Active Help with fixing a family members pc.

Forsaken Knight · 2009/11/11

[Active] Help with fixing a family members pc.

I ran a hijack this log and found three "X" on my family member’s pc. They all were 2.9 or higher, out of 5. I would like help identifying the files in question and any other possible problems on my family member’s pc. I would like to know if I might upload the hijack this log file for assessment, and help.

Please reply.

Thank you all for your help in this matter. I look forward to hearing your responses.

Sincerely,

FK

broni · 2009/11/11

Read this post, then post the requested log(s).

Forsaken Knight · 2009/11/12

DDS (Ver_09-10-26.01) - NTFSx86
Run by Micro at 12:30:43.03 on Thu 11/12/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.479.114 [GMT -5:00]

AV: avast! antivirus 4.8.1356 [VPS 091112-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\util\winzip\WZQKPICK.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Micro\Desktop\dds.scr

============== Pseudo HJT Report ===============

mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: ZoneAlarm Spy Blocker Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_04\bin\jusched.exe
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [StorageGuard] "c:\program files\veritas software\update manager\sgtray.exe" /r
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe "
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe "
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - d:\util\winzip\WZQKPICK.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

============= SERVICES / DRIVERS ===============

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [2009-11-5 134272]
R0 tdrpman174;Acronis Try&Decide and Restore Points filter (build 174);c:\windows\system32\drivers\tdrpm174.sys [2009-11-5 971552]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-11 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-11 20560]
S2 ASKService;ASKService;c:\program files\askbardis\bar\bin\askservice.exe --> c:\program files\askbardis\bar\bin\AskService.exe [?]

