Solved Internet Explorer 6 runs very slow (not sure what infection)

scgoh123 · 2010/11/07

[Resolved] Internet Explorer 6 runs very slow (not sure what infection)

Internet 6 on my teacher's computer runs very slow!! When attempt to open some .pdf files from IE6, it become very slow to respond and I had to stop it using task manager. The problem is, when we open other browsers except IE6, the computers runs great and nothing happened. Can you check whether is it contains viruses or malware?

System Specs:
Dell Optilex 740
AMD athlon 64 X2 dual
core processor 3800+
2Ghz, 960MB or RAM
Windows Xp service pack 2

scgoh123 · 2010/11/07

DDS log:
DDS (Ver_10-11-08.01) - NTFSx86
Run by DELL TOWER at 0:47:26.37 on Wed 11/03/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.410 [GMT 8:00]

AV: AVG Anti-Virus 7.0.289 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
FW: Trend Micro OfficeScan Enterprise Client Firewall *enabled* {59DF26A4-8DBF-45FE-952F-04DBF545957E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\HP\HP UT\bin\hppusg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\SXE6E7.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\DELL TOWER\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uURLSearchHooks: Jhoos Toolbar: {9c25d2ef-c545-49ee-bd1a-f264b273ec10} - c:\program files\jhoos\tbJho1.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Jhoos Toolbar: {9c25d2ef-c545-49ee-bd1a-f264b273ec10} - c:\program files\jhoos\tbJho1.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Jhoos Toolbar: {9c25d2ef-c545-49ee-bd1a-f264b273ec10} - c:\program files\jhoos\tbJho1.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install

scgoh123 · 2010/11/07

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-08.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 11/26/2006 6:03:29 PM
System Uptime: 11/2/2010 8:26:16 PM (4 hours ago)

Motherboard: Dell Inc | | 0UT225
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2004/1000mhz
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2004/1000mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 24.685 GiB free.
D: is FIXED (NTFS) - 37 GiB total, 37.19 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP204: 8/5/2010 11:31:34 AM - System Checkpoint
RP205: 8/9/2010 7:50:23 AM - System Checkpoint
RP206: 8/10/2010 9:20:22 AM - System Checkpoint
RP207: 8/12/2010 7:23:12 AM - System Checkpoint
RP208: 8/13/2010 10:26:00 AM - System Checkpoint
RP209: 8/16/2010 7:26:27 AM - System Checkpoint
RP210: 8/17/2010 11:49:37 AM - System Checkpoint
RP211: 8/18/2010 11:52:36 AM - System Checkpoint
RP212: 8/20/2010 7:14:23 AM - System Checkpoint
RP213: 8/23/2010 8:33:11 AM - System Checkpoint
RP214: 8/24/2010 8:38:16 AM - System Checkpoint
RP215: 8/25/2010 8:38:45 AM - System Checkpoint
RP216: 8/26/2010 9:33:30 AM - System Checkpoint
RP217: 1/1/2003 1:19:38 AM - System Checkpoint
RP218: 9/3/2010 7:29:28 AM - System Checkpoint
RP219: 1/1/2003 12:34:39 AM - System Checkpoint
RP220: 1/2/2003 3:14:06 AM - System Checkpoint
RP221: 10/13/2010 1:09:14 PM - System Checkpoint
RP222: 10/14/2010 2:06:07 PM - System Checkpoint
RP223: 10/15/2010 2:32:18 PM - System Checkpoint
RP224: 10/15/2010 3:45:12 PM - Software Distribution Service 3.0
RP225: 10/15/2010 3:52:32 PM - Installed Windows Internet Explorer 8.
RP226: 10/15/2010 3:53:20 PM - Software Distribution Service 3.0
RP227: 11/2/2010 10:11:19 AM - System Checkpoint
RP228: 11/2/2010 8:23:07 PM - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe Reader 7.0.7
AMD Processor Driver
Apple Application Support
Apple Software Update
AVG Free Edition
Broadcom Gigabit Integrated Controller
Broadcom Management Programs
BufferChm
ClocX (1.5b1)
CorePLS_Full_QFolder
CorePLS_Min_QFolder
D1300
D1300_Help
D2400
D2400_Help
Dell Resource CD

broni · 2010/11/08

Please, read this post, then post ALL requested log(s).

Attach.txt log is incomplete. Please, redo.

I don't see any real AV program running.

AVG 7 is not functional anymore and must be uninstalled.
At the link above, you'll find couple of AV programs, you can download and install.

I can see Trend Micro OfficeScan Enterprise Client Firewall, but I'm not sure, if those are some traces, or a functional firewall.
Please explain.

scgoh123 · 2010/11/08

sorry about the DDS log. Do I need to download antivirus software first before I proceed to produce logs??

broni · 2010/11/08

Yes, please.

Also...

I can see Trend Micro OfficeScan Enterprise Client Firewall, but I'm not sure, if those are some traces, or a functional firewall.
Please explain.
Click to expand...

scgoh123 · 2010/11/08

I saw Trend Micro OfficsScan Client also in Add/Remove Programs, actually it contains firewall also, but the thing is it requires password to remove the software. As the teacher had forgotten the password, how to remove it??

broni · 2010/11/08

If it's working, I'd simply leave it alone.

scgoh123 · 2010/11/08

okay, I don't think it's working......
I'll post MBAM logs first.
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5076

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

11/3/2010 2:31:24 AM
mbam-log-2010-11-03 (02-31-24).txt

Scan type: Quick scan
Objects scanned: 155230
Time elapsed: 14 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winlogon (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\status (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-220523388-920026266-725345543-1004\Dc39\svchost.exe (Worm.Muha) -> Quarantined and deleted successfully.
C:\Documents and Settings\DELL TOWER\Local Settings\Temp\MicrosoftPowerPoint\svchost.exe (Worm.Muha) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.

broni · 2010/11/08

I don't think it's working......
Click to expand...

