1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Cant do a system restore.

Discussion in 'Malware and Virus Removal Archive' started by Davidx510, 2010/12/23.

Thread Status:
Not open for further replies.
  1. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    [Inactive] Cant do a system restore.

    I recently had a virus on my computer , i got rid of most of it but i dont think all of it. i think the virus corrupted on system files and when i try to do system restore , it keeps saying "system restore is not able to protect your computer please restart and try again ". i did what it says and it turns out the same. I tried doing system restore in safe mode, that didnt work. My system restore is turned not turned off , its turned on. Could anybody help me ASAP. thanks.

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5363

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    12/22/2010 7:28:42 PM
    mbam-log-2010-12-22 (19-28-42).txt

    Scan type: Quick scan
    Objects scanned: 191305
    Time elapsed: 9 hour(s), 6 minute(s), 1 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 4
    Registry Values Infected: 0
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 4

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\Typelib\{5D2631E5-8696-7543-50B2-F674CD4308EB} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\WINDOWS\system32\drivers\bmwaqk.sys (Trojan.Bubnix) -> Quarantined and deleted successfully.
    c:\documents and settings\danny chor\local settings\Temp\plugtmp-84\plugin-index.php (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\documents and settings\danny chor\local settings\temporary internet files\Content.IE5\QBFL2XFC\authorization[2].css (Trojan.Zbot) -> Quarantined and deleted successfully.
    c:\documents and settings\danny chor\local settings\temporary internet files\ijjistarter2fxb.exe (Trojan.Agent) -> Quarantined and deleted successfully.



    i got more it just exceeds the characters limit.
     
    Last edited by a moderator: 2010/12/23
  2. 2010/12/23
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Split the logs over several posts.
     

  3. to hide this advert.

  4. 2010/12/23
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I've just seen your other thread - deleted.

    Please do not Double Post. As a new member with less than 10 posts any post you make which contains a URL requires approval (moderation) before it is visible.
     
  5. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    i so sorry, i was in a hurry, my cpu is messed up right now

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2010-12-22 19:58:40
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort1 WDC_WD2500JS-75NCB1 rev.10.02E01
    Running: 0gjlrjov.exe; Driver: C:\DOCUME~1\guestt\LOCALS~1\Temp\uxloapog.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    .text bmwaqk.sys F741500E 26 Bytes CALL F74155EF bmwaqk.sys
    .text bmwaqk.sys F7415029 4 Bytes [66, 89, 45, 00] {MOV [EBP+0x0], AX}
    .text bmwaqk.sys F741502E 36 Bytes [74, 24, 04, 9C, 8D, 64, 24, ...]
    .text bmwaqk.sys F7415053 64 Bytes CALL F7415269 bmwaqk.sys
    .text bmwaqk.sys F7415094 7 Bytes [3D, 06, 00, 00, 9C, 60, 66]
    .text ...
    ? C:\WINDOWS\system32\drivers\bmwaqk.sys A device attached to the system is not functioning.
    PAGE Ntfs.sys F72F3E55 4 Bytes CALL 873D9E79
    .text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF5F62000, 0x1C5D38, 0xE8000020]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\Explorer.EXE[416] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00E1000A
    .text C:\WINDOWS\Explorer.EXE[416] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E2000A
    .text C:\WINDOWS\Explorer.EXE[416] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00E0000C
    .text C:\WINDOWS\System32\svchost.exe[1244] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007F000A
    .text C:\WINDOWS\System32\svchost.exe[1244] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0080000A
    .text C:\WINDOWS\System32\svchost.exe[1244] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 007E000C
    .text C:\WINDOWS\System32\svchost.exe[1244] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00D4000A
    ? C:\WINDOWS\System32\svchost.exe[1820] image checksum mismatch; number of sections mismatch; time/date stamp mismatch;
    .text C:\Program Files\Internet Explorer\iexplore.exe[2748] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 01D0000A
    .text C:\Program Files\Internet Explorer\iexplore.exe[2748] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 01D1000A
    .text C:\Program Files\Internet Explorer\iexplore.exe[2748] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 015D000C

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 51EC8B55
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 1845DB51
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] F855DD56
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] E8084DDC
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 000004D2
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] FF184589
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 40515C15
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] F845DD00
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] 8B104DDC
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 1865DAF0
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 0004B9E8
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8BC88B00
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] F74199C6
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] C28B5EF9
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 2B08244C
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 9904244C
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 8BF9F741
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 244403C2
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] FF56C304
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 40515C15
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 244C8B00
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 244403C1
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] 15FFC308
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] [0040515C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 04244C8B
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] F9F74199
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFC3C28B
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 40515C15
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 646A9900
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 33F9F759
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 24543BC0
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] C09C0F04
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] EC8B55C3
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 0204EC81
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 68560000
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 00000100
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] 515415FF
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 8B590040
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] 00FFB8F0
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 8D500000
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] FFFEFC8D
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] C93351FF
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 558D5151
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 8D5052FC
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] FFFDFC85
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 40504415
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 56216A00
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] FFFC75FF
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 40515815
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 0CC48300
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] C01BD8F7
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] C95EC623
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] EC8B55C3
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 458B5151
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 33565308
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 57C88BF6
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 33FC7589
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 01518DFF
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] 8441198A
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 2BF975DB
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 802974CA
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7420063C
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] 75FF850A
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 45FF470C
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8506EBFC
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 46C88BFF
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 8A01518D
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] DB844119
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] CA2BF975
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] D772F13B
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 5FFC458B
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] C3C95B5E
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 83EC8B55
    IAT C:\WINDOWS\System32\svchost.exe[1820] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 56530CEC

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs 8738ADF0
    Device \Driver\Tcpip \Device\Ip 86D51128
    Device \Driver\Tcpip \Device\Tcp 86D51128
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8732039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8732039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-4 8732039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 8732039B
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T1L0-c 8732039B
    Device \Driver\Tcpip \Device\Udp 86D51128
    Device \Driver\Tcpip \Device\RawIp 86D51128
    Device \Driver\Tcpip \Device\IPMULTICAST 86D51128
    Device \FileSystem\Fastfat \Fat B08BCD20
    Device \Device\Ide\IdeDeviceP1T0L0-17 -> \??\IDE#DiskWDC_WD2500JS-75NCB1_____________________10.02E01#5&2510770d&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- Services - GMER 1.0.15 ----

    Service (*** hidden *** ) [BOOT] bmwaqk <-- ROOTKIT !!!