=============== Created Last 30 ================

2009-11-12 01:44:31 0 d-----w- c:\program files\Trend Micro
2009-11-11 21:52:08 0 d-----w- c:\program files\AskBarDis
2009-11-11 21:51:40 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-11-11 21:51:26 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-11-11 21:51:26 0 d-----w- c:\windows\system32\ZoneLabs
2009-11-11 21:51:26 0 d-----w- c:\program files\Zone Labs
2009-11-11 21:51:25 350192 ----a-w- c:\windows\system32\vsconfig.xml
2009-11-11 21:50:02 0 d-----w- c:\windows\Internet Logs
2009-11-11 21:22:46 0 d-----w- c:\windows\system32\appmgmt
2009-11-08 19:35:26 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-11-08 19:35:26 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-11-08 19:35:25 991232 -c----w- c:\windows\system32\dllcache\ieframe.dll.mui
2009-11-08 19:35:25 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-11-08 19:35:25 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-11-08 19:35:24 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-11-08 19:35:24 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-11-08 19:35:24 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-11-08 19:35:24 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-11-08 19:04:56 0 d-----w- c:\program files\MSXML 4.0
2009-11-08 18:45:46 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-08 18:45:19 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-11-08 18:45:05 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-11-08 18:45:02 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-11-08 18:44:58 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-11-08 18:44:51 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-11-08 18:44:48 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-11-08 18:43:44 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-08 18:43:42 2066048 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-11-08 18:43:42 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-08 18:40:47 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-11-08 18:40:44 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-11-08 18:39:45 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-11-08 18:39:44 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-11-08 18:39:44 1203922 -c----w- c:\windows\system32\dllcache\sysmain.sdb
2009-11-08 18:39:42 512000 -c----w- c:\windows\system32\dllcache\jscript.dll
2009-11-08 18:38:05 0 d-----w- c:\windows\system32\PreInstall
2009-11-08 18:38:03 0 d--h--w- c:\windows\$hf_mig$
2009-11-08 18:32:03 0 d-----w- c:\windows\system32\SoftwareDistribution
2009-11-07 20:50:45 0 d-sh--w- c:\documents and settings\micro\UserData
2009-11-07 19:42:56 0 d-----w- c:\program files\common files\HP
2009-11-07 19:37:51 0 d-----w- c:\program files\common files\Hewlett-Packard
2009-11-07 19:34:19 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2009-11-07 19:34:18 49664 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2009-11-07 19:33:58 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2009-11-07 19:33:56 77824 ----a-r- c:\windows\system32\hpzids01.dll
2009-11-07 19:33:39 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-11-07 19:33:39 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-11-07 19:29:39 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2009-11-07 19:29:38 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2009-11-07 19:29:38 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2009-11-07 19:29:38 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2009-11-07 19:29:38 306688 ----a-w- c:\windows\IsUninst.exe
2009-11-07 19:29:38 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2009-11-07 19:29:38 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2009-11-07 19:28:36 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-11-07 19:28:36 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-11-07 19:28:33 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-11-07 19:28:33 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-07 19:27:58 0 d-----w- c:\program files\HP
2009-11-07 19:26:47 109920 ----a-w- c:\windows\hpoins08.dat
2009-11-07 19:26:46 7577 ------w- c:\windows\hpomdl08.dat
2009-11-07 19:04:07 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-05 19:18:00 971552 ----a-w- c:\windows\system32\drivers\tdrpm174.sys
2009-11-05 19:17:55 540000 ----a-w- c:\windows\system32\drivers\timntr.sys
2009-11-05 19:17:55 44704 ----a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-11-05 19:17:48 134272 ----a-w- c:\windows\system32\drivers\snman380.sys
2009-11-05 18:57:19 28672 ----a-r- c:\windows\system32\SiSPInst.dll
2009-11-05 18:57:19 1864409 ----a-r- c:\windows\system32\sisgl.dll
2009-11-05 18:57:18 870400 ----a-r- c:\windows\system32\sisgrv.dll
2009-11-05 18:57:18 65536 ----a-r- c:\windows\system32\sis760.bin