What does make you to think so?

scgoh123 · 2010/11/08

I don't think the OfficeSacn is WORKING, because it doesn't exist on the right side of the taskbar and Windows Security Alert doesn't detect any OfficeScan Firewall is working on the background.... xP

scgoh123 · 2010/11/08

...and GMER seems running slowly, until half an hour still not yet finished.......
MBR log:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E2000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7497000 MountMgr.sys
0xF7328000 ftdisk.sys
0xF798B000 dmload.sys
0xF7302000 dmio.sys
0xF770F000 PartMgr.sys
0xF74A7000 VolSnap.sys
0xF72EA000 atapi.sys
0xF7717000 cercsr6.sys
0xF72D2000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF74B7000 disk.sys
0xF74C7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF72B3000 fltMgr.sys
0xF72A1000 sr.sys
0xF728A000 KSecDD.sys
0xF71FD000 Ntfs.sys
0xF71D0000 NDIS.sys
0xF71B5000 Mup.sys
0xF7667000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF7143000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xF6D7B000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6D67000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF77DF000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6D44000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF77E7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7677000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7687000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7697000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6D21000 \SystemRoot\system32\DRIVERS\ks.sys
0xF6CAE000 \SystemRoot\system32\DRIVERS\ar5211.sys
0xF6C88000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7947000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6C74000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7B7A000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF794B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6C5D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF76D7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77F7000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6C09000 \SystemRoot\system32\DRIVERS\psched.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF780F000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7817000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF5F18000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF7517000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF781F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7827000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF79AD000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5EBC000 \SystemRoot\system32\DRIVERS\update.sys
0xF7967000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7557000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7567000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79B5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF36D8000 \SystemRoot\system32\drivers\sthda.sys
0xF36B4000 \SystemRoot\system32\drivers\portcls.sys
0xF7597000 \SystemRoot\system32\drivers\drmk.sys
0xF783F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF79B9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B20000 \SystemRoot\System32\Drivers\Null.SYS
0xF79BB000 \SystemRoot\System32\Drivers\Beep.SYS
0xF784F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7857000 \SystemRoot\System32\drivers\vga.sys
0xF79BD000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79BF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF785F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7867000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF791B000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3681000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF3629000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF3601000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF35E0000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF35BE000 \SystemRoot\System32\drivers\afd.sys
0xF75C7000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF75D7000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF3592000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF34FB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF75F7000 \SystemRoot\System32\Drivers\Fips.SYS
0xF7933000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7607000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF793F000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF79C3000 \SystemRoot\System32\Drivers\avg7rsw.sys
0xF5F0C000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF7647000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF3443000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79D5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF5DB8000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7757000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A63000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xF34AB000 \??\C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys
0xBA3E8000 \??\C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys
0xBA3A9000 \??\C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys
0xBA500000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB993C000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA2C9000 \SystemRoot\system32\drivers\sysaudio.sys
0xB936A000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7A43000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB945F000 \SystemRoot\System32\Drivers\DgiVecp.sys
0xB9183000 \SystemRoot\system32\DRIVERS\srv.sys
0xB9079000 \??\C:\Program Files\Trend Micro\OfficeScan Client\tm_cfw.sys
0xB8D40000 \SystemRoot\System32\Drivers\HTTP.sys
0xB7E3C000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF7847000 \??\C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\mbr.sys
0xB652A000 \??\C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\kgroquod.sys
0xB6500000 \SystemRoot\system32\drivers\kmixer.sys
0xB64DD000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7A35000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0xB64C8000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 54):
0 System Idle Process
4 System
636 C:\WINDOWS\system32\smss.exe
692 csrss.exe
716 C:\WINDOWS\system32\winlogon.exe
760 C:\WINDOWS\system32\services.exe
772 C:\WINDOWS\system32\lsass.exe
968 C:\WINDOWS\system32\svchost.exe
1012 svchost.exe
1052 C:\WINDOWS\system32\svchost.exe
1156 svchost.exe
1184 svchost.exe
1448 C:\WINDOWS\system32\spoolsv.exe
1680 C:\WINDOWS\explorer.exe
1840 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1848 C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe
1860 C:\WINDOWS\system32\rundll32.exe
1868 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
1876 C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
1884 C:\Program Files\HP\HP UT\bin\hppusg.exe
1920 C:\WINDOWS\Samsung\ComSMMgr\SSMMgr.exe
1944 C:\WINDOWS\stsystra.exe
1992 C:\WINDOWS\system32\ctfmon.exe
2032 C:\Program Files\Messenger\msmsgs.exe
196 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
288 C:\Program Files\OpenOffice.org 3\program\soffice.exe
320 C:\Program Files\OpenOffice.org 3\program\soffice.bin
408 svchost.exe
400 C:\WINDOWS\system32\svchost.exe
560 C:\Program Files\Java\jre6\bin\jqs.exe
624 C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
672 C:\WINDOWS\system32\nvsvc32.exe
1080 C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
1584 C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
2464 C:\WINDOWS\Temp\YME77F.EXE
2780 C:\WINDOWS\system32\wscntfy.exe
2868 alg.exe
3572 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
3880 C:\Program Files\Mozilla Firefox\firefox.exe
1604 C:\WINDOWS\system32\wuauclt.exe
3068 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
1800 C:\Documents and Settings\DELL TOWER\My Documents\Downloads\lzwpn62z.exe
3000 C:\Documents and Settings\DELL TOWER\My Documents\Downloads\avira_antivir_personal_en.exe
3388 C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\RarSFX1\presetup.exe
2512 C:\WINDOWS\system32\msiexec.exe
376 C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\RarSFX1\setup.exe
2196 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1484 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
3876 C:\Program Files\Avira\AntiVir Desktop\sched.exe
2460 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3188 C:\Program Files\Avira\AntiVir Desktop\avconfig.exe
1804 C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
2088 C:\Program Files\Avira\AntiVir Desktop\update.exe
1000 C:\Documents and Settings\DELL TOWER\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`036e8e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000009`51a18200 (NTFS)