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\ControlSet001\Services\bmwaqk@rvxizxwpw -2082960234
    Reg HKLM\SYSTEM\ControlSet001\Services\bmwaqk@Type 1
    Reg HKLM\SYSTEM\ControlSet001\Services\bmwaqk@Start 0
    Reg HKLM\SYSTEM\ControlSet001\Services\bmwaqk@ErrorControl 0
    Reg HKLM\SYSTEM\ControlSet001\Services\bmwaqk@Group Boot Bus Extender
    Reg HKLM\SYSTEM\CurrentControlSet\Services\bmwaqk@rvxizxwpw -2082960234
    Reg HKLM\SYSTEM\CurrentControlSet\Services\bmwaqk@Type 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\bmwaqk@Start 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\bmwaqk@ErrorControl 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\bmwaqk@Group Boot Bus Extender
    Reg HKLM\SYSTEM\ControlSet003\Services\bmwaqk@rvxizxwpw -2082960234
    Reg HKLM\SYSTEM\ControlSet003\Services\bmwaqk@Type 1
    Reg HKLM\SYSTEM\ControlSet003\Services\bmwaqk@Start 0
    Reg HKLM\SYSTEM\ControlSet003\Services\bmwaqk@ErrorControl 0
    Reg HKLM\SYSTEM\ControlSet003\Services\bmwaqk@Group Boot Bus Extender
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@NoPopUpsOnBoot 1
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

    ---- Disk sectors - GMER 1.0.15 ----
     
  6. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    ****, i'm so sorry i think i need another thread -.-

    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 57: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

    ---- Files - GMER 1.0.15 ----

    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KZ.gif 374 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LA.gif 366 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LB.gif 366 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LC.gif 379 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LI.gif 359 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LK.gif 377 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LR.gif 360 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LS.gif 369 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LT.gif 362 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LU.gif 368 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LV.gif 363 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\LY.gif 362 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MA.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MC.gif 359 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MD.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\ME.gif 330 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MG.gif 372 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MH.gif 370 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MK.gif 382 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\ML.gif 363 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MM.gif 365 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MN.gif 368 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MO.gif 378 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MP.gif 368 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MQ.gif 379 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MR.gif 377 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MS.gif 371 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MT.gif 369 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MU.gif 358 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MV.gif 372 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SE.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SG.gif 364 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SH.gif 371 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SI.gif 362 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SK.gif 361 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SL.gif 363 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SM.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SN.gif 364 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SO.gif 376 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SR.gif 361 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\ST.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SV.gif 363 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SY.gif 361 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SZ.gif 363 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TC.gif 366 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TD.gif 368 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TG.gif 366 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TH.gif 360 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TJ.gif 361 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TK.gif 372 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TL.gif 360 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TM.gif 367 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TN.gif 375 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KN.gif 370 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KP.gif 366 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KR.gif 385 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KW.gif 362 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\KY.gif 373 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\MW.gif 364 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\SD.gif 355 bytes
    File C:\Documents and Settings\Danny Chor\Local Settings\Temp\__SkypeDialog_Cache\TO.gif 367 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel[3].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pom[1].css 2416 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\popup[1].png 17632 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[1].htm 149 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[2].htm 150 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[3].htm 136 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[4].htm 159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[5].htm 130 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\portal[6].htm 898 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\style[1].css 2684 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\style[2].css 15492 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[10] 4158 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[11] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[13] 4158 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[1] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[2] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[3] 4158 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[4] 4158 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[5] 4385 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[6] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[7] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[8] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\st[9] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\swfobject[1].js 6880 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\textlinkad[2].swf 4342 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\textlinkad[3].swf 4342 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\thumbnail[1].php 3252 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\tophomeappliances.blogspot[1].htm 52847 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\top[1].gif 3484 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\TrackView[1].xml 78 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\travian_signup[1].jpg 31320 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\t[1].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\t[2].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\t[3].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\t[4].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\urchin[1].js 22645 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\usgeo[1].htm 1404 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\v=5;m=2;l=3276;cxt=;kw=;ts=257193;smuid=751-w9KCga[1] 222 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\vj[1] 1395 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\vj[2] 384 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\vj[3] 3281 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\vj[4] 1394 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\rand[1].gif 108 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\realtechnetworktf728[1].htm 1248 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\Real_Torture_160x600[1].gif 13898 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\register[1].jpg 110877 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\resize[1].jpg 1110 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\RLbody03[1].png 133 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\RLfoot01[1].png 291 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\rsiads[1].js 778 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\script[1].js 9087 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\script[2].js 9087 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[12].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[13].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[14].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[15].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[2].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[3].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[4].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[5].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[6].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[7].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[8].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[9].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel[2].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\p[11].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\signup[1].gif 1281 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\style-11px%20Lucida%20Grande,%20Verdana,%20sans-serif%3b000000_FFFFFF_009900_FF0000_FFCC00_FF6633_000000%3b1px%20none%3b_blank[1].htm 5172 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\textlinkad[1].swf 4342 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[10].htm 46 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[11].htm 1668 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[1].htm 530 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[2].htm 517 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[3].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[4].htm 1659 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[5].htm 592 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[6].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[7].htm 76 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[8].htm 605 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\search[9].htm 1666 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\serve2[1].htm 350 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\serv[1].htm 249 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\signupslogan[1].gif 4848 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\wgmservecpx[1].htm 17750 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\wgmserveredux[1].htm 17161 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\widget02[1].css 4337 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\wroiweurewioua[1].htm 1311 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\x[1].gif 228 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\yes[1].gif 292 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\YourDegree_160x600[1].htm 4505 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\zmfc[1].js 671 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\zmpfc[1].js 1081 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\zone[1].htm 6685 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\zone[2].htm 289 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\_default;sz=160x600;ord=7188970066273807[1] 378 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\signup[2].gif 1706 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\simg_t_ts5205857a80ee4d420204dd191ceba7cbca4cb9fjpg85[1] 3242 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\simg_t_ts5615958601aecb4d85748e3ad0542abf84a3912jpg85[1] 3069 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\smartsearch[1].htm 849 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\smartsearch[2].htm 699 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\srad[1].js 5957 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\sresults[1].gif 586 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\ssbanner-jookz-nature3-300x250[1].swf 31787 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\stage-middle[1].gif 76 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\state[1].js 3155 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\PF2_800x600_2_m;sz=800x600;ord=5150422944522404[1].htm 482 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\PF3_800x600_2_m;sz=800x600;ord=2723597601780593[1].5 247 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\PF4_800x600_2_m;sz=800x600;ord=7854057221873962[1] 328 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel;r=1145928124;fpan=0;fpa=1231131907-63729573-93975366;fpbn=1;fpb=598501458;ns=1;url=http%3A%2F%2Fad.yieldmanager[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel;r=1608280548;fpan=1;fpa=1231131907-63729573-93975366;fpbn=1;fpb=1652022105;ns=1;url=http%3A%2F%2Fwww.egotvonline[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel;r=493340462;fpan=1;fpa=1231131907-63729573-93975366;fpbn=1;fpb=883646006;ns=1;url=http%3A%2F%2Fwww.digitaltrends[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel;r=620118313;fpan=0;fpa=1231131907-63729573-93975366;fpbn=0;fpb=837679236;ns=1;url=http%3A%2F%2Fad.yieldmanager[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7866B787\pixel[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\portal[1].htm 888 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\portal[2].htm 150 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\portal[4].htm 155 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\post_myspace_icon[1].gif 624 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\prf[1].js 2631 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\product[1].jpg 20970 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\product[2].jpg 20970 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\product[3].jpg 24192 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\product[4].jpg 333036 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].net%2Fmedia%2F300x250&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].net%2Fmedia%2F728x90&r=0 1053 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].php&r=0 1080 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[30].net%2Fmedia%2F728x90&r=0 1167 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[31].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[32].net%2Fmedia%2F728x90&r=0 554 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[33].net%2Fmedia%2F728x90&r=0 557 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[34].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[35].net%2Fmedia%2F728x90&r=0 612 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[36].net%2Fmedia%2F728x90&r=0 613 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[37].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[38].net%2Fmedia%2F728x90&r=0 565 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[39].net%2Fmedia%2F728x90&r=0 563 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3] 48 bytes
     
