000 \SystemRoot\System32\ati3duag.dll
    0xBF2A7000 \SystemRoot\System32\ativvaxx.dll
    0xA8B8D000 \SystemRoot\system32\DRIVERS\AegisP.sys
    0xA8AE7000 \SystemRoot\System32\DRIVERS\irda.sys
    0xA8B89000 \SystemRoot\system32\DRIVERS\s24trans.sys
    0xA8B85000 \SystemRoot\System32\DRIVERS\ndisuio.sys
    0xA897A000 \SystemRoot\System32\DRIVERS\mrxdav.sys
    0xF77F1000 \??\C:\WINDOWS\system32\drivers\ibmfilter.sys
    0xA89D7000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xA8837000 \SystemRoot\System32\DRIVERS\srv.sys
    0xF7C51000 \??\C:\WINDOWS\SYSTEM32\Drivers\PMEMNT.SYS
    0xA8642000 \SystemRoot\system32\drivers\wdmaud.sys
    0xA8687000 \SystemRoot\system32\drivers\sysaudio.sys
    0xA85F5000 \SystemRoot\system32\drivers\kmixer.sys
    0xA82DC000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 19):
    0 System Idle Process
    4 System
    608 C:\WINDOWS\system32\smss.exe
    672 csrss.exe
    716 C:\WINDOWS\system32\winlogon.exe
    760 C:\WINDOWS\system32\services.exe
    772 C:\WINDOWS\system32\lsass.exe
    916 C:\WINDOWS\system32\svchost.exe
    996 svchost.exe
    1036 C:\WINDOWS\system32\svchost.exe
    1116 svchost.exe
    1148 svchost.exe
    1396 C:\WINDOWS\system32\spoolsv.exe
    1456 svchost.exe
    1684 C:\WINDOWS\system32\svchost.exe
    1704 wdfmgr.exe
    1884 alg.exe
    544 C:\WINDOWS\explorer.exe
    1268 C:\Documents and Settings\Eric Richardson\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: HTS424040M9AT00, Rev: MA2IA75A

    Size Device Name MBR Status
    --------------------------------------------
    37 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: 571DD7ED9C04A93C65A1B320D02BAFE55EBE3FCF


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!
     
    tmricha,
    #13
  15. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You can't use CDRW. It must be CDR.
     
    broni,
    #14
  16. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    I got it to boot and ran the program. The MBRCheck was posted with previous post.
     
    tmricha,
    #15
  17. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    For some reason, it didn't work.

    We'll get back to it in a moment.

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #16
  18. 2011/01/28
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    ComboFix will not run (always hangs at "Scanning for infected... may easily double ")

    Tried it in safe mode. Tried renaming it. Tried renaming it in safe mode. Always hangs at same place.



    Ive tried RKill to stop anything immediately followed by a renamed ComboFix. It still hangs.
     
    tmricha,
    #17
  19. 2011/01/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #18
  20. 2011/01/31
    tmricha

    tmricha Inactive Thread Starter

    Joined:
    2011/01/27
    Messages:
    12
    Likes Received:
    0
    OTL.txt below (the scan did not produce an Extra.txt)


    OTL logfile created on: 1/31/2011 9:33:33 AM - Run 2
    OTL by OldTimer - Version 3.2.20.5 Folder = C:\Documents and Settings\Eric Richardson\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,023.00 Mb Total Physical Memory | 677.00 Mb Available Physical Memory | 66.00% Memory free
    2.00 Gb Paging File | 1.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 32.67 Gb Total Space | 17.82 Gb Free Space | 54.54% Space Free | Partition Type: NTFS
    Drive E: | 5.45 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive F: | 1.91 Gb Total Space | 1.13 Gb Free Space | 59.42% Space Free | Partition Type: FAT

    Computer Name: ETRLAPTOP | User Name: Eric Richardson | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Documents and Settings\Eric Richardson\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


    ========== Modules (SafeList) ==========

    MOD - C:\Documents and Settings\Eric Richardson\Desktop\OTL.exe (OldTimer Tools)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