PhysicalDrive0 Model Number: <error opening>

Size Device Name MBR Status
--------------------------------------------
ERROR Opening: \\.\PhysicalDrive0 (32)

Done!

broni · 2010/11/08

MBRCheck couldn't read MBR for some reason.
Let's try different tool...

Download Bootkit Remover to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/

After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.

It will show a Black screen with some data on it.

Right click on the screen and click Select All.

Press CTRL+C

Open a Notepad and press CTRL+V

Post the output back here.

Regarding TrendMicro firewall, see, if this will help: http://www.mydigitallife.info/2008/...cro-officescan-uninstall-password-to-default/
You may need to restart computer after step #6

scgoh123 · 2010/11/08

It came out this after I ran Bootkit Remover
.\debug.cpp(238) : Debug log started at 02.11.2010 - 19:47:20
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Professional Service Pack 2 (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x804d7000 0x0020b000 "\WINDOWS\system32\ntkrnlpa.exe "
.\debug.cpp(256) : 0x806e2000 0x00020d00 "\WINDOWS\system32\hal.dll "
.\debug.cpp(256) : 0xf7987000 0x00002000 "\WINDOWS\system32\KDCOM.DLL "
.\debug.cpp(256) : 0xf7897000 0x00003000 "\WINDOWS\system32\BOOTVID.dll "
.\debug.cpp(256) : 0xf7358000 0x0002e000 "ACPI.sys "
.\debug.cpp(256) : 0xf7989000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS "
.\debug.cpp(256) : 0xf7347000 0x00011000 "pci.sys "
.\debug.cpp(256) : 0xf7487000 0x00009000 "isapnp.sys "
.\debug.cpp(256) : 0xf7a4f000 0x00001000 "pciide.sys "
.\debug.cpp(256) : 0xf7707000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS "
.\debug.cpp(256) : 0xf7497000 0x0000b000 "MountMgr.sys "
.\debug.cpp(256) : 0xf7328000 0x0001f000 "ftdisk.sys "
.\debug.cpp(256) : 0xf798b000 0x00002000 "dmload.sys "
.\debug.cpp(256) : 0xf7302000 0x00026000 "dmio.sys "
.\debug.cpp(256) : 0xf770f000 0x00005000 "PartMgr.sys "
.\debug.cpp(256) : 0xf74a7000 0x0000d000 "VolSnap.sys "
.\debug.cpp(256) : 0xf72ea000 0x00018000 "atapi.sys "
.\debug.cpp(256) : 0xf7717000 0x00008000 "cercsr6.sys "
.\debug.cpp(256) : 0xf72d2000 0x00018000 "\WINDOWS\System32\Drivers\SCSIPORT.SYS "
.\debug.cpp(256) : 0xf74b7000 0x00009000 "disk.sys "
.\debug.cpp(256) : 0xf74c7000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS "
.\debug.cpp(256) : 0xf72b3000 0x0001f000 "fltMgr.sys "
.\debug.cpp(256) : 0xf72a1000 0x00012000 "sr.sys "
.\debug.cpp(256) : 0xf728a000 0x00017000 "KSecDD.sys "
.\debug.cpp(256) : 0xf71fd000 0x0008d000 "Ntfs.sys "
.\debug.cpp(256) : 0xf71d0000 0x0002d000 "NDIS.sys "
.\debug.cpp(256) : 0xf71b5000 0x0001b000 "Mup.sys "
.\debug.cpp(256) : 0xf7667000 0x0000e000 "\SystemRoot\system32\DRIVERS\AmdK8.sys "
.\debug.cpp(256) : 0xf7143000 0x0002a000 "\SystemRoot\system32\DRIVERS\b57xp32.sys "
.\debug.cpp(256) : 0xf6d7b000 0x003c8000 "\SystemRoot\system32\DRIVERS\nv4_mini.sys "
.\debug.cpp(256) : 0xf6d67000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS "
.\debug.cpp(256) : 0xf77df000 0x00005000 "\SystemRoot\system32\DRIVERS\usbohci.sys "
.\debug.cpp(256) : 0xf6d44000 0x00023000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS "
.\debug.cpp(256) : 0xf77e7000 0x00007000 "\SystemRoot\system32\DRIVERS\usbehci.sys "
.\debug.cpp(256) : 0xf7677000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys "
.\debug.cpp(256) : 0xf7687000 0x0000d000 "\SystemRoot\system32\DRIVERS\cdrom.sys "
.\debug.cpp(256) : 0xf7697000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys "
.\debug.cpp(256) : 0xf6d21000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys "
.\debug.cpp(256) : 0xf6cae000 0x00073000 "\SystemRoot\system32\DRIVERS\ar5211.sys "
.\debug.cpp(256) : 0xf6c88000 0x00026000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys "
.\debug.cpp(256) : 0xf77ef000 0x00007000 "\SystemRoot\system32\DRIVERS\fdc.sys "
.\debug.cpp(256) : 0xf76a7000 0x00010000 "\SystemRoot\system32\DRIVERS\serial.sys "
.\debug.cpp(256) : 0xf7947000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys "
.\debug.cpp(256) : 0xf6c74000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys "
.\debug.cpp(256) : 0xf7b7a000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys "
.\debug.cpp(256) : 0xf76b7000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys "
.\debug.cpp(256) : 0xf794b000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys "
.\debug.cpp(256) : 0xf6c5d000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys "
.\debug.cpp(256) : 0xf76c7000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys "
.\debug.cpp(256) : 0xf76d7000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys "
.\debug.cpp(256) : 0xf77f7000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS "
.\debug.cpp(256) : 0xf6c09000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys "
.\debug.cpp(256) : 0xf76e7000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys "
.\debug.cpp(256) : 0xf780f000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys "
.\debug.cpp(256) : 0xf7817000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys "
.\debug.cpp(256) : 0xf5f18000 0x00031000 "\SystemRoot\system32\DRIVERS\rdpdr.sys "
.\debug.cpp(256) : 0xf7517000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys "
.\debug.cpp(256) : 0xf781f000 0x00006000 "\SystemRoot\system32\DRIVERS\kbdclass.sys "
.\debug.cpp(256) : 0xf7827000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys "
.\debug.cpp(256) : 0xf79ad000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys "
.\debug.cpp(256) : 0xf5ebc000 0x00034000 "\SystemRoot\system32\DRIVERS\update.sys "
.\debug.cpp(256) : 0xf7967000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys "
.\debug.cpp(256) : 0xf7557000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS "
.\debug.cpp(256) : 0xf7567000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys "
.\debug.cpp(256) : 0xf79b5000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS "
.\debug.cpp(256) : 0xf36d8000 0x00113000 "\SystemRoot\system32\drivers\sthda.sys "
.\debug.cpp(256) : 0xf36b4000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys "
.\debug.cpp(256) : 0xf7597000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys "
.\debug.cpp(256) : 0xf783f000 0x00005000 "\SystemRoot\system32\DRIVERS\flpydisk.sys "