    Last edited: 2010/12/23
  7. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\include[1].js 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5].php&r=0 628 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6] 1150 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6].net%2Fmedia%2F120x600&r=0 1056 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6].net%2Fmedia%2F160x600&r=0 624 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6].net%2Fmedia%2F300x250&r=0 515 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6].net%2Fmedia%2F728x90&r=0 505 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[6].php&r=0 647 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7] 48 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7].net%2Fmedia%2F120x600&r=0 514 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7].net%2Fmedia%2F160x600&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7].net%2Fmedia%2F300x250&r=0 626 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7].net%2Fmedia%2F728x90&r=0 622 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[7].php&r=0 649 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[8].net%2Fmedia%2F120x600&r=0 610 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[8].net%2Fmedia%2F160x600&r=0 624 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[8].net%2Fmedia%2F300x250&r=0 672 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[8].net%2Fmedia%2F728x90&r=0 1057 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[8].php&r=0 629 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[9].net%2Fmedia%2F120x600&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\simg_t_ts5349623b367583194684d8095b671c879ed27fbjpg85[1] 3921 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\simg_t_ts56159391ebf423adbe3410aad42f725777a0eb0jpg85[1] 3696 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\spacer[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\spacer[2].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\sprytabs[1].js 11276 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\stage-bottom[1].gif 794 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\stage-top[1].gif 794 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\StdBanner[1].js 14666 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\style[1].css 9829 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\style[2].css 953 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\style[3].css 2059 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[2] 4385 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[3] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[4] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[5] 4221 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[6] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[7] 4158 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\s_code[1].js 18112 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\textlinkad[1].swf 4342 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\text_group[1].htm 2762 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\text_group[2].htm 2762 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\TFSMFlashWrapper204[1].js 1960 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\tft_button[1].jpg 6250 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\thumbnail[1].php 2976 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\inifr[2].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\inject_object_div[1].js 1921 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\its[1].gif 47 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[10].js 1113 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[11].js 1065 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[12].js 1220 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[13].js 451 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[14].js 1076 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[15].js 1045 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[16].js 701 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[1].js 1078 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[2].js 610 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[3].js 1065 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\quant[1].js 2951 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\quant[2].js 2945 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[9].net%2Fmedia%2F300x250&r=0 667 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\jackpot-manny-728x90[1].jpg 19062 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\Joy_v1_160x600[1].gif 25492 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\joy_v2_160x600[1].swf 29289 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\js9[1].js 7363 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\js[1].php;w=1024x768x32 446 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\Julia86-21[1].jpg 30859 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\jump1[1].htm 1235 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\jump1[2].htm 1195 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\jump1[3].htm 1205 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\jump1[4].htm 1191 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\new_bg[1].jpg 45086 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\new_mod_wide_01[1].gif 1434 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\new_mod_wide_02[1].gif 1502 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\PF3_m;sz=800x600;ord=4908132449838055[1] 247 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\PF3_m;sz=800x600;ord=6299443726732812[1] 247 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pic[1].gif 719 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pixel;r=1348587569;fpan=1;fpa=1231131907-63729573-93975366;fpbn=1;fpb=1252475329;ns=1;url=http%3A%2F%2Fad.yieldmanager[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pixel;r=87797011;fpan=0;fpa=1231131907-63729573-93975366;fpbn=0;fpb=837679236;ns=1;url=http%3A%2F%2Fad.yieldmanager[1].gif 35 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pixel[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pixel[2].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\pixel[3].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].net%2Fmedia%2F160x600&r=0 1040 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3].net%2Fmedia%2F120x600&r=0 519 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5].net%2Fmedia%2F728x90&r=0 1041 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[9].net%2Fmedia%2F160x600&r=0 623 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[9].net%2Fmedia%2F728x90&r=0 622 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\inifr[1].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[4].js 1042 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\menu1_01[1].jpg 550 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\new_article_blox1[1].gif 3840 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[9].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[4].htm 555 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\showAd[2].htm 9196 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\st[1] 4159 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\v53[1].js 12558 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\9bde27fe3a8bdf082774a839f2b90f84[1].swf 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\tin[1].gif 79 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\topleftcorner[1].png 7884 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\track_1182409[1].htm 644 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\travian0[1].gif 2395 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\t[1].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\t[2].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\t[3].gif 49 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\u7K[1].htm 755 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\unpixel[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\render_ads[1].js 94 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\resize[1].jpg 1083 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\results1[1].htm 1403 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\RLfoot03[1].png 319 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\RLhead02[1].png 168 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\RLt1[1].png 443 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\rss1[1].png 716 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\sag[1].htm 1 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\screenshots[1].gif 1325 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\searchPrograms_btn[1].jpg 2035 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[10].htm 100 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[1].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[2].htm 100 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[3].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\menu1_05[1].gif 1822 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\menu1_06[1].gif 1787 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\menu_02[1].gif 1551 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\menu_07[1].gif 1672 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\metanetworks_300[1].js 153 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\metanetworks_728[1].js 152 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\mlopen_track[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\m_un2[1].js 5997 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\newArcade_05[1].jpg 704 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\NewDotNetAd300x250[1].jpg 21455 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\NewDotNetAd728x90[1].jpg 23199 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\newsbox3[1].gif 538 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[5].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[6].htm 1664 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[7].htm 489 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[8].htm 46 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\search[9].htm 1663 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\seek[1].htm 873 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\send[1].jpg 837 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\showAd[1].htm 9198 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[5].js 1042 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[6].js 1042 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[7].js 490 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[8].js 1040 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\i[9].js 1082 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\promote15[1].htm 451 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\Proxy[1].xml 30693 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[10].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[11].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[12].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[13].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[14].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[15].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[16].gif 43 bytes
     