2009-11-05 18:57:18 65536 ----a-r- c:\windows\system32\sis741.bin
2009-11-05 18:57:18 49152 ----a-r- c:\windows\system32\sis660.bin
2009-11-05 18:57:05 243200 ----a-r- c:\windows\system32\drivers\sisgrp.sys
2009-11-05 18:57:05 11776 ----a-r- c:\windows\system32\drivers\srvkp.sys
2009-11-05 13:58:35 0 d-----w- C:\Backup
2009-11-05 12:05:48 0 d-----w- c:\docume~1\alluse~1\applic~1\sentinel
2009-11-05 12:04:03 0 d-sh--r- c:\windows\PSICache
2009-11-05 12:03:14 98354 ----a-w- c:\windows\dla.exe
2009-11-05 12:03:14 78048 ----a-w- c:\windows\system32\drivers\drvmcdb.sys
2009-11-05 12:03:14 61494 ----a-w- c:\windows\system32\tfswapi.dll
2009-11-05 12:03:14 5589 ----a-w- c:\windows\system32\drivers\sscdbhk5.sys
2009-11-05 12:03:14 40096 ----a-w- c:\windows\system32\drivers\drvnddm.sys
2009-11-05 12:03:14 22963 ----a-w- c:\windows\system32\drivers\ssrtln.sys
2009-11-05 12:03:14 132 ----a-w- c:\windows\wininit.ini
2009-11-05 12:03:14 0 d-----w- c:\windows\system32\dla
2009-11-05 11:58:31 0 d-----w- c:\program files\VERITAS Software
2009-11-05 11:56:55 0 d-----w- c:\program files\CIS RecordNow DX
2009-11-05 11:55:00 1024 ---h--r- c:\windows\system32\NTIMPEG2.dll
2009-11-05 11:55:00 1024 ---h--r- c:\windows\system32\NTICDMK32.dll
2009-11-05 11:42:02 715 ----a-w- c:\windows\aolback.exe.lnk
2009-11-05 11:41:32 0 d-----w- c:\program files\common files\aolback
2009-11-05 11:41:20 0 d-----w- C:\Install AOL Communicator
2009-11-05 11:41:19 0 d-----w- C:\Install Winamp
2009-11-05 11:41:18 0 d-----w- C:\Install ICQ
2009-11-05 11:41:16 0 d-----w- C:\AOL Instant Messenger
2009-11-05 11:41:14 0 d-----w- C:\aolextras
2009-11-05 11:41:09 0 d-----w- c:\program files\AOL Companion
2009-11-05 11:41:04 0 d-----w- c:\windows\occache
2009-11-05 11:41:04 0 d-----w- c:\program files\Learn2.com
2009-11-05 11:40:59 0 d-----w- c:\docume~1\alluse~1\applic~1\Viewpoint
2009-11-05 11:40:58 0 d-----w- c:\program files\Viewpoint
2009-11-05 11:40:40 0 d-----w- c:\program files\common files\Nullsoft
2009-11-05 11:40:19 0 d-----w- c:\program files\common files\Real
2009-11-05 11:39:46 24659 ----a-w- c:\windows\system32\aolddial.dll
2009-11-05 11:39:46 153088 ----a-w- c:\windows\system32\jgdwmie.dll
2009-11-05 11:39:45 54784 ----a-w- c:\windows\system32\Inetwh32.dll
2009-11-05 11:39:45 29184 ----a-w- c:\windows\system32\popup.ocx
2009-11-05 11:39:45 1044480 ----a-w- c:\windows\system32\roboex32.dll
2009-11-05 11:39:26 65536 ----a-w- c:\windows\wanmpsvc.exe
2009-11-05 11:39:21 33588 ----a-w- c:\windows\system32\drivers\wanatw4.sys
2009-11-05 11:39:20 1706800 ----a-w- c:\windows\system32\gdiplus.dll
2009-11-05 11:39:12 0 d-----w- c:\program files\common files\aolshare
2009-11-05 11:39:05 0 d-----w- c:\program files\America Online 9.0
2009-11-05 11:36:59 0 d-----w- c:\program files\common files\AOL
2009-11-04 20:27:07 376 ----a-w- c:\windows\ODBC.INI
2009-11-04 20:24:47 0 d-----w- c:\program files\Microsoft ActiveSync
2009-11-04 20:23:25 0 d-----w- c:\windows\ShellNew
2009-11-04 20:23:23 0 d-----w- c:\program files\common files\L&H
2009-11-04 20:04:10 49265 ----a-w- c:\windows\system32\jpicpl32.cpl
2009-11-04 19:40:59 76800 ------w- c:\windows\system32\msshavmsg.dll
2009-11-04 19:38:19 33792 -c--a-w- c:\windows\system32\dllcache\custsat.dll
2009-11-04 19:37:59 809984 -c----w- c:\windows\system32\dllcache\wmvdmod.dll
2009-11-04 19:36:36 0 d-----w- c:\windows\network diagnostic
2009-11-04 19:36:34 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2009-11-04 19:36:34 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2009-11-04 19:35:18 19569 ----a-w- c:\windows\005306_.tmp
2009-11-04 19:21:53 0 d-----w- c:\windows\system32\wbem\AutoRecover
2009-11-04 19:21:40 0 d-s---w- c:\windows\system32\Microsoft
2009-11-04 19:17:19 316640 ----a-w- c:\windows\WMSysPr9.prx
2009-11-04 19:13:59 0 d-----w- c:\windows\ServicePackFiles
2009-11-04 19:12:10 2897920 ------w- c:\windows\system32\xpsp2res.dll
2009-11-04 19:11:10 19528 ----a-w- c:\windows\002236_.tmp
2009-11-04 19:11:07 0 d-----w- c:\windows\system32\ReinstallBackups
2009-11-04 19:10:42 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2009-11-04 19:08:22 0 d-----w- c:\windows\EHome
2009-11-04 19:02:08 0 d-sh--w- c:\windows\Installer
2009-11-04 18:55:29 0 d-sh--w- c:\documents and settings\all users\DRM
2009-11-04 18:53:53 0 d-----w- c:\program files\common files\MSSoap
2009-11-04 18:52:55 0 d--h--w- c:\program files\WindowsUpdate
2009-11-04 18:52:55 0 d-----w- c:\program files\Online Services
2009-11-04 18:52:49 0 d-----w- c:\program files\Messenger
2009-11-04 18:52:39 0 d-----w- c:\program files\MSN Gaming Zone
2009-11-04 18:52:28 0 d-----w- c:\program files\Windows NT
2009-11-04 13:43:46 0 d-----w- c:\program files\common files\ODBC
2009-11-04 13:43:43 0 d-----w- c:\program files\common files\SpeechEngines
2009-11-04 13:43:21 0 d-----r- c:\documents and settings\all users\Documents