.\debug.cpp(256) : 0xf79b9000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS "
.\debug.cpp(256) : 0xf7b20000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS "
.\debug.cpp(256) : 0xf79bb000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS "
.\debug.cpp(256) : 0xf784f000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS "
.\debug.cpp(256) : 0xf7857000 0x00006000 "\SystemRoot\System32\drivers\vga.sys "
.\debug.cpp(256) : 0xf79bd000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS "
.\debug.cpp(256) : 0xf79bf000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys "
.\debug.cpp(256) : 0xf785f000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS "
.\debug.cpp(256) : 0xf7867000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS "
.\debug.cpp(256) : 0xf791b000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys "
.\debug.cpp(256) : 0xf3681000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys "
.\debug.cpp(256) : 0xf3629000 0x00058000 "\SystemRoot\system32\DRIVERS\tcpip.sys "
.\debug.cpp(256) : 0xf3601000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys "
.\debug.cpp(256) : 0xf35e0000 0x00021000 "\SystemRoot\system32\DRIVERS\ipnat.sys "
.\debug.cpp(256) : 0xf35be000 0x00022000 "\SystemRoot\System32\drivers\afd.sys "
.\debug.cpp(256) : 0xf75c7000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys "
.\debug.cpp(256) : 0xf75d7000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys "
.\debug.cpp(256) : 0xf3592000 0x0002c000 "\SystemRoot\system32\DRIVERS\rdbss.sys "
.\debug.cpp(256) : 0xf34fb000 0x0006f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys "
.\debug.cpp(256) : 0xf75f7000 0x00009000 "\SystemRoot\System32\Drivers\Fips.SYS "
.\debug.cpp(256) : 0xf7933000 0x00003000 "\SystemRoot\system32\DRIVERS\hidusb.sys "
.\debug.cpp(256) : 0xf7607000 0x00009000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS "
.\debug.cpp(256) : 0xf793f000 0x00003000 "\SystemRoot\system32\DRIVERS\mouhid.sys "
.\debug.cpp(256) : 0xf79c3000 0x00002000 "\SystemRoot\System32\Drivers\avg7rsw.sys "
.\debug.cpp(256) : 0xf5f0c000 0x00004000 "\SystemRoot\system32\DRIVERS\kbdhid.sys "
.\debug.cpp(256) : 0xf7647000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS "
.\debug.cpp(256) : 0xf3443000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys "
.\debug.cpp(256) : 0xf79d5000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS "
.\debug.cpp(256) : 0xbf800000 0x001c4000 "\SystemRoot\System32\win32k.sys "
.\debug.cpp(256) : 0xf5db8000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys "
.\debug.cpp(256) : 0xf7757000 0x00005000 "\SystemRoot\System32\watchdog.sys "
.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys "
.\debug.cpp(256) : 0xf7a63000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys "
.\debug.cpp(256) : 0xbf012000 0x00449000 "\SystemRoot\System32\nv4_disp.dll "
.\debug.cpp(256) : 0xf34ab000 0x0000d000 "\??\C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys "
.\debug.cpp(256) : 0xba3e8000 0x00100000 "\??\C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys "
.\debug.cpp(256) : 0xba3a9000 0x0003f000 "\??\C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys "
.\debug.cpp(256) : 0xba500000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys "
.\debug.cpp(256) : 0xb993c000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys "
.\debug.cpp(256) : 0xba2c9000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys "
.\debug.cpp(256) : 0xb936a000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys "
.\debug.cpp(256) : 0xf7a43000 0x00002000 "\SystemRoot\System32\Drivers\ParVdm.SYS "
.\debug.cpp(256) : 0xb945f000 0x0000f000 "\SystemRoot\System32\Drivers\DgiVecp.sys "
.\debug.cpp(256) : 0xb9183000 0x00057000 "\SystemRoot\system32\DRIVERS\srv.sys "
.\debug.cpp(256) : 0xb9079000 0x000ba000 "\??\C:\Program Files\Trend Micro\OfficeScan Client\tm_cfw.sys "
.\debug.cpp(256) : 0xb8d40000 0x00041000 "\SystemRoot\System32\Drivers\HTTP.sys "
.\debug.cpp(256) : 0xb7e3c000 0x00023000 "\SystemRoot\System32\Drivers\Fastfat.SYS "
.\debug.cpp(256) : 0xf7847000 0x00007000 "\??\C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\mbr.sys "
.\debug.cpp(256) : 0xb652a000 0x00018000 "\??\C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\kgroquod.sys "
.\debug.cpp(256) : 0xb64dd000 0x00023000 "\SystemRoot\system32\DRIVERS\avipbb.sys "
.\debug.cpp(256) : 0xf7a35000 0x00002000 "\??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys "
.\debug.cpp(256) : 0xb64c8000 0x00015000 "\SystemRoot\system32\DRIVERS\avgntflt.sys "
.\debug.cpp(256) : 0xb649e000 0x0002a000 "\SystemRoot\system32\drivers\kmixer.sys "
.\debug.cpp(256) : 0x7c900000 0x000b2000 "\WINDOWS\system32\ntdll.dll "
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS "
.\debug.cpp(400) : Destination "\Device\Ndis "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D: "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{2D02B859-CC1F-4DBB-80CD-A1F99637BB14} "
.\debug.cpp(400) : Destination "\Device\{2D02B859-CC1F-4DBB-80CD-A1F99637BB14} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1 "
.\debug.cpp(400) : Destination "\Device\Video0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2003#6&22de7086&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\0000006b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2 "
.\debug.cpp(400) : Destination "\Device\Video1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmIoDaemon "
.\debug.cpp(400) : Destination "\Device\DmControl\DmIoDaemon "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\0000003e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip "
.\debug.cpp(400) : Destination "\Device\Ip "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3 "
.\debug.cpp(400) : Destination "\Device\Video2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\E: "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgio "
.\debug.cpp(400) : Destination "\Device\avgio "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev "
.\debug.cpp(400) : Destination "\Device\IPSEC "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4 "
.\debug.cpp(400) : Destination "\Device\Video3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002d "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDPROXY "
.\debug.cpp(400) : Destination "\Device\NDProxy "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{423F439F-65A2-4523-96B6-59E6CBD6B3B5} "
.\debug.cpp(400) : Destination "\Device\{423F439F-65A2-4523-96B6-59E6CBD6B3B5} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\$VDMLPT1 "
.\debug.cpp(400) : Destination "\Device\ParallelVdm0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RdpDrDvMgr "
.\debug.cpp(400) : Destination "\Device\RdpDrDvMgr "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{7da5ea49-08dc-11dc-913c-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\TM_CFW "
.\debug.cpp(400) : Destination "\Device\TM_CFW "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_026E&SUBSYS_01EC1028&REV_A3#3&2411e6fe&0&59#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0017 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice "
.\debug.cpp(400) : Destination "\Device\WMIDataDevice "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\kgroquod "
.\debug.cpp(400) : Destination "\Device\kgroquod "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#4&54ac241&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1} "
.\debug.cpp(400) : Destination "\Device\Parallel0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1 "
.\debug.cpp(400) : Destination "\Device\Serial0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgntflt "
.\debug.cpp(400) : Destination "\FileSystem\Filters\avgntflt "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_75#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0} "
.\debug.cpp(400) : Destination "\Device\0000003c "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE "
.\debug.cpp(400) : Destination "\Device\NamedPipe "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788} "
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_0461&Pid_4d15#5&36ff4167&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_168C&DEV_001A&SUBSYS_2052168C&REV_01#4&dc268a3&0&4880#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0026 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_14E4&DEV_167A&SUBSYS_01EC1028&REV_02#4&59b10b8&0&0018#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0027 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC "
.\debug.cpp(400) : Destination "\Device\Mup "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched "
.\debug.cpp(400) : Destination "\Device\PSched "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\VsapiNt "
.\debug.cpp(400) : Destination "\Device\VsapiNt "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT "
.\debug.cpp(400) : Destination "\Device\IPNAT "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg "
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CDRWDVD_TS-H493A_______________D200____#5&2360d1ba&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0 "
.\debug.cpp(400) : Destination "\Device\USBFDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp "
.\debug.cpp(400) : Destination "\Device\Tcp "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD "
.\debug.cpp(400) : Destination "\Device\VideoPdo0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1 "
.\debug.cpp(400) : Destination "\Device\USBFDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000033 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6D529B09-35D2-45E5-85EE-13398E4A3D21} "
.\debug.cpp(400) : Destination "\Device\{6D529B09-35D2-45E5-85EE-13398E4A3D21} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0 "
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN "
.\debug.cpp(400) : Destination "\DosDevices\LPT1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&35f0ee2&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000031 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DgivEcp1 "
.\debug.cpp(400) : Destination "\Device\DgivEcp0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio "
.\debug.cpp(400) : Destination "\Device\sysaudio "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap "
.\debug.cpp(400) : Destination "\Device\FsWrap "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000032 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000030 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0 "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature80Offset951A18200Length94E31F800#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_0241&SUBSYS_01EC1028&REV_A2#3&2411e6fe&0&28#{5b45201d-f2f2-4f3b-85bb-30ff1f953599} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0011 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{D0F95D87-00D4-435A-A999-C32C3DAD48E4} "
.\debug.cpp(400) : Destination "\Device\{D0F95D87-00D4-435A-A999-C32C3DAD48E4} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global "
.\debug.cpp(400) : Destination "\GLOBAL?? "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\00000041 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{86e0d1e0-8089-11d0-9ce4-08003e301f73} "
.\debug.cpp(400) : Destination "\Device\0000004b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{f6c58c1f-7d44-4dd1-b240-dee24d44fd91} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788} "
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6D3A6C67-7243-40AB-804D-FC6C7E0DF9F3} "
.\debug.cpp(400) : Destination "\Device\{6D3A6C67-7243-40AB-804D-FC6C7E0DF9F3} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#1#{4d36e978-e325-11ce-bfc1-08002be10318} "
.\debug.cpp(400) : Destination "\Device\0000004b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6CD8F11D-1B60-4C9A-BA52-EADC7DCA01B3} "
.\debug.cpp(400) : Destination "\Device\{6CD8F11D-1B60-4C9A-BA52-EADC7DCA01B3} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CDRWDVD_TS-H493A_______________D200____#5&2360d1ba&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{2E2D6651-AFF4-48A2-B366-9F0A8A705C37} "
.\debug.cpp(400) : Destination "\Device\{2E2D6651-AFF4-48A2-B366-9F0A8A705C37} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{5E31EFCA-1340-4586-9391-A0D7D0A6A6E2} "
.\debug.cpp(400) : Destination "\Device\{5E31EFCA-1340-4586-9391-A0D7D0A6A6E2} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager "
.\debug.cpp(400) : Destination "\Device\MountPointManager "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FDC#GENERIC_FLOPPY_DRIVE#4&15e2db85&0&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\FloppyPDO0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788} "