  8. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[17].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[1].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[2].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[3].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[4].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[5].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[6].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[7].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\p[8].gif 43 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\VAL_PRP_JC0028_20for20_122808_160x600[1].swf 28888 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\video_player_page[1].css 9916 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\x_g[1].jpg 1600 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\YourDegree.Ads.CareerEducation[1].js 760 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\yourminis[1].htm 12831 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\zmfc[1].js 406 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\zone[1] 767 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\zone[1].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\zone[2].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\zone[3].htm 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[23].net%2Fmedia%2F160x600&r=0 1164 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[23].net%2Fmedia%2F300x250&r=0 1061 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[23].net%2Fmedia%2F728x90&r=0 612 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[24].net%2Fmedia%2F120x600&r=0 626 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[24].net%2Fmedia%2F160x600&r=0 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[24].net%2Fmedia%2F300x250&r=0 1040 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[24].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[25].net%2Fmedia%2F120x600&r=0 615 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[25].net%2Fmedia%2F300x250&r=0 556 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[25].net%2Fmedia%2F728x90&r=0 1167 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[26].net%2Fmedia%2F120x600&r=0 1163 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[26].net%2Fmedia%2F300x250&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[26].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[27].net%2Fmedia%2F120x600&r=0 627 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[27].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[28].net%2Fmedia%2F728x90&r=0 609 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[29].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2] 1150 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].0%2F5181%2F439718%2F0%2F154%2FADTECH&r=0 650 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[2].net%2Fmedia%2F120x600&r=0 507 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3].net%2Fmedia%2F160x600&r=0 1040 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3].net%2Fmedia%2F300x250&r=0 506 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3].net%2Fmedia%2F728x90&r=0 1161 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[3].php&r=0 1080 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[40].net%2Fmedia%2F728x90&r=0 63 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[41].net%2Fmedia%2F728x90&r=0 554 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[42].net%2Fmedia%2F728x90&r=0 1161 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4] 1236 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4].net%2Fmedia%2F120x600&r=0 516 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4].net%2Fmedia%2F160x600&r=0 623 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4].net%2Fmedia%2F300x250&r=0 515 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4].net%2Fmedia%2F728x90&r=0 625 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[4].php&r=0 626 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5] 754 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5].net%2Fmedia%2F120x600&r=0 621 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5].net%2Fmedia%2F160x600&r=0 626 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\imp[5].net%2Fmedia%2F300x250&r=0 614 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\j[1].ad 355 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\j[2].ad 217 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\leftnav-bg-top2[1].gif 2824 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\lib[1].js 31407 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\load[1] 597 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\login[1].gif 1638 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\logo-sendme[1].jpg 4721 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\logo[1].gif 2598 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\main[1].js 620 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B9BLVWC8\map[1].js 65 bytes
    File C:\WINDOWS\system32\dllcache\psisrndr.ax 224256 bytes executable
    File C:\WINDOWS\system32\dllcache\quartz.dll (size mismatch) 1291264/1291776 bytes executable
    File C:\WINDOWS\system32\dllcache\rmcast.sys 203136 bytes executable
    File C:\WINDOWS\system32\dllcache\rpcrt4.dll 585216 bytes executable
    File C:\WINDOWS\system32\dllcache\rpcss.dll 401408 bytes executable
    File C:\WINDOWS\system32\dllcache\sbe.dll 291840 bytes executable
    File C:\WINDOWS\system32\dllcache\sc.exe 35328 bytes executable
    File C:\WINDOWS\system32\dllcache\schannel.dll (size mismatch) 144896/147456 bytes executable
    File C:\WINDOWS\system32\dllcache\scrobj.dll 180224 bytes executable
    File C:\WINDOWS\system32\dllcache\scrrun.dll 172032 bytes executable
    File C:\WINDOWS\system32\dllcache\services.exe 110592 bytes executable
    File C:\WINDOWS\system32\dllcache\SET294.tmp 1676288 bytes executable
    File C:\WINDOWS\system32\dllcache\SET295.tmp 575488 bytes executable
    File C:\WINDOWS\system32\dllcache\SET296.tmp 597504 bytes executable
    File C:\WINDOWS\system32\dllcache\SET297.tmp 89088 bytes executable
    File C:\WINDOWS\system32\dllcache\shell32.dll (size mismatch) 8461312/8462336 bytes executable
    File C:\WINDOWS\system32\dllcache\srv.sys (size mismatch) 333952/353792 bytes executable
    File C:\WINDOWS\system32\dllcache\tcpip.sys 361600 bytes executable