==================== Find3M ====================

2009-11-05 11:40:27 8552 ----a-w- c:\windows\system32\drivers\asctrm.sys
2009-11-04 18:53:13 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36:27 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36:24 78336 ------w- c:\windows\system32\ieencode.dll
2009-08-29 07:36:24 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll

============= FINISH: 12:31:29.18 ===============

Forsaken Knight · 2009/11/12

if you want me to post the hijackthis log as well, please state so. In addition, if you only want the specific problems on my family members pc, (by this, I mean the ones whom appeared with an x status from the http://www.hijackthis.de/ web site results from the log), I'll post only those specific ones. The total found by hijackthis was three.

Again, thank you for your time and help upon this matter.

broni · 2009/11/12

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

STEP 4. Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Forsaken Knight · 2009/11/13

Summary:

I did the first instructions as stated. I had to use f5 instead of f8. I guess that my family members pc was older than I first figured. I did the scan as instructed. That scan found nothing. I then went back and put a check mark on all parts within the scanner options which did not have the word ignore within the check mark box description. 54 things were found in that scan. In the original instructions, it is stated as, "Under Scanner Options make sure the following are checked (leave all others unchecked): Close browsers before scanning. Terminate memory threats before quarantining." Other than that, Everything went fine.

I did the second step as instructed. The scan found 3 thrings. Other than that, the instructions ran smoothly.

I did the third step as instructed. Nothing additional to say that was different.

I did the fourth step as instructed.

The following posts' of mine will be the logs that are stated in the instructed to be posted.

Forsaken Knight · 2009/11/13

super antispyware log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/13/2009 at 04:13 PM

Application Version : 4.30.1004

Core Rules Database Version : 4267
Trace Rules Database Version: 2151

Scan type : Complete Scan
Total Scan Time : 01:43:31

Memory items scanned : 231
Memory threats detected : 0
Registry items scanned : 4560
Registry threats detected : 0
File items scanned : 55829
File threats detected : 54

Adware.Tracking Cookie
C:\Documents and Settings\Micro\Cookies\micro@revsci[1].txt
C:\Documents and Settings\Micro\Cookies\micro@specificmedia[2].txt
C:\Documents and Settings\Micro\Cookies\micro@adserver.adtechus[1].txt
C:\Documents and Settings\Micro\Cookies\micro@collective-media[1].txt
C:\Documents and Settings\Micro\Cookies\micro@tacoda[2].txt
C:\Documents and Settings\Micro\Cookies\micro@a1.interclick[2].txt
C:\Documents and Settings\Micro\Cookies\micro@trafficmp[1].txt
C:\Documents and Settings\Micro\Cookies\micro@realmedia[1].txt
C:\Documents and Settings\Micro\Cookies\micro@boostmobile.112.2o7[1].txt
C:\Documents and Settings\Micro\Cookies\micro@oasn03.247realmedia[1].txt
C:\Documents and Settings\Micro\Cookies\micro@adserving.autotrader[1].txt
C:\Documents and Settings\Micro\Cookies\micro@apmebf[2].txt
C:\Documents and Settings\Micro\Cookies\micro@msnportal.112.2o7[1].txt
C:\Documents and Settings\Micro\Cookies\micro@tribalfusion[1].txt
C:\Documents and Settings\Micro\Cookies\micro@serving-sys[2].txt
C:\Documents and Settings\Micro\Cookies\micro@atdmt[2].txt
C:\Documents and Settings\Micro\Cookies\micro@ad.yieldmanager[1].txt
C:\Documents and Settings\Micro\Cookies\micro@fastclick[1].txt
C:\Documents and Settings\Micro\Cookies\micro@interclick[2].txt
C:\Documents and Settings\Micro\Cookies\micro@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Micro\Cookies\micro@at.atwola[1].txt
C:\Documents and Settings\Micro\Cookies\micro@zedo[1].txt
C:\Documents and Settings\Micro\Cookies\micro@invitemedia[1].txt
C:\Documents and Settings\Micro\Cookies\micro@server.iad.liveperson[2].txt
C:\Documents and Settings\Micro\Cookies\micro@ak[2].txt
C:\Documents and Settings\Micro\Cookies\micro@richmedia.yahoo[2].txt
C:\Documents and Settings\Micro\Cookies\micro@burstnet[2].txt
C:\Documents and Settings\Micro\Cookies\micro@ad.m5prod[2].txt
C:\Documents and Settings\Micro\Cookies\micro@questionmarket[2].txt
C:\Documents and Settings\Micro\Cookies\micro@network.realmedia[1].txt
C:\Documents and Settings\Micro\Cookies\micro@content.yieldmanager[2].txt
C:\Documents and Settings\Micro\Cookies\micro@yieldmanager[1].txt
C:\Documents and Settings\Micro\Cookies\micro@ad.wsod[2].txt
C:\Documents and Settings\Micro\Cookies\micro@casalemedia[2].txt
C:\Documents and Settings\Micro\Cookies\micro@cdn4.specificclick[2].txt
C:\Documents and Settings\Micro\Cookies\micro@statcounter[1].txt
C:\Documents and Settings\Micro\Cookies\micro@247realmedia[2].txt
C:\Documents and Settings\Micro\Cookies\micro@server.iad.liveperson[3].txt
C:\Documents and Settings\Micro\Cookies\micro@advertising[1].txt
C:\Documents and Settings\Micro\Cookies\micro@ads.bridgetrack[2].txt
C:\Documents and Settings\Micro\Cookies\micro@statse.webtrendslive[2].txt
C:\Documents and Settings\Micro\Cookies\micro@oasn04.247realmedia[2].txt
C:\Documents and Settings\Micro\Cookies\micro@pointroll[2].txt
C:\Documents and Settings\Micro\Cookies\micro@insightexpressai[1].txt
C:\Documents and Settings\Micro\Cookies\micro@citi.bridgetrack[2].txt
C:\Documents and Settings\Micro\Cookies\micro@ads.pointroll[1].txt
C:\Documents and Settings\Micro\Cookies\micro@adbrite[1].txt
C:\Documents and Settings\Micro\Cookies\micro@doubleclick[2].txt
C:\Documents and Settings\Micro\Cookies\micro@ads.infinisource[2].txt
C:\Documents and Settings\Micro\Cookies\micro@www.googleadservices[2].txt
C:\Documents and Settings\Micro\Cookies\micro@lfstmedia[2].txt
C:\Documents and Settings\Micro\Cookies\micro@bs.serving-sys[1].txt
C:\Documents and Settings\Micro\Cookies\micro@mediaplex[1].txt
C:\Documents and Settings\Micro\Cookies\micro@specificclick[2].txt