    ========== Win32 Services (SafeList) ==========

    SRV - (PsaSrv) -- File not found
    SRV - (PEVSystemStart) -- File not found
    SRV - (JavaQuickStarterService) -- File not found
    SRV - (HidServ) -- File not found
    SRV - (QCONSVC) -- C:\WINDOWS\system32\QCONSVC.EXE (IBM Corp.)
    SRV - (S24EventMonitor) -- C:\WINDOWS\system32\S24EvMon.exe (Intel Corporation )
    SRV - (RegSrvc) -- C:\WINDOWS\system32\RegSrvc.exe (Intel Corporation)
    SRV - (IBM Rapid Restore Ultra Service) -- C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe ()
    SRV - (IBMPMSVC) -- C:\WINDOWS\system32\ibmpmsvc.exe ()
    SRV - (TpKmpSVC) -- C:\WINDOWS\system32\TpKmpSvc.exe ()


    ========== Driver Services (SafeList) ==========

    DRV - (EGATHDRV) -- C:\WINDOWS\GATHER.KM ()
    DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    DRV - (psadd) -- C:\WINDOWS\system32\drivers\psadd.sys (Windows (R) 2000 DDK provider)
    DRV - (NSCIRDA) -- C:\WINDOWS\system32\drivers\nscirda.sys (National Semiconductor Corporation)
    DRV - (amdagp) -- C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
    DRV - (sisagp) -- C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
    DRV - (QCNDISIF) -- C:\WINDOWS\system32\drivers\qcndisif.sys (IBM Corporation.)
    DRV - (ANC) -- C:\WINDOWS\system32\drivers\ANC.sys (IBM Corp.)
    DRV - (IBMTPCHK) -- C:\WINDOWS\system32\drivers\IBMBLDID.SYS ()
    DRV - (ibmfilter) -- C:\WINDOWS\system32\drivers\ibmfilter.sys (IBM)
    DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
    DRV - (ltmodem5) -- C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
    DRV - (w70n51) Intel(R) -- C:\WINDOWS\system32\drivers\w70n51.sys (Intel® Corporation)
    DRV - (TPPWR) -- C:\WINDOWS\system32\drivers\TPPWR.SYS (IBM Corp.)
    DRV - (Smapint) -- C:\WINDOWS\system32\drivers\SMAPINT.SYS (Microsoft Corporation)
    DRV - (TDSMAPI) -- C:\WINDOWS\system32\drivers\TDSMAPI.SYS ()
    DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
    DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
    DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
    DRV - (TSMAPIP) -- C:\WINDOWS\system32\drivers\TSMAPIP.SYS ()
    DRV - (Shockprf) -- C:\WINDOWS\System32\drivers\shockprf.sys (IBM Corporation)
    DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
    DRV - (TPHKDRV) -- C:\WINDOWS\System32\drivers\TPHKDRV.sys (IBM Corporation)
    DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
    DRV - (ShockMgr) -- C:\WINDOWS\System32\drivers\ShockMgr.sys (IBM Corporation)
    DRV - (IBMPMDRV) -- C:\WINDOWS\system32\drivers\ibmpmdrv.sys (IBM Corp.)
    DRV - (S3SSavage) -- C:\WINDOWS\system32\drivers\s3ssavm.sys (S3 Graphics, Inc.)
    DRV - (Sparrow) -- C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
    DRV - (sym_u3) -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
    DRV - (sym_hi) -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
    DRV - (symc8xx) -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
    DRV - (symc810) -- C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
    DRV - (ultra) -- C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
    DRV - (ql12160) -- C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
    DRV - (ql1080) -- C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
    DRV - (ql1280) -- C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
    DRV - (dac2w2k) -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
    DRV - (mraid35x) -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
    DRV - (asc) -- C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
    DRV - (asc3550) -- C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
    DRV - (AliIde) -- C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
    DRV - (CmdIde) -- C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
    DRV - (TwoTrack) -- C:\WINDOWS\system32\drivers\TwoTrack.sys (IBM Corporation)
    DRV - (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM) -- C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
    DRV - (PMEM) -- C:\WINDOWS\system32\drivers\PMEMNT.SYS (Microsoft Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.google.com/mail/#inbox
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost; 127.0.0.1; ;<local>


    [2011/01/26 14:06:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Eric Richardson\Application Data\Mozilla\Extensions
    [2009/04/08 12:56:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Eric Richardson\Application Data\Mozilla\Extensions\mozswing@mozswing.org