    ---- EOF - GMER 1.0.15 ----
     
  9. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001c

    Kernel Drivers (total 122):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806E4000 \WINDOWS\system32\hal.dll
    0x872E8000 \WINDOWS\system32\KDCOM.DLL
    0xF7A26000 \WINDOWS\system32\BOOTVID.dll
    0xF74E3000 ACPI.sys
    0xF7B12000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF74D2000 pci.sys
    0xF7612000 isapnp.sys
    0xF7414000 bmwaqk.sys
    0xF7BDA000 pciide.sys
    0xF7892000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF7622000 MountMgr.sys
    0xF73F5000 ftdisk.sys
    0xF7B14000 dmload.sys
    0xF73CF000 dmio.sys
    0xF789A000 PartMgr.sys
    0xF7632000 VolSnap.sys
    0xF73B7000 atapi.sys
    0xF7642000 disk.sys
    0xF7652000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF7397000 fltmgr.sys
    0xF7385000 sr.sys
    0xF78A2000 PxHelp20.sys
    0xF736E000 KSecDD.sys
    0xF735B000 WudfPf.sys
    0xF72CE000 Ntfs.sys
    0xF72A1000 NDIS.sys
    0xF7287000 Mup.sys
    0xF6BAE000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xF5F61000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF5F4D000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF5F25000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xF79F2000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xF5F01000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF79FA000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF5EA5000 \SystemRoot\system32\DRIVERS\Angel.sys
    0xF5E82000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7B5A000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF5E5C000 \SystemRoot\system32\DRIVERS\e100b325.sys
    0xF6B9E000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF6B8E000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF7A02000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xF6B7E000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF7CFD000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF6B6E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7217000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF5E45000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF7862000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF7872000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7A0A000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF5E34000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF7882000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF7A12000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7A1A000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF5E04000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF7672000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF78B2000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF78D2000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7B5C000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF5DA6000 \SystemRoot\system32\DRIVERS\update.sys
    0xF64B1000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF5D76000 \SystemRoot\system32\drivers\windrvr6.sys
    0xF7692000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF1E60000 \SystemRoot\system32\drivers\sthda.sys
    0xF1E3C000 \SystemRoot\system32\drivers\portcls.sys
    0xF7832000 \SystemRoot\system32\drivers\drmk.sys
    0xF7842000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7AF6000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xF0CF5000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xEF549000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xEF455000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xF7B4C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xECCE6000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7B4E000 \SystemRoot\System32\Drivers\Beep.SYS
    0xEBF7F000 \SystemRoot\System32\drivers\vga.sys
    0xF7B50000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7B54000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xEBF77000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xEBF6F000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xEF329000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEB29B000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEB242000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEB21C000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xEB1F4000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xEF529000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xEB1D2000 \SystemRoot\System32\drivers\afd.sys
    0xEF519000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xEF309000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0xEB18A000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xEC05D000 \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS
    0xEB11A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xEBFFF000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF7237000 \SystemRoot\System32\Drivers\ASPI32.SYS
    0xB9C41000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xB9C39000 \SystemRoot\system32\DRIVERS\LHidKE.Sys
    0xEF32D000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0xB9680000 \SystemRoot\system32\DRIVERS\LMouKE.Sys
    0xB48BE000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xEB2CA000 \SystemRoot\System32\drivers\Dxapi.sys
    0xB9973000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7CD1000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF065000 \SystemRoot\System32\ati2cqag.dll
    0xBF0FE000 \SystemRoot\System32\atikvmag.dll
    0xBF182000 \SystemRoot\System32\atiok3x2.dll
    0xBF1CD000 \SystemRoot\System32\ati3duag.dll
    0xBF572000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xEB6E8000 \SystemRoot\system32\DRIVERS\mdc8021x.sys
    0xEB6DC000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xF0DCB000 \??\C:\WINDOWS\system32\ANIO.SYS
    0xB1E35000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF7802000 \SystemRoot\system32\drivers\sysaudio.sys
    0xEF4D4000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
    0xB1BA6000 \SystemRoot\System32\Drivers\HTTP.sys
    0xEF4D0000 \SystemRoot\system32\drivers\MSPQM.sys
    0xB08D9000 \??\C:\DOCUME~1\guestt\LOCALS~1\Temp\uxloapog.sys
    0xB08B5000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xB088A000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 25):
    0 System Idle Process
    4 System
    688 C:\WINDOWS\system32\smss.exe
    736 csrss.exe
    768 C:\WINDOWS\system32\winlogon.exe
    820 C:\WINDOWS\system32\services.exe
    832 C:\WINDOWS\system32\lsass.exe
    1024 C:\WINDOWS\system32\svchost.exe
    1136 svchost.exe
    1244 C:\WINDOWS\system32\svchost.exe
    1356 C:\WINDOWS\system32\svchost.exe
    1512 svchost.exe
    276 C:\Program Files\IObit\Game Booster 2\GameBox.exe
    416 C:\WINDOWS\explorer.exe
    504 C:\WINDOWS\ehome\ehrecvr.exe
    720 C:\WINDOWS\ehome\ehSched.exe
    1576 C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    1820 C:\WINDOWS\system32\svchost.exe
    3140 C:\WINDOWS\system32\wscntfy.exe
    3728 alg.exe
    1808 C:\WINDOWS\system32\svchost.exe
    2404 C:\Program Files\Mozilla Firefox\firefox.exe
    3920 C:\Program Files\Mozilla Firefox\plugin-container.exe
    2956 C:\Documents and Settings\guestt\Desktop\MBRCheck.exe
    2864 <unknown>

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS)

    PhysicalDrive0 Model Number: WDCWD2500JS-75NCB1, Rev: 10.02E01

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: BF118E4CFC2D7C7489A85AC7AD11D2A979F74824


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.