Forsaken Knight · 2009/11/13

malware antibytes malware

Malwarebytes' Anti-Malware 1.41
Database version: 3165
Windows 5.1.2600 Service Pack 3

11/13/2009 5:51:45 PM
mbam-log-2009-11-13 (17-51-45).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 168110
Time elapsed: 39 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Forsaken Knight · 2009/11/13

gmer log

GMER 1.0.15.15220 - http://www.gmer.net
Rootkit scan 2009-11-13 18:45:24
Windows 5.1.2600 Service Pack 3
Running: fi79ifsf.exe; Driver: C:\DOCUME~1\Micro\LOCALS~1\Temp\awadyaow.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB402E6B8]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB4198FC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB4195C80]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB402E574]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB4199580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB41AD900]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB41ADB10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB41B1B10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB4199670]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB4196210]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB41B09F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB402EA52]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB41AD280]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB41B0F10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB41B0F90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB4196070]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB402E64E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB41AF180]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB41AEF40]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB402E76E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB41B16F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB41B1150]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB4198BE0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB402E72E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB4199190]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB4196440]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB402E8AE]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB41AE200]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB41AE080]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [80, 95, 19, B4, 00, D9, 1A, ...]
.text ntoskrnl.exe!_abnormal_termination + 150 804E27AC 4 Bytes JMP CB30B402
.text ntoskrnl.exe!_abnormal_termination + 428 804E2A84 4 Bytes CALL F859DE8B
? srescan.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E351FF7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E351F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E351FBC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E351F04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E351F3E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E352032 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3128] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3521F4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [B419BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [B419BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [B419BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [B41B6B30] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [B419BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [B419DB20] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [B419BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [B419E260] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [B419D930] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [B41968D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [B4196A80] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [B41965E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [B4196980] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[692] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[692] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs tdrpm174.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

---- EOF - GMER 1.0.15 ----

Forsaken Knight · 2009/11/13

hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:47:57 PM, on 11/13/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\util\winzip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtbx01.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe "
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\util\winzip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7907 bytes

Forsaken Knight · 2009/11/13

I ran the hijackthis log on the web site that lets you check the logs from hijackthis. I found only one thing from the results. If anyone sees anything in the logs that I posted that I should also check, please let me know.

This is the only thing with an x status.

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
Neutral Nasty (2.93 / 5.00)

broni · 2009/11/13

I don't like GMER report, so....

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Forsaken Knight · 2009/11/16

confusing part...

I did as I was instructed. I closed all anti-virus programs. I even physically removed the connection from the internet. I also closed my firewall (of course, I did this after physically removing the internet connection). I then checked in the task manager for anything that I might have missed. I had 28 processes left, which all seemed to be requirements for running my family members system (this is an assumption). I then ran the combo fix program. The program gave me the error of my date being wrong. I checked, and it was correct. Well, I did, and it is correct. Therefore, I do not know what to do next, as this is a weird error I am getting. Could someone please clarify this? In addition, if you want me to post what programs are running, I will be happy to list them.

In the mean time, I am going to check to see if the program will run in safe mode.

I look forward to anyone’s replies on this matter of mine, which are meant to help me in this dilemma.

Thank you all for your time.

Sincerely,

FK

broni · 2009/11/16

The program gave me the error of my date being wrong
Click to expand...

Does it prevent you from running Combofix?

Forsaken Knight · 2009/11/16

yes, combofix stops working after getting that notification.

broni · 2009/11/16

Delete your Combofix file.
Download fresh one from HERE
Try to run it again.

Forsaken Knight · 2009/11/17

Error with new link.

I deleted the old combofix file from my desktop, and downloaded the new recommended link. When I ran it, I got the following message.