    O1 HOSTS File: ([2001/08/18 03:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
    O9 - Extra 'Tools' menuitem : IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1217514547182 (WUWebControl Class)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
    O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4.1/jinstall-141-win.cab (Java Plug-in 1.4.1)
    O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.94.156.1 68.94.157.1
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
    O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
    O20 - Winlogon\Notify\QConGina: DllName - QConGina.dll - C:\WINDOWS\System32\QConGina.dll (IBM Corp.)
    O24 - Desktop WallPaper: C:\Documents and Settings\Eric Richardson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eric Richardson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/07/31 07:00:03 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2006/12/11 14:03:59 | 000,000,277 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
    O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell - " " = AutoRun
    O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell\AutoRun - " " = Auto&Play
    O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell\AutoRun\command - " " = E:\LaunchU3.exe -- [2006/12/07 12:45:13 | 001,095,224 | R--- | M] ()
    O33 - MountPoints2\E\Shell - " " = AutoRun
    O33 - MountPoints2\E\Shell\AutoRun - " " = Auto&Play
    O33 - MountPoints2\E\Shell\AutoRun\command - " " = E:\LaunchU3.exe -- [2006/12/07 12:45:13 | 001,095,224 | R--- | M] ()
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/01/31 09:32:20 | 000,603,136 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Eric Richardson\Desktop\OTL.exe
    [2011/01/31 08:36:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
    [2011/01/31 07:28:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
    [2011/01/28 17:20:55 | 000,000,000 | ---D | C] -- C:\a8aa9dd3dfdbb53e98
    [2011/01/28 17:07:32 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
    [2011/01/28 16:44:14 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2011/01/28 16:44:14 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2011/01/28 16:44:14 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2011/01/28 16:44:14 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2011/01/28 16:44:08 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2011/01/28 09:38:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Eric Richardson\Recent
    [2011/01/27 16:53:48 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/01/27 15:01:17 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
    [2011/01/27 15:01:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    [2011/01/27 13:15:17 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2011/01/27 13:15:13 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2011/01/27 13:15:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/01/27 09:55:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric Richardson\Application Data\SUPERAntiSpyware.com
    [2011/01/27 09:55:02 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
    [2011/01/27 09:21:44 | 000,000,000 | ---D | C] -- C:\X_32788R22FWJFW
    [2011/01/27 07:33:45 | 000,000,000 | ---D | C] -- C:\X_1e675f7174c5eab7b8ec21cbd5223e
    [2011/01/26 16:59:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
    [2011/01/26 16:42:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
    [2011/01/26 16:41:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
    [2011/01/26 14:43:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
    [2011/01/26 14:32:56 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
    [2011/01/26 14:24:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Eric Richardson\Application Data\X_U3
    [2011/01/26 11:27:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\PFetch_Rem
    [2011/01/26 08:12:20 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2011/01/25 15:43:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
    [2011/01/25 14:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
    [2011/01/25 14:37:34 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Eric Richardson\PrivacIE
    [2011/01/25 14:37:33 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Eric Richardson\IECompatCache
    [2011/01/25 14:30:06 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
    [2011/01/25 13:15:32 | 000,000,000 | ---D | C] -- C:\X_af665146e3db987e02d1d16351c5584c
    [2011/01/25 10:33:41 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
    [2011/01/25 10:32:11 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Eric Richardson\IETldCache
    [2011/01/25 09:55:07 | 000,000,000 | ---D | C] -- C:\_OTL
    [2011/01/25 08:58:07 | 000,000,000 | ---D | C] -- C:\MGtools
    [2011/01/25 08:40:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
    [2011/01/25 07:46:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Installed By Troy
    [2011/01/24 16:43:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
    [2011/01/24 16:43:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
    [2011/01/24 16:20:10 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2011/01/24 16:16:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2011/01/24 08:51:18 | 000,000,000 | ---D | C] -- C:\ibTroy
    [2011/01/24 08:41:31 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2011/01/24 08:32:27 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