    Enter your choice:
     
  10. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    DDS (Ver_10-12-12.02) - NTFSx86
    Run by guestt at 20:04:27.91 on Wed 12/22/2010
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_17
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.437 [GMT -8:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    C:\Program Files\IObit\Game Booster 2\GameBox.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    "C:\WINDOWS\System32\svchost.exe "
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Documents and Settings\guestt\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://search.babylon.com/home?AF=10191
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: H - No File
    uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
    mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
    mURLSearchHooks: H - No File
    mURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
    BHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
    TB: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
    TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
    TB: PandoraTV Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
    uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
    mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    dRunOnce: [RealUpgradeHelper] "c:\program files\common files\real\update_ob\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0 "
    uPolicies-explorer: NoInstrumentation = 1 (0x1)
    IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
    IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
    IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
    IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231464666968
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: {AC12BE9A-2B60-4542-A6AA-210CAD210760} = 208.67.222.222,0.0.0.0
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\guestt\applic~1\mozilla\firefox\profiles\gq03x6kz.default\
    FF - prefs.js: browser.startup.homepage - google.com
    FF - prefs.js: keyword.URL - hxxp://utils.babylon.com/abt/index.php?url=
    FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
    FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
    FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Shop to Win: {5835466c-49af-4cbe-b102-a8c8b6313749} - %profile%\extensions\{5835466c-49af-4cbe-b102-a8c8b6313749}
    FF - Ext: Autofill Forms: autofillForms@blueimp.net - %profile%\extensions\autofillForms@blueimp.net
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

    ============= SERVICES / DRIVERS ===============

    R3 Angel;Angel MPEG Device;c:\windows\system32\drivers\Angel.sys [2006-3-17 375936]
    S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    S2 tbhMonitor.exe;The Browser Highlighter Monitor;c:\program files\tbh\monitor\bin\tbhMonitor.exe [2009-10-22 70952]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-6-16 24652]
    S3 asbp2poa;asbp2poa;\??\c:\docume~1\dannyc~1\locals~1\temp\asbp2poa.sys --> c:\docume~1\dannyc~1\locals~1\temp\asbp2poa.sys [?]
    S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
    S3 cpuz132;cpuz132;\??\c:\docume~1\dannyc~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\dannyc~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-11-27 29744]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-12-22 38224]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S3 ZD1211BU(WLAN);IEEE 802.11g USB Wireless LAN(WLAN);c:\windows\system32\drivers\ZD1211BU.sys [2009-2-22 402432]
    S3 ZD1211U(WLAN);IEEE 802.11g USB Wireless LAN Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [2008-7-22 247296]

    =============== Created Last 30 ================

    2010-12-22 18:13:59 -------- d-----w- c:\docume~1\guestt\applic~1\Malwarebytes
    2010-12-22 18:13:52 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-22 18:13:52 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-12-22 18:13:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-22 18:13:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-22 06:07:57 -------- d-----w- C:\ComboFix
    2010-12-22 05:32:50 -------- d-----w- c:\docume~1\guestt\applic~1\DriverCure
    2010-12-22 05:32:49 -------- d-----w- c:\docume~1\guestt\applic~1\ParetoLogic
    2010-12-22 05:32:32 -------- d-----w- c:\docume~1\alluse~1\applic~1\ParetoLogic
    2010-12-21 23:47:41 -------- d-----w- c:\program files\Registry Easy
    2010-12-21 23:40:20 -------- d-----w- c:\program files\RegQuick
    2010-12-21 22:21:20 -------- d--h--w- c:\windows\system32\GroupPolicy
    2010-12-21 20:50:05 -------- d-----w- c:\windows\system32\NtmsData
    2010-12-21 08:53:39 -------- d-sha-r- C:\cmdcons
    2010-12-21 08:45:51 98816 ----a-w- c:\windows\sed.exe
    2010-12-21 08:45:51 89088 ----a-w- c:\windows\MBR.exe
    2010-12-21 08:45:51 256512 ----a-w- c:\windows\PEV.exe
    2010-12-21 08:45:51 161792 ----a-w- c:\windows\SWREG.exe
    2010-12-21 08:37:40 210432 ----a-w- c:\windows\Xtycea.exe
    2010-12-21 08:37:20 126464 --sha-r- c:\windows\system32\atiiiexxr.dll
    2010-12-21 08:35:52 0 ----a-w- c:\windows\Qbubuciv.bin
    2010-12-21 08:34:06 763392 ----a-w- c:\windows\system32\drivers\bmwaqk.sys
    2010-12-21 01:45:14 -------- d-----w- c:\program files\Yontoo Layers Client
    2010-12-21 01:45:13 -------- d-----w- c:\docume~1\alluse~1\applic~1\Tarma Installer
    2010-11-30 05:50:13 -------- d-----w- C:\Download
    2010-11-30 05:49:35 -------- d-----w- C:\tmpDownload
    2010-11-30 05:49:28 -------- d-----w- C:\YoutubeMusicDownloader
    2010-11-30 05:40:10 -------- d-----w- c:\docume~1\guestt\locals~1\applic~1\DownloadYoutubeMusic
    2010-11-24 06:12:12 -------- d-----w- c:\program files\common files\DivX Shared
    2010-11-24 06:09:39 -------- d-----w- c:\docume~1\alluse~1\applic~1\DivX