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002c "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_75#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0} "
.\debug.cpp(400) : Destination "\Device\0000003d "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmConfig "
.\debug.cpp(400) : Destination "\Device\DmControl\DmConfig "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp "
.\debug.cpp(400) : Destination "\Device\WANARP "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&34614a96&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_026D&SUBSYS_01EC1028&REV_A3#3&2411e6fe&0&58#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000003 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskWDC_WD800JD-75MSA3______________________10.01E04#5&10a72115&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T0L0-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomTSSTcorp_CDRWDVD_TS-H493A_______________D200____#5&2360d1ba&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmTrace "
.\debug.cpp(400) : Destination "\Device\DmControl\DmTrace "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\A: "
.\debug.cpp(400) : Destination "\Device\Floppy0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0400#3&2411e6fe&0#{97f76ef0-f883-11d0-af1f-0000f800845c} "
.\debug.cpp(400) : Destination "\Device\0000004c "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP "
.\debug.cpp(400) : Destination "\Device\NdisWanIp "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#dmio#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_0461&Pid_4d15#6&265d01b3&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\0000006a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788} "
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{5f6b13e4-6814-4fb4-bf50-84cbb4297800} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\TMFilter "
.\debug.cpp(400) : Destination "\Device\VprotectTMFilter0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_413c&Pid_2003#5&36ff4167&0&6#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1 "
.\debug.cpp(400) : Destination "\Device\ParTechInc0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{7da5ea4a-08dc-11dc-913c-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407} "
.\debug.cpp(400) : Destination "\Device\00000037 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISTAPI "
.\debug.cpp(400) : Destination "\Device\NdisTapi "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan "
.\debug.cpp(400) : Destination "\Device\NdisWan "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1 "
.\debug.cpp(400) : Destination "\Device\NamedPipe\Spooler\LPT1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST "
.\debug.cpp(400) : Destination "\Device\IPMULTICAST "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2 "
.\debug.cpp(400) : Destination "\Device\ParTechInc1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmLoader "
.\debug.cpp(400) : Destination "\Device\DmLoader "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow "
.\debug.cpp(400) : Destination "\Device\LanmanRedirector "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{ba0afe40-6d0a-4d2c-954f-6f7b82187a14} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3 "
.\debug.cpp(400) : Destination "\Device\ParTechInc2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&Signature80Offset36E8E00Length94E327600#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr "
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Pscan "
.\debug.cpp(400) : Destination "\Device\VprotectTMFilter0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl "
.\debug.cpp(400) : Destination "\Device\FtControl "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C: "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{7da5ea48-08dc-11dc-913c-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mbr "
.\debug.cpp(400) : Destination "\Device\mbr "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT "
.\debug.cpp(400) : Destination "\Device\MailSlot "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX "
.\debug.cpp(400) : Destination "\DosDevices\COM1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8384&DEV_7690&SUBSYS_102801EC&REV_1022#4&17ca7074&0&0001#{ac7e9cf6-d199-450d-bedf-8a35b000442d} "
.\debug.cpp(400) : Destination "\Device\00000068 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{224afd68-7c7e-11db-8c6a-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\Floppy0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL "
.\debug.cpp(400) : Destination "\Device\Null "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2003#6&22de7086&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\0000006b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT "
.\debug.cpp(400) : Destination " "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio "
.\debug.cpp(400) : Destination "\Device\Ndisuio "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NONSPOOLED_LPT1 "
.\debug.cpp(400) : Destination "\Device\Parallel0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000035 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_0461&Pid_4d15#6&265d01b3&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\0000006a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\avipbb "
.\debug.cpp(400) : Destination "\Device\avipbb "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{498A15A1-7E50-4D92-B776-0398FEE0BD9B} "
.\debug.cpp(400) : Destination "\Device\{498A15A1-7E50-4D92-B776-0398FEE0BD9B} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DmInfo "
.\debug.cpp(400) : Destination "\Device\DmControl\DmInfo "
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************
.\boot_cleaner.cpp(565) : System volume is \\.\C:
.\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`036e8e00
.\boot_cleaner.cpp(276) : Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd
.\boot_cleaner.cpp(1060) :
.\boot_cleaner.cpp(1061) : Size Device Name MBR Status
.\boot_cleaner.cpp(1062) : --------------------------------------------
.\boot_cleaner.cpp(1106) : 74 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
.\boot_cleaner.cpp(1112) :
.\boot_cleaner.cpp(1151) : Done;