"C: Documents and Settings\Micro\Desktop\Scft34rsd.exe

C: Documents and Settings\Micro\Desktop\Scft34rsd.exe is not a valid Win32 application. "

The program does not run, and only allows an "o.k. ", to close the message window.

Forsaken Knight · 2009/11/17

Trial and error worked, scanned finally

I tried the other links from before after the new one did not work. The second link from the first post for combofix download lead to a forum, and no immidiate download link for combofix was apparant. Therefore, I tried the first link again, since I deleted the original downloaded combofix. I installed combofix and ran it. The program worked in normal mode. I had to disable avast and only avast. After that, the program ran well. It went up to 50 stages completed of the scan. The log was done, and I saved the log to my desktop. I then ran the hijackthis program, and saved the log to my desktop. The following are the logs from combofix and hijackthis.

Forsaken Knight · 2009/11/17

combofix log

ComboFix 09-11-18.01 - Micro 11/17/2009 14:06.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.479.161 [GMT -5:00]
Running from: c:\documents and settings\Micro\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091117-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2009-10-17 to 2009-11-17 )))))))))))))))))))))))))))))))
.

2009-11-15 18:25 . 2009-11-15 18:25 -------- d-----w- c:\documents and settings\Berta\Application Data\Malwarebytes
2009-11-14 08:45 . 2009-11-14 08:45 -------- d-----w- c:\documents and settings\Willie\Application Data\Malwarebytes
2009-11-13 21:52 . 2009-11-13 21:52 -------- d-----w- c:\documents and settings\Micro\Application Data\Malwarebytes
2009-11-13 21:52 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-13 21:52 . 2009-11-13 21:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-13 21:52 . 2009-11-13 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-13 21:52 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-13 01:16 . 2009-11-13 01:16 117760 ----a-w- c:\documents and settings\Micro\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-13 01:16 . 2009-11-13 01:16 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-13 01:15 . 2009-11-13 01:15 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-13 01:15 . 2009-11-13 01:15 -------- d-----w- c:\documents and settings\Micro\Application Data\SUPERAntiSpyware.com
2009-11-13 01:14 . 2009-11-13 01:14 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-12 01:44 . 2009-11-12 01:44 -------- d-----w- c:\program files\Trend Micro
2009-11-11 21:52 . 2009-11-11 21:52 -------- d-----w- c:\program files\AskBarDis
2009-11-11 21:51 . 2009-11-11 21:51 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-11-11 21:51 . 2009-02-16 05:10 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-11-11 21:51 . 2009-02-16 05:10 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-11-11 21:51 . 2009-11-11 21:51 -------- d-----w- c:\windows\system32\ZoneLabs
2009-11-11 21:51 . 2009-11-11 21:51 -------- d-----w- c:\program files\Zone Labs
2009-11-11 21:51 . 2009-02-16 05:10 1221512 ----a-w- c:\windows\system32\zpeng25.dll
2009-11-11 21:50 . 2009-11-17 19:06 -------- d-----w- c:\windows\Internet Logs
2009-11-11 21:33 . 2009-09-15 11:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-11 21:33 . 2009-09-15 11:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-11 21:33 . 2009-09-15 11:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-11 21:33 . 2009-09-15 11:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-11 21:33 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-11 21:33 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-11 21:33 . 2009-09-15 11:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-11 21:33 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-11 21:33 . 2009-09-15 11:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-11 21:33 . 2009-11-11 21:33 -------- d-----w- c:\program files\Alwil Software
2009-11-10 03:40 . 2009-11-10 03:40 -------- d-----w- c:\windows\Sun
2009-11-09 22:47 . 2009-11-14 21:49 -------- d-----w- c:\documents and settings\Micro\Local Settings\Application Data\Adobe
2009-11-08 19:35 . 2009-08-29 07:36 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-11-08 19:35 . 2009-08-29 07:36 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-11-08 19:35 . 2009-08-29 07:36 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-11-08 19:35 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-11-08 19:35 . 2009-08-29 07:36 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-11-08 19:35 . 2009-08-29 07:36 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-11-08 19:35 . 2009-08-29 07:36 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-11-08 19:35 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-11-08 19:04 . 2009-11-08 19:04 -------- d-----w- c:\program files\MSXML 4.0