    [1980/01/01 01:00:00 | 000,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/01/31 09:31:13 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/01/31 09:27:10 | 000,380,918 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011/01/31 09:27:10 | 000,053,166 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011/01/31 09:25:38 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
    [2011/01/31 09:24:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/01/31 09:22:25 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011/01/31 09:12:54 | 000,000,826 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2011/01/31 09:12:00 | 000,001,018 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2566305758-1680464645-585233709-1005UA.job
    [2011/01/31 09:12:00 | 000,000,966 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2566305758-1680464645-585233709-1005Core.job
    [2011/01/31 09:11:12 | 000,208,104 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/01/31 07:31:52 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
    [2011/01/31 07:31:13 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
    [2011/01/28 09:38:28 | 000,004,702 | ---- | M] () -- C:\cc_20110128_093825.reg
    [2011/01/27 14:12:13 | 000,000,310 | RHS- | M] () -- C:\BOOT.INI
    [2011/01/27 09:32:39 | 000,002,964 | ---- | M] () -- C:\cc_20110127_093236.reg
    [2011/01/27 09:08:15 | 000,050,445 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Desktop\SvcHost.JPG
    [2011/01/27 08:26:12 | 000,000,164 | ---- | M] () -- C:\cc_20110127_082610.reg
    [2011/01/27 08:26:00 | 000,001,278 | ---- | M] () -- C:\cc_20110127_082557.reg
    [2011/01/27 08:25:12 | 000,020,646 | ---- | M] () -- C:\cc_20110127_082508.reg
    [2011/01/26 17:22:41 | 000,003,584 | ---- | M] () -- C:\WINDOWS\System32\X_nt.dll
    [2011/01/26 17:04:37 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2011/01/26 16:59:49 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
    [2011/01/26 16:41:53 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2011/01/26 14:39:15 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2011/01/26 13:55:25 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
    [2011/01/26 13:55:25 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
    [2011/01/26 13:54:55 | 000,000,808 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Application Data\Launch Internet Explorer Browser.lnk
    [2011/01/26 11:21:54 | 000,004,474 | ---- | M] () -- C:\WINDOWS\GATHER.KM
    [2011/01/26 11:18:16 | 000,000,378 | ---- | M] () -- C:\cc_20110126_111811.reg
    [2011/01/26 11:01:23 | 000,000,436 | ---- | M] () -- C:\GoodRegistry_012611.reg
    [2011/01/25 14:11:44 | 069,013,432 | ---- | M] () -- C:\GoodRegistry_012511.reg
    [2011/01/25 10:16:55 | 000,020,028 | ---- | M] () -- C:\cc_20110125_101651.reg
    [2011/01/25 09:51:46 | 000,603,136 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric Richardson\Desktop\OTL.exe
    [2011/01/25 09:00:59 | 000,097,275 | ---- | M] () -- C:\MGlogs.zip
    [2011/01/25 08:58:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2011/01/25 08:03:31 | 000,000,774 | ---- | M] () -- C:\cc_20110125_080327.reg
    [2011/01/24 10:11:21 | 000,002,182 | ---- | M] () -- C:\cc_20110124_101110.reg
    [2011/01/24 08:43:23 | 000,105,472 | ---- | M] () -- C:\cc_20110124_084258.reg
    [2011/01/21 08:08:24 | 000,038,400 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Desktop\MAHANEY ON RENT.xls
    [2011/01/18 09:49:44 | 000,000,468 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/01/28 17:57:31 | 000,010,457 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.hta
    [2011/01/28 17:57:31 | 000,000,855 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpocm.inf
    [2011/01/28 17:57:29 | 000,029,070 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmp.inf
    [2011/01/28 17:57:26 | 000,017,272 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmdm.inf
    [2011/01/28 17:57:26 | 000,006,769 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmfsdk.inf
    [2011/01/28 17:57:25 | 000,066,725 | ---- | C] () -- C:\WINDOWS\System32\dllcache\revert.wmz
    [2011/01/28 17:57:25 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\dllcache\skins.inf
    [2011/01/28 17:57:23 | 000,018,286 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.inf
    [2011/01/28 17:57:20 | 000,184,959 | ---- | C] () -- C:\WINDOWS\System32\dllcache\compact.wmz
    [2011/01/28 17:49:37 | 000,498,742 | ---- | C] () -- C:\WINDOWS\System32\dllcache\dxmasf.dll
    [2011/01/28 17:49:36 | 000,844,314 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxm.ocx
    [2011/01/28 17:49:36 | 000,004,126 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdxmlc.dll
    [2011/01/28 17:07:51 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
    [2011/01/28 16:44:14 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2011/01/28 16:44:14 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2011/01/28 16:44:14 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2011/01/28 16:44:14 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2011/01/28 16:44:14 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2011/01/28 09:38:27 | 000,004,702 | ---- | C] () -- C:\cc_20110128_093825.reg
    [2011/01/27 09:32:37 | 000,002,964 | ---- | C] () -- C:\cc_20110127_093236.reg
    [2011/01/27 09:08:15 | 000,050,445 | ---- | C] () -- C:\Documents and Settings\Eric Richardson\Desktop\SvcHost.JPG
    [2011/01/27 08:26:11 | 000,000,164 | ---- | C] () -- C:\cc_20110127_082610.reg
    [2011/01/27 08:25:59 | 000,001,278 | ---- | C] () -- C:\cc_20110127_082557.reg
    [2011/01/27 08:25:11 | 000,020,646 | ---- | C] () -- C:\cc_20110127_082508.reg