scgoh123 · 2010/11/08

sorry about the dds log. I've forgotten about them....
attach:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-08.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 11/26/2006 6:03:29 PM
System Uptime: 11/3/2010 2:09:02 AM (1 hours ago)

Motherboard: Dell Inc | | 0UT225
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2004/1000mhz
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2004/1000mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 24.426 GiB free.
D: is FIXED (NTFS) - 37 GiB total, 37.19 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP204: 8/5/2010 11:31:34 AM - System Checkpoint
RP205: 8/9/2010 7:50:23 AM - System Checkpoint
RP206: 8/10/2010 9:20:22 AM - System Checkpoint
RP207: 8/12/2010 7:23:12 AM - System Checkpoint
RP208: 8/13/2010 10:26:00 AM - System Checkpoint
RP209: 8/16/2010 7:26:27 AM - System Checkpoint
RP210: 8/17/2010 11:49:37 AM - System Checkpoint
RP211: 8/18/2010 11:52:36 AM - System Checkpoint
RP212: 8/20/2010 7:14:23 AM - System Checkpoint
RP213: 8/23/2010 8:33:11 AM - System Checkpoint
RP214: 8/24/2010 8:38:16 AM - System Checkpoint
RP215: 8/25/2010 8:38:45 AM - System Checkpoint
RP216: 8/26/2010 9:33:30 AM - System Checkpoint
RP217: 1/1/2003 1:19:38 AM - System Checkpoint
RP218: 9/3/2010 7:29:28 AM - System Checkpoint
RP219: 1/1/2003 12:34:39 AM - System Checkpoint
RP220: 1/2/2003 3:14:06 AM - System Checkpoint
RP221: 10/13/2010 1:09:14 PM - System Checkpoint
RP222: 10/14/2010 2:06:07 PM - System Checkpoint
RP223: 10/15/2010 2:32:18 PM - System Checkpoint
RP224: 10/15/2010 3:45:12 PM - Software Distribution Service 3.0
RP225: 10/15/2010 3:52:32 PM - Installed Windows Internet Explorer 8.
RP226: 10/15/2010 3:53:20 PM - Software Distribution Service 3.0
RP227: 11/2/2010 10:11:19 AM - System Checkpoint
RP228: 11/2/2010 8:23:07 PM - Software Distribution Service 3.0
RP229: 11/3/2010 2:49:25 AM - Avira AntiVir Personal - 11/3/2010 2:47

==== Installed Programs ======================

Adobe Reader 7.0.7
AMD Processor Driver
Apple Application Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Broadcom Gigabit Integrated Controller
Broadcom Management Programs
BufferChm
ClocX (1.5b1)
CorePLS_Full_QFolder
CorePLS_Min_QFolder
D1300
D1300_Help
D2400
D2400_Help
Dell Resource CD
DeviceDiscovery
dj_sf_ProductContext
dj_sf_software
dj_sf_software_req
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 9.0
HP Deskjet Printer Driver Software 9.0
HP Imaging Device Functions 9.0
HP LaserJet P2015 Series 1.0
HP Photosmart and Deskjet 7.0 Software
HP Photosmart Essential
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Smart Web Printing
HP Solution Center 9.0
HP Update
hph_ProductContext
hph_readme
hph_software
hph_software_req
hppFonts
HPPhotoSmartExpress
hppIOFiles
hppLJP2015
hppManualsP2015
hppMSRedist
HPProductAssistant
hppTLBXFXP2015
hppusgP2015
hppWebRegMM
HPSSupply
hpzTLBXFX
J2SE Runtime Environment 5.0 Update 6
Java Auto Updater
Java(TM) 6 Update 18
Jhoos Toolbar
KPM_Imbas
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Modem Helper
Mozilla Firefox (3.6.8)
NVIDIA Drivers
OpenOffice.org 3.2
PanoStandAlone
Pendaftaran Pmr v2010
Product_SF_Full_QFolder
Product_SF_Min_QFolder
PSSWCORE
Safari
Samsung ML-2010 Series
ScanTools Plus Link Runtime
ScanTools Plus Link Runtime Installer
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981350)
Security Update for Windows XP (KB982381)
SigmaTel Audio
SISTEM PEMARKAHAN ULBS SPM SEKOLAH
Sistem Pengurusan Peperiksaan v3.0.0.3
SolutionCenter
Status
Toolbox
TrayApp
Trend Micro OfficeScan Client
Unload
UnloadSupport
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
URGE
VideoToolkit01
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11

==== Event Viewer Messages From Past Week ========

11/3/2010 2:47:26 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
11/3/2010 2:47:26 AM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\RarSFX1\redist.dll. Reference error message: The operation completed successfully. .
11/3/2010 2:47:26 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
11/2/2010 1:46:49 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avg7Core Avg7RsXP

==== End Of File ===========================

scgoh123 · 2010/11/08

GMER:
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-03 03:41:27
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800JD-75MSA3 rev.10.01E04
Running: lzwpn62z.exe; Driver: C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\kgroquod.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6D7B360, 0x2462AD, 0xE8000020]
? System32\Drivers\avg7rsw.sys The system cannot find the path specified. !
? C:\DOCUME~1\DELLTO~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[3880] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs TmPreFlt.sys (Pre-Filter For XP/Trend Micro Inc.)
AttachedDevice \FileSystem\Fastfat \Fat TmPreFlt.sys (Pre-Filter For XP/Trend Micro Inc.)