    ==================== Find3M ====================

    2010-10-07 20:23:02 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-10-07 20:23:02 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-10-07 20:23:02 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-10-07 20:23:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2010-09-28 23:44:52 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

    =================== ROOTKIT ====================

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: WDC_WD2500JS-75NCB1 rev.10.02E01 -> Harddisk0\DR0 -> \Device\Ide\IdePort1 P1T0L0-17

    device: opened successfully
    user: MBR read successfully

    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x87320555]<<
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x873267b0]; MOV EAX, [0x8732682c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x87376AB8]
    3 CLASSPNP[0xF7652FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x873AA030]
    \Driver\atapi[0x87378A00] -> IRP_MJ_CREATE -> 0x87320555
    kernel: MBR read successfully
    _asm { MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62d; }
    detected disk devices:
    \Device\Ide\IdeDeviceP1T0L0-17 -> \??\IDE#DiskWDC_WD2500JS-75NCB1_____________________10.02E01#5&2510770d&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x8732039B
    user & kernel MBR OK
    Warning: possible TDL3 rootkit infection !

    ============= FINISH: 20:05:53.30 ===============
     
  11. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 8/27/2007 7:37:52 PM
    System Uptime: 12/22/2010 7:32:47 PM (1 hours ago)

    Motherboard: Dell Inc. | | 0WG261
    Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz | Microprocessor | 3192/800mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 228 GiB total, 103.333 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP767: 9/29/2010 12:27:06 AM - System Checkpoint
    RP768: 11/7/2010 10:22:16 AM - System Checkpoint
    RP769: 11/16/2010 10:08:32 PM - Removed Ask Toolbar.
    RP770: 11/16/2010 10:20:05 PM - Installed iTunes
    RP771: 12/20/2010 2:51:09 PM - Software Distribution Service 3.0

    ==== Installed Programs ======================

    2Wire Wireless Client
    Acrobat.com
    Adobe AIR
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Reader 8.1.1
    Adobe Reader 9.1.1
    Adobe Setup
    Adobe Shockwave Player
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    Advanced SystemCare 3
    Advanced Video FX Utility
    AIM 6
    AIM Toolbar
    Amadis AVI/DIVX/WMV/MPEG/MOV/SWF/FLV/MKV/RM/RMVB Video Converte
    ANIO Service
    ANIWZCS2 Service
    AOLIcon
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Ask Toolbar
    AT&T Yahoo! High Speed Internet Home Networking Installer
    ATI Control Panel
    ATI Display Driver
    Avanquest update
    Banctec Service Agreement
    Bonjour
    Browser Highlighter - Firefox
    Call of Duty(R) - World at War(TM)
    CCleaner
    Cheat Engine 5.6.1
    Combined Community Codec Pack 2007-07-22
    Coupon Printer for Windows
    Creative Photo Manager
    Creative WebCam Center
    Creative WebCam Instant Driver (1.03.02.0425)
    Creative WebCam Instant User's Guide (English)
    Critical Update for Windows Media Player 11 (KB959772)
    Dell Digital Jukebox Driver
    Dell Driver Reset Tool
    Dell ResourceCD
    Dell Support Center (Support Software)
    Dell System Restore
    DellSupport
    Digital Content Portal
    DivX Setup
    DriverMax 5
    EducateU
    ELIcon
    Epson Easy Photo Print 2
    EPSON NX100 Series Printer Uninstall
    EPSON Scan
    ESPNMotion
    FaxTools
    Fotosizer 1.12.0.190
    FrostWire 4.17.2
    Game Booster
    getPlus(R) for Adobe
    Google Desktop
    High Definition Audio Driver Package - KB835221
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    ijji REACTOR
    Intel(R) PRO Network Connections Drivers
    Intel(R) PROSet for Wired Connections
    iSpring Free 4.1
    iTunes
    Java 2 Runtime Environment, SE v1.4.2_03
    Java(TM) 6 Update 17
    Java(TM) 6 Update 2
    K-Lite Codec Pack 3.4.5 Full
    Logger Pro 3.6.1
    Logitech Desktop Messenger
    Logitech SetPoint
    Malwarebytes' Anti-Malware
    MCU
    Microsoft .NET Framework 1.0 Hotfix (KB953295)
    Microsoft .NET Framework 1.0 Hotfix (KB979904)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft ActiveSync
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Digital Image Library 9 - Blocker
    Microsoft Digital Image Standard 2006
    Microsoft Digital Image Standard 2006 Editor
    Microsoft Digital Image Standard 2006 Library
    Microsoft Encarta Encyclopedia Standard 2006
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Money 2006
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Standard 2007
    Microsoft Office Standard 2007 Trial
    Microsoft Office Word MUI (English) 2007
    Microsoft Plus! Digital Media Edition Installer
    Microsoft Plus! Photo Story 2 LE
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft Streets & Trips 2006
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works
    Microsoft Works Suite 2006 Setup Launcher
    Microsoft Works Suite Add-in for Microsoft Word
    Motorola Driver Installation 3.2.0
    Motorola Phone Tools
    Mozilla Firefox (3.6.13)
    MSN
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser (KB925673)
    Pack Vista Inspirat 2 1.0
    Pando Media Booster
    PDF Settings
    PowerDVD 5.5
    QuickTime
    RealPlayer
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for 2007 Microsoft Office System (KB982312)
    Security Update for 2007 Microsoft Office System (KB982331)
    Security Update for Microsoft Office Excel 2007 (KB982308)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office Outlook 2007 (KB980376)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB969613)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB982135)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB976325)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB981349)
    Security Update for Windows XP (KB982381)
    SightSpeed
    Skype web features
    Skype™ 4.1
    Soldier Front
    Sonic Encoders
    Sony Ericsson Media Manager 1.0
    Sony Ericsson PC Suite 3.106.00
    System Requirements Lab for Intel
    The KMPlayer (remove only)
    TransferMy Video
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Outlook 2007 Junk Email Filter (kb2202131)
    Update for Windows Media Player 10 (KB913800)
    Update for Windows Media Player 10 (KB926251)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Update for Windows XP (KB978207)
    Update for Windows XP (KB980182)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    Update Service
    URL Assistant
    VC80CRTRedist - 8.0.50727.4053
    Viewpoint Media Player
    Virtual Earth 3D (Beta)
    WebCam Instant Product Registration
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Installer 3.1 (KB893803)
    Windows Media Format 11 runtime
    Windows Media Player 10
    Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
    Windows Media Player 11
    Windows Media Player Firefox Plugin
    Windows Mobile® Device Handbook
    Windows Presentation Foundation
    Windows XP Media Center Edition 2005 KB908246
    Windows XP Media Center Edition 2005 KB925766
    Windows XP Media Center Edition 2005 KB973768
    Windows XP Service Pack 3
    WinRAR archiver
    Wireless G WUA-1340
    Works Upgrade
    Xilisoft iPod Video Converter
    XML Paper Specification Shared Components Pack 1.0
    Yontoo Layers Client 1.10.01