    [2011/01/26 17:04:36 | 000,000,424 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2011/01/26 16:41:53 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2011/01/26 14:48:25 | 000,001,771 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.css
    [2011/01/26 14:48:25 | 000,000,420 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmploc.js
    [2011/01/26 14:48:24 | 000,613,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.chm
    [2011/01/26 14:48:24 | 000,067,374 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.adm
    [2011/01/26 14:48:24 | 000,023,195 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplay.chm
    [2011/01/26 14:48:23 | 000,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud7.wav
    [2011/01/26 14:48:23 | 000,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud6.wav
    [2011/01/26 14:48:23 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud9.wav
    [2011/01/26 14:48:23 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud8.wav
    [2011/01/26 14:48:23 | 000,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud3.wav
    [2011/01/26 14:48:23 | 000,086,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud5.wav
    [2011/01/26 14:48:23 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud4.wav
    [2011/01/26 14:48:23 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud2.wav
    [2011/01/26 14:48:22 | 000,354,468 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud1.wav
    [2011/01/26 14:48:21 | 000,007,892 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm9.gif
    [2011/01/26 14:48:20 | 000,300,969 | ---- | C] () -- C:\WINDOWS\System32\dllcache\viz.wmv
    [2011/01/26 14:48:20 | 000,017,489 | ---- | C] () -- C:\WINDOWS\System32\dllcache\videobg.gif
    [2011/01/26 14:48:20 | 000,008,677 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm7.gif
    [2011/01/26 14:48:20 | 000,007,636 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm2.gif
    [2011/01/26 14:48:20 | 000,007,369 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm4.gif
    [2011/01/26 14:48:20 | 000,006,241 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm3.gif
    [2011/01/26 14:48:20 | 000,006,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm6.gif
    [2011/01/26 14:48:20 | 000,005,789 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm1.gif
    [2011/01/26 14:48:20 | 000,005,290 | ---- | C] () -- C:\WINDOWS\System32\dllcache\vidsamp.gif
    [2011/01/26 14:48:20 | 000,004,193 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm8.gif
    [2011/01/26 14:48:20 | 000,002,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm5.gif
    [2011/01/26 14:48:20 | 000,002,469 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplay.gif
    [2011/01/26 14:48:20 | 000,002,375 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplayh.gif
    [2011/01/26 14:48:20 | 000,002,371 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpauseh.gif
    [2011/01/26 14:48:19 | 000,572,557 | ---- | C] () -- C:\WINDOWS\System32\dllcache\rtuner.wmv
    [2011/01/26 14:48:19 | 000,023,829 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tourbg.gif
    [2011/01/26 14:48:19 | 000,003,187 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tour.js
    [2011/01/26 14:48:19 | 000,002,450 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpause.gif
    [2011/01/26 14:48:19 | 000,001,398 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taon.gif
    [2011/01/26 14:48:19 | 000,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taonh.gif
    [2011/01/26 14:48:19 | 000,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoff.gif
    [2011/01/26 14:48:19 | 000,001,367 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoffh.gif
    [2011/01/26 14:48:19 | 000,001,148 | ---- | C] () -- C:\WINDOWS\System32\dllcache\snd.htm
    [2011/01/26 14:48:18 | 000,375,519 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nuskin.wmv
    [2011/01/26 14:48:18 | 000,077,307 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plyr_err.chm
    [2011/01/26 14:48:18 | 000,022,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npds.zip
    [2011/01/26 14:48:18 | 000,001,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst6.wpl
    [2011/01/26 14:48:18 | 000,001,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst5.wpl
    [2011/01/26 14:48:18 | 000,001,474 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst3.wpl
    [2011/01/26 14:48:18 | 000,001,451 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst12.wpl
    [2011/01/26 14:48:18 | 000,001,448 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst4.wpl
    [2011/01/26 14:48:18 | 000,001,250 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst1.wpl
    [2011/01/26 14:48:18 | 000,001,049 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst2.wpl
    [2011/01/26 14:48:18 | 000,001,046 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst7.wpl
    [2011/01/26 14:48:18 | 000,001,036 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst8.wpl
    [2011/01/26 14:48:18 | 000,000,789 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst11.wpl
    [2011/01/26 14:48:18 | 000,000,787 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst10.wpl
    [2011/01/26 14:48:18 | 000,000,784 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst9.wpl
    [2011/01/26 14:48:18 | 000,000,783 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst13.wpl
    [2011/01/26 14:48:18 | 000,000,775 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst14.wpl
    [2011/01/26 14:48:18 | 000,000,733 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plylst15.wpl
    [2011/01/26 14:48:18 | 000,000,403 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npdrmv2.zip