2009-11-08 18:45 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-08 18:45 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-11-08 18:45 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-11-08 18:45 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-11-08 18:44 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-11-08 18:44 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-11-08 18:44 . 2008-09-04 17:15 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-11-08 18:43 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-08 18:43 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-08 18:43 . 2009-08-04 14:20 2066048 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-11-08 18:42 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-11-08 18:42 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-11-08 18:42 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-11-08 18:42 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-11-08 18:42 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-11-08 18:42 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-11-08 18:42 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-11-08 18:42 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-11-08 18:42 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-11-08 18:40 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-11-08 18:40 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-11-08 18:39 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-11-08 18:39 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-11-08 18:39 . 2009-08-13 15:16 512000 -c----w- c:\windows\system32\dllcache\jscript.dll
2009-11-08 18:38 . 2009-11-11 11:49 -------- d--h--w- c:\windows\$hf_mig$
2009-11-08 10:54 . 2009-11-08 10:54 -------- d-----w- c:\documents and settings\Berta\Local Settings\Application Data\Google
2009-11-08 09:50 . 2009-11-08 09:50 -------- d-sh--w- c:\documents and settings\Willie\UserData
2009-11-08 09:49 . 2009-11-08 09:49 -------- d-----w- c:\documents and settings\Willie\Local Settings\Application Data\Google
2009-11-07 21:48 . 2009-11-11 18:28 -------- d-----w- c:\documents and settings\Micro\Local Settings\Application Data\Google
2009-11-07 21:46 . 2009-11-07 21:47 -------- d-----w- c:\program files\Google
2009-11-07 21:46 . 2009-11-08 09:48 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-11-07 21:44 . 2009-11-07 21:44 1961720 ----a-w- c:\documents and settings\Micro\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-11-07 20:50 . 2009-11-07 20:50 -------- d-sh--w- c:\documents and settings\Micro\UserData
2009-11-07 19:43 . 2009-11-07 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-11-07 19:42 . 2009-11-07 19:42 -------- d-----w- c:\program files\Common Files\HP
2009-11-07 19:40 . 2009-11-07 19:40 -------- d-----w- c:\program files\Hewlett-Packard
2009-11-07 19:37 . 2009-11-07 19:37 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-11-07 19:35 . 2009-11-07 19:35 -------- d-sh--w- c:\documents and settings\Berta\UserData
2009-11-07 19:34 . 2005-10-28 00:24 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2009-11-07 19:34 . 2005-10-28 00:24 49664 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2009-11-07 19:33 . 2005-10-15 03:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2009-11-07 19:33 . 2005-03-22 12:48 77824 ----a-r- c:\windows\system32\hpzids01.dll
2009-11-07 19:33 . 2008-04-14 05:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-11-07 19:33 . 2008-04-14 05:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-11-07 19:29 . 2005-03-14 18:39 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2009-11-07 19:29 . 2005-03-14 17:05 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2009-11-07 19:29 . 2005-03-14 17:05 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2009-11-07 19:29 . 2005-03-14 17:03 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2009-11-07 19:29 . 2005-03-08 16:55 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2009-11-07 19:29 . 2005-03-08 16:55 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2009-11-07 19:29 . 1998-10-29 21:45 306688 ----a-w- c:\windows\IsUninst.exe
2009-11-07 19:28 . 2008-04-14 05:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-11-07 19:28 . 2008-04-14 05:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-11-07 19:28 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-11-07 19:28 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-07 19:27 . 2009-11-07 19:42 -------- d-----w- c:\program files\HP
2009-11-07 19:26 . 2009-11-07 19:44 109920 ----a-w- c:\windows\hpoins08.dat
2009-11-07 19:26 . 2006-01-24 06:15 7577 ------w- c:\windows\hpomdl08.dat
2009-11-07 19:24 . 2009-11-07 19:24 -------- d-----w- c:\documents and settings\Berta\Application Data\VERITAS
2009-11-07 19:04 . 2009-11-07 19:04 -------- d-----w- c:\documents and settings\Willie\Application Data\VERITAS
2009-11-07 19:04 . 2009-11-07 19:04 20264 ----a-w- c:\documents and settings\Willie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 19:04 . 2008-04-14 10:42 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-05 19:18 . 2009-11-05 19:18 971552 ----a-w- c:\windows\system32\drivers\tdrpm174.sys
2009-11-05 19:17 . 2009-11-05 19:17 540000 ----a-w- c:\windows\system32\drivers\timntr.sys
2009-11-05 19:17 . 2009-11-05 19:17 44704 ----a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-11-05 19:17 . 2009-11-05 19:17 134272 ----a-w- c:\windows\system32\drivers\snman380.sys
2009-11-05 19:17 . 2009-11-05 19:17 -------- d-----w- c:\program files\Acronis
2009-11-05 19:16 . 2009-11-05 19:17 -------- d-----w- c:\program files\Common Files\Acronis
2009-11-05 18:57 . 2005-03-07 06:15 28672 ----a-r- c:\windows\system32\SiSPInst.dll