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\D8D65BA4d01 23655 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\69180E7Dd01 32195 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\95AB3F58d01 299192 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\C177C5E2d01 119646 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\1E652041d01 28725 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\B0A74C0Cd01 101648 bytes
File C:\Documents and Settings\DELL TOWER\Local Settings\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\Cache\A7EFABF1d01 66297 bytes

---- EOF - GMER 1.0.15 ----

broni · 2010/11/08

Bootkit Remover log is clean

Did you try my link, regarding TrendMicro firewall?

scgoh123 · 2010/11/08

yeah, it has removed the OfficeScan successfully~

broni · 2010/11/08

Make sure to turn Windows firewall ON.

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

scgoh123 · 2010/11/08

ComboFix 10-11-07.A2 - DELL TOWER 11/09/2010 11:13:41.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.489 [GMT 8:00]
Running from: c:\documents and settings\DELL TOWER\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_$$_TEMP.TMP
c:\windows\system\oeminfo.ini
c:\windows\system32\AutoRun.inf
c:\windows\system32\drivers\vivlntn.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_jern

((((((((((((((((((((((((( Files Created from 2010-10-09 to 2010-11-09 )))))))))))))))))))))))))))))))
.

2010-11-02 19:43 . 2010-11-02 19:43 -------- d-----w- c:\program files\7-Zip
2010-11-02 18:49 . 2010-08-02 08:10 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-02 18:49 . 2010-08-02 08:10 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-02 18:49 . 2010-06-17 07:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-11-02 18:49 . 2010-06-17 07:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-11-02 18:49 . 2010-11-02 18:49 -------- d-----w- c:\program files\Avira
2010-11-02 18:49 . 2010-11-02 18:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-11-02 18:15 . 2010-11-02 18:15 -------- d-----w- c:\documents and settings\DELL TOWER\Application Data\Malwarebytes
2010-11-02 18:15 . 2010-04-29 07:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-02 18:15 . 2010-11-02 18:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-02 18:15 . 2010-11-02 18:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-02 18:15 . 2010-04-29 07:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-15 08:10 . 2010-10-15 08:10 -------- d-sh--w- c:\documents and settings\DELL TOWER\IETldCache
2010-10-15 07:50 . 2010-10-15 07:52 -------- dc-h--w- c:\windows\ie8
2010-10-15 07:45 . 2010-05-06 10:41 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-10-15 07:45 . 2010-05-06 10:41 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-10-15 07:45 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-10-15 07:45 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-10-15 07:45 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-10-15 07:45 . 2010-05-06 10:41 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-10-15 07:45 . 2010-05-06 10:41 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9c25d2ef-c545-49ee-bd1a-f264b273ec10} "= "c:\program files\Jhoos\tbJho1.dll" [2010-10-13 2735200]

[HKEY_CLASSES_ROOT\clsid\{9c25d2ef-c545-49ee-bd1a-f264b273ec10}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c25d2ef-c545-49ee-bd1a-f264b273ec10}]
2010-10-13 07:34 2735200 ----a-w- c:\program files\Jhoos\tbJho1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9c25d2ef-c545-49ee-bd1a-f264b273ec10} "= "c:\program files\Jhoos\tbJho1.dll" [2010-10-13 2735200]

[HKEY_CLASSES_ROOT\clsid\{9c25d2ef-c545-49ee-bd1a-f264b273ec10}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9C25D2EF-C545-49EE-BD1A-F264B273EC10} "= "c:\program files\Jhoos\tbJho1.dll" [2010-10-13 2735200]

[HKEY_CLASSES_ROOT\clsid\{9c25d2ef-c545-49ee-bd1a-f264b273ec10}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-10-03 7630848]
"nwiz "= "nwiz.exe" [2006-10-03 1617920]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-10-03 86016]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"ToolBoxFX "= "c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 49152]
"HPUsageTracking "= "c:\program files\HP\HP UT\bin\hppusg.exe" [2006-06-09 36864]
"Samsung Common SM "= "c:\windows\Samsung\ComSMMgr\ssmmgr.exe" [2005-07-03 372736]
"SigmatelSysTrayApp "= "stsystra.exe" [2006-07-27 282624]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

c:\documents and settings\DELL TOWER\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClocX]
2004-09-04 09:28 270336 ----a-w- c:\program files\ClocX\ClocX.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/3/2010 2:49 AM 135336]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SSMDRV

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-11-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-01 14:18]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\DELL TOWER\Application Data\Mozilla\Firefox\Profiles\j4vba4em.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-09 11:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(248)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\RUNDLL32.EXE
c:\windows\stsystra.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\windows\system32\nvsvc32.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2010-11-09 11:22:53 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-09 03:22

Pre-Run: 26,209,972,224 bytes free
Post-Run: 26,537,324,544 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - D2746D4F20B7FAC744625E03D18AC2FE

Log in or Sign up

Solved Internet Explorer 6 runs very slow (not sure what infection)

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved Internet Explorer 6 runs very slow (not sure what infection)

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

broni Moderator Malware Analyst

scgoh123 Well-Known Member Thread Starter

Share This Page

Useful Searches