    [2011/01/26 14:48:17 | 000,002,778 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogoh.gif
    [2011/01/26 14:48:17 | 000,002,545 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogo.gif
    [2011/01/26 14:48:16 | 000,457,607 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mdlib.wmv
    [2011/01/26 14:48:16 | 000,005,971 | ---- | C] () -- C:\WINDOWS\System32\dllcache\events.js
    [2011/01/26 14:48:15 | 000,381,425 | ---- | C] () -- C:\WINDOWS\System32\dllcache\copycd.wmv
    [2011/01/26 14:48:15 | 000,009,585 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.css
    [2011/01/26 14:48:15 | 000,008,298 | ---- | C] () -- C:\WINDOWS\System32\dllcache\contents.htm
    [2011/01/26 14:48:15 | 000,006,878 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.js
    [2011/01/26 14:48:15 | 000,000,999 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bktrh.gif
    [2011/01/26 14:48:15 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnth.gif
    [2011/01/26 14:48:15 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnt.gif
    [2011/01/26 14:48:15 | 000,000,772 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cntd.gif
    [2011/01/26 14:48:15 | 000,000,760 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapph.gif
    [2011/01/26 14:48:15 | 000,000,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapp.gif
    [2011/01/26 13:54:55 | 000,000,808 | ---- | C] () -- C:\Documents and Settings\Eric Richardson\Application Data\Launch Internet Explorer Browser.lnk
    [2011/01/26 11:18:14 | 000,000,378 | ---- | C] () -- C:\cc_20110126_111811.reg
    [2011/01/26 11:01:23 | 000,000,436 | ---- | C] () -- C:\GoodRegistry_012611.reg
    [2011/01/25 14:39:45 | 000,000,236 | ---- | C] () -- C:\WINDOWS\tasks\OGALogon.job
    [2011/01/25 14:11:33 | 069,013,432 | ---- | C] () -- C:\GoodRegistry_012511.reg
    [2011/01/25 10:34:38 | 000,001,945 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
    [2011/01/25 10:16:54 | 000,020,028 | ---- | C] () -- C:\cc_20110125_101651.reg
    [2011/01/25 08:58:12 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
    [2011/01/25 08:58:09 | 000,097,275 | ---- | C] () -- C:\MGlogs.zip
    [2011/01/25 08:03:30 | 000,000,774 | ---- | C] () -- C:\cc_20110125_080327.reg
    [2011/01/24 16:20:18 | 000,000,194 | ---- | C] () -- C:\Boot.bak
    [2011/01/24 16:20:14 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2011/01/24 15:04:48 | 000,004,474 | ---- | C] () -- C:\WINDOWS\GATHER.KM
    [2011/01/24 10:11:19 | 000,002,182 | ---- | C] () -- C:\cc_20110124_101110.reg
    [2011/01/24 08:43:20 | 000,105,472 | ---- | C] () -- C:\cc_20110124_084258.reg
    [2009/11/07 09:48:22 | 000,000,209 | ---- | C] () -- C:\WINDOWS\OPLW.INI
    [2009/10/27 12:58:56 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
    [2009/10/27 12:58:56 | 000,000,026 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
    [2009/10/27 12:58:43 | 000,000,000 | ---- | C] () -- C:\Program Files\error.dat
    [2009/10/27 12:58:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
    [2009/10/27 12:58:34 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL
    [2009/10/27 12:58:32 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI
    [2009/06/25 15:28:37 | 000,000,112 | ---- | C] () -- C:\WINDOWS\OPLK.INI
    [2008/07/31 07:38:41 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2008/05/20 18:03:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2008/05/20 18:00:12 | 000,002,432 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.SYS
    [2008/05/20 17:48:20 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
    [2008/05/20 17:48:20 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
    [2008/05/20 17:48:20 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
    [2008/05/20 17:48:20 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
    [2008/05/20 17:48:19 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
    [2008/05/20 17:48:19 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
    [2008/05/20 17:46:43 | 000,000,138 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2008/05/20 17:38:27 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\FPCALL.dll
    [2008/05/20 17:38:06 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS
    [2008/05/20 17:37:37 | 000,009,341 | ---- | C] () -- C:\WINDOWS\System32\drivers\TDSMAPI.SYS
    [2008/05/20 16:13:36 | 000,002,481 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2004/11/08 18:12:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/09/06 03:13:30 | 000,045,124 | ---- | C] () -- C:\WINDOWS\System32\LsaWrApi.dll
    [2004/09/06 03:04:12 | 000,225,349 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
    [2004/03/19 13:12:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\pwdmon.dll
    [2004/03/19 13:12:10 | 000,019,692 | ---- | C] () -- C:\WINDOWS\ibmprc.ini
    [2004/01/09 07:10:32 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\AIBMRUNL.dll
    [2003/02/20 10:32:29 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2003/02/20 10:03:32 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2002/12/02 15:57:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
    [2002/12/02 15:57:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
    [1980/01/01 01:00:00 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
    [1980/01/01 01:00:00 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
    [1980/01/01 01:00:00 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
    [1980/01/01 01:00:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\tpinspm.dll
    [1980/01/01 01:00:00 | 000,003,584 | ---- | C] () -- C:\WINDOWS\System32\X_nt.dll