2009-11-05 18:57 . 2005-03-03 19:40 1864409 ----a-r- c:\windows\system32\sisgl.dll
2009-11-05 18:57 . 2005-03-04 07:48 870400 ----a-r- c:\windows\system32\sisgrv.dll
2009-11-05 18:57 . 2005-03-03 18:57 49152 ----a-r- c:\windows\system32\sis660.bin
2009-11-05 18:57 . 2003-11-26 08:10 65536 ----a-r- c:\windows\system32\sis741.bin
2009-11-05 18:57 . 2003-11-26 08:10 65536 ----a-r- c:\windows\system32\sis760.bin
2009-11-05 18:57 . 2005-03-04 07:40 243200 ----a-r- c:\windows\system32\drivers\sisgrp.sys
2009-11-05 18:57 . 2005-03-03 19:41 11776 ----a-r- c:\windows\system32\drivers\srvkp.sys
2009-11-05 13:58 . 2009-11-05 14:10 -------- d-----w- C:\Backup
2009-11-05 12:05 . 2009-11-05 12:05 -------- d-----w- c:\documents and settings\All Users\Application Data\sentinel
2009-11-05 12:05 . 2009-11-11 21:25 -------- dc----w- c:\windows\system32\DRVSTORE
2009-11-05 12:04 . 2009-11-11 21:25 -------- d-sh--r- c:\windows\PSICache
2009-11-05 12:03 . 2009-11-05 12:03 -------- d-----w- c:\windows\system32\dla
2009-11-05 12:03 . 2002-04-17 08:25 98354 ----a-w- c:\windows\dla.exe
2009-11-05 12:03 . 2002-04-17 08:25 61494 ----a-w- c:\windows\system32\tfswapi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-13 01:37 . 2009-11-13 01:37 97270 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_11_12_20_30_07_small.dmp.zip
2009-11-13 01:30 . 2009-11-13 01:30 99840 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2009-11-13 01:30 . 2009-11-13 01:30 1399296 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2009-11-07 19:23 . 2009-11-07 19:23 20264 ----a-w- c:\documents and settings\Berta\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\program files\Viewpoint
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\QuickTime
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\program files\QuickTime
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\program files\Common Files\Nullsoft
2009-11-05 11:40 . 2009-11-05 11:40 8552 ----a-w- c:\windows\system32\drivers\asctrm.sys
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\program files\Common Files\Real
2009-11-05 11:40 . 2009-11-05 11:40 -------- d-----w- c:\program files\Real
2009-11-04 19:44 . 2009-11-04 18:55 86327 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-11-04 18:56 . 2009-11-04 18:56 -------- d-----w- c:\program files\microsoft frontpage
2009-11-04 18:53 . 2009-11-04 18:53 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-11 14:18 . 2001-08-23 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2001-08-23 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2001-08-23 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2009-11-04 19:16 78336 ------w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2001-08-23 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00 . 2001-08-23 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 23:22 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98} "= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-07 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 36975]
"RealTray "= "c:\program files\Real\RealPlayer\RealPlay.exe" [2009-11-05 26112]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-11-05 77824]
"StorageGuard "= "c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-05-09 155648]
"dla "= "c:\windows\system32\dla\tfswctrl.exe" [2002-04-17 102455]
"TrueImageMonitor.exe "= "c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2008-11-22 4352832]
"AcronisTimounterMonitor "= "c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2008-11-22 960528]
"Acronis Scheduler2 Service "= "c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2008-11-22 165144]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 49152]
"avast! "= "c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SoundMan "= "SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2009-11-5 36953]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WinZip Quick Pick.lnk - d:\util\winzip\WZQKPICK.EXE [2009-11-4 106560]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11/11/2009 4:33 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/11/2009 4:33 PM 20560]
S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 14:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3724)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2009-11-17 14:50
ComboFix-quarantined-files.txt 2009-11-17 19:50

Pre-Run: 56,026,791,936 bytes free
Post-Run: 57,079,922,688 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - F9C4A7CEF1207F39305721DF4BBC50D1

Forsaken Knight · 2009/11/17

hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:55:28 PM, on 11/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\util\winzip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe "
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\util\winzip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7403 bytes

Log in or Sign up

Active Help with fixing a family members pc.

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Active Help with fixing a family members pc.

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

broni Moderator Malware Analyst

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Forsaken Knight Well-Known Member Thread Starter

Share This Page

Useful Searches