    ========== LOP Check ==========

    [2010/12/17 09:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eMhIo05200
    [2008/05/20 17:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IBM
    [2008/11/24 10:08:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OrbNetworks
    [2008/09/08 15:04:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric Richardson\Application Data\IBM
    [2009/02/04 15:15:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric Richardson\Application Data\InterVideo
    [2009/04/28 12:11:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric Richardson\Application Data\Research In Motion
    [2011/01/26 14:24:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Eric Richardson\Application Data\X_U3
    [2008/07/31 07:15:22 | 000,000,362 | ---- | M] () -- C:\WINDOWS\Tasks\BMMTask.job
    [2011/01/26 17:04:37 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
    [2011/01/31 09:25:38 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2008/07/31 07:00:03 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
    [2010/12/17 08:07:22 | 000,000,194 | ---- | M] () -- C:\Boot.bak
    [2011/01/27 14:12:13 | 000,000,310 | RHS- | M] () -- C:\BOOT.INI
    [2008/05/20 17:41:24 | 000,000,000 | -H-- | M] () -- C:\BOOTLOG.PRV
    [2008/05/20 18:04:36 | 000,000,000 | -H-- | M] () -- C:\BOOTLOG.TXT
    [2003/02/20 09:54:04 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
    [2008/05/20 18:02:18 | 000,000,355 | ---- | M] () -- C:\ccrrec.ver
    [2011/01/24 08:43:23 | 000,105,472 | ---- | M] () -- C:\cc_20110124_084258.reg
    [2011/01/24 10:11:21 | 000,002,182 | ---- | M] () -- C:\cc_20110124_101110.reg
    [2011/01/25 08:03:31 | 000,000,774 | ---- | M] () -- C:\cc_20110125_080327.reg
    [2011/01/25 10:16:55 | 000,020,028 | ---- | M] () -- C:\cc_20110125_101651.reg
    [2011/01/26 11:18:16 | 000,000,378 | ---- | M] () -- C:\cc_20110126_111811.reg
    [2011/01/27 08:25:12 | 000,020,646 | ---- | M] () -- C:\cc_20110127_082508.reg
    [2011/01/27 08:26:00 | 000,001,278 | ---- | M] () -- C:\cc_20110127_082557.reg
    [2011/01/27 08:26:12 | 000,000,164 | ---- | M] () -- C:\cc_20110127_082610.reg
    [2011/01/27 09:32:39 | 000,002,964 | ---- | M] () -- C:\cc_20110127_093236.reg
    [2011/01/28 09:38:28 | 000,004,702 | ---- | M] () -- C:\cc_20110128_093825.reg
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2008/07/31 07:00:03 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
    [2008/05/20 17:46:06 | 000,000,754 | ---- | M] () -- C:\drivez.log
    [2011/01/25 14:11:44 | 069,013,432 | ---- | M] () -- C:\GoodRegistry_012511.reg
    [2011/01/26 11:01:23 | 000,000,436 | ---- | M] () -- C:\GoodRegistry_012611.reg
    [2008/07/31 07:00:03 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2011/01/25 16:40:17 | 000,045,762 | ---- | M] () -- C:\log2.txt
    [2011/01/25 16:39:04 | 000,004,242 | ---- | M] () -- C:\logcmd.txt
    [2008/05/20 17:44:18 | 000,000,164 | ---- | M] () -- C:\LOGFILE.txt
    [2011/01/25 09:00:59 | 000,097,275 | ---- | M] () -- C:\MGlogs.zip
    [2011/01/25 08:58:12 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2008/05/20 17:19:20 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2011/01/26 14:39:15 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2011/01/31 09:24:10 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
    [2011/01/27 16:53:16 | 000,000,359 | ---- | M] () -- C:\rkill.log
    [2008/05/20 16:13:38 | 000,001,543 | ---- | M] () -- C:\SYSLEVEL.IBM
    [2008/05/20 16:12:00 | 000,000,043 | ---- | M] () -- C:\TCPACHIP.LOG
    [2011/01/28 12:36:29 | 000,049,684 | ---- | M] () -- C:\TDSSKiller.2.4.15.0_28.01.2011_12.32.56_log.txt
    [2011/01/27 09:42:26 | 000,001,762 | ---- | M] () -- C:\tl1.txt
    [2011/01/27 09:42:37 | 000,019,682 | ---- | M] () -- C:\tl2.txt
    [2011/01/27 14:50:48 | 000,026,642 | ---- | M] () -- C:\tlist.txt

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2003/02/20 10:13:04 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >
    [2003/07/15 17:35:04 | 000,002,193 | ---- | M] () -- C:\WINDOWS\system32\TpShPrm.jpg

    < %systemroot%\*.jpg >
    [2002/10/10 14:07:40 | 000,055,408 | ---- | M] () -- C:\WINDOWS\1024 x 768 IBM Americas Map.jpg
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/10/27 12:58:43 | 000,000,000 | ---- | M] () -- C:\Program Files\error.dat

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2003/02/20 10:02:10 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2003/02/20 10:02:10 | 000,626,688 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2003/02/20 10:02:10 | 000,413,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2011/01/28 17:58:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2011/01/31 07:31:28 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\Eric Richardson\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2003/02/20 10:21:00 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2008/10/22 09:36:35 | 001,851,544 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Eric Richardson\Desktop\install_flash_player.exe
    [2011/01/25 09:51:46 | 000,603,136 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Eric Richardson\Desktop\OTL.exe
    [2009/03/24 07:01:35 | 021,878,064 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\Eric Richardson\Desktop\QuickTimeInstaller.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2011/01/31 07:31:29 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Eric Richardson\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2011/01/31 09:31:53 | 001,097,728 | ---- | M] () -- C:\Documents and Settings\Eric Richardson\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2008/04/14 05:42:40 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/14 05:41:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2002/08/20 13:32:18 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2002/08/20 13:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2002/08/20 13:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
    [2008/05/02 08:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 23:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/14 05:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2002/08/20 16:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
    [2002/08/20 21:29:48 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2002/08/20 21:30:06 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2002/08/20 21:30:06 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2002/08/20 13:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/07/17 12:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
    tmricha,
    #19
  21. 2011/01/31
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =================================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
IE - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = localhost; 127.0.0.1; ;<local>
O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-2566305758-1680464645-585233709-1005\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.
O9 - Extra 'Tools' menuitem : IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell - " " = AutoRun
O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell\AutoRun - " " = Auto&Play
O33 - MountPoints2\{5cde51b3-27c7-11e0-a214-00112542cffa}\Shell\AutoRun\command - " " = E:\LaunchU3.exe -- [2006/12/07 12:45:13 | 001,095,224 | R--- | M] ()
O33 - MountPoints2\E\Shell - " " = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - " " = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - " " = E:\LaunchU3.exe -- [2006/12/07 12:45:13 | 001,095,224 | R--- | M] ()
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ===============================================================

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...