    ==== Event Viewer Messages From Past Week ========

    12/21/2010 3:15:09 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/21/2010 12:50:19 PM, error: Service Control Manager [7024] - The Media Center Extender Service service terminated with service-specific error 2147500037 (0x80004005).
    12/21/2010 12:49:54 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000003A' while processing the file '_filelst.cfg' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
    12/21/2010 12:34:12 AM, error: Service Control Manager [7000] - The Microsoft Kernel Acoustic Echo Canceller service failed to start due to the following error: A device attached to the system is not functioning.
    12/21/2010 11:26:49 PM, error: Service Control Manager [7000] - The Media Center Extender Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/21/2010 11:26:47 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Media Center Extender Service service to connect.
    12/21/2010 10:22:16 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    12/21/2010 1:36:08 AM, error: Service Control Manager [7024] - The Computer Browser service terminated with service-specific error 2184 (0x888).
    12/21/2010 1:36:08 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA) service to connect.
    12/21/2010 1:36:08 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Fax service to connect.
    12/21/2010 1:36:08 AM, error: Service Control Manager [7000] - The Windows Image Acquisition (WIA) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/21/2010 1:36:08 AM, error: Service Control Manager [7000] - The Fax service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/21/2010 1:35:18 AM, error: BROWSER [8017] - The browser has failed to start because the dependent service LanmanServer had invalid service status 3. Status Meaning 1 Service Stopped 2 Start Pending 3 Stop Pending 4 Running 5 Continue Pending 6 Pause Pending 7 Paused
    12/21/2010 1:25:12 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ASPI32 Fips intelppm OMCI
    12/21/2010 1:25:12 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The file or directory is corrupted and unreadable.
    12/21/2010 1:24:26 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/21/2010 1:23:53 PM, error: SRService [104] - The System Restore initialization process failed.
    12/21/2010 1:23:52 PM, error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.
    12/21/2010 1:23:51 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000034' while processing the file '_filelst.cfg' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
    12/21/2010 1:08:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    12/20/2010 6:38:07 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    12/18/2010 9:01:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Apple Mobile Device service to connect.
    12/18/2010 9:01:56 PM, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/18/2010 9:00:52 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 6:20:20 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 7 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 4:20:33 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 6 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 4:11:04 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 5 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 3:11:20 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 12:50:48 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/18/2010 11:11:27 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/17/2010 10:44:50 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/15/2010 8:37:42 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 16 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    ==== End Of File ===========================
    DONE PLEASE HELP ..
     
  12. 2010/12/23
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Thanks :)

    One of our trained malware analysts will take a look at your logs ASAP, but it may be a day or so before you get a response as they are always very busy. All logs are dealt with in the order received.

    Thank you for your patience.
     
  13. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    Thanks for replying, hope they will help this guy asap!
     
  14. 2010/12/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard :)

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================================================

    We have quite a few issues here, including lack of any antivirus program installed, but let's start with removing a rootkit.

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  15. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    thanks i'm dling it right now =]
     
  16. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    2010/12/23 11:46:55.0250 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
    2010/12/23 11:46:55.0250 ================================================================================
    2010/12/23 11:46:55.0250 SystemInfo:
    2010/12/23 11:46:55.0250
    2010/12/23 11:46:55.0250 OS Version: 5.1.2600 ServicePack: 3.0
    2010/12/23 11:46:55.0250 Product type: Workstation
    2010/12/23 11:46:55.0250 ComputerName: DDCJ3P91
    2010/12/23 11:46:55.0250 UserName: guestt
    2010/12/23 11:46:55.0250 Windows directory: C:\WINDOWS
    2010/12/23 11:46:55.0250 System windows directory: C:\WINDOWS
    2010/12/23 11:46:55.0250 Processor architecture: Intel x86
    2010/12/23 11:46:55.0250 Number of processors: 2
    2010/12/23 11:46:55.0250 Page size: 0x1000
    2010/12/23 11:46:55.0250 Boot type: Normal boot
    2010/12/23 11:46:55.0250 ================================================================================
    2010/12/23 11:46:55.0625 Initialize success
    2010/12/23 11:47:05.0328 ================================================================================
    2010/12/23 11:47:05.0328 Scan started
    2010/12/23 11:47:05.0328 Mode: Manual;
    2010/12/23 11:47:05.0328 ================================================================================
    2010/12/23 11:47:06.0125 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    2010/12/23 11:47:06.0234 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2010/12/23 11:47:06.0250 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2010/12/23 11:47:06.0265 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    2010/12/23 11:47:06.0328 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2010/12/23 11:47:06.0406 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2010/12/23 11:47:06.0453 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2010/12/23 11:47:06.0484 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    2010/12/23 11:47:06.0515 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
    2010/12/23 11:47:06.0546 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    2010/12/23 11:47:06.0562 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    2010/12/23 11:47:06.0578 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
    2010/12/23 11:47:06.0640 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
    2010/12/23 11:47:06.0656 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
    2010/12/23 11:47:06.0687 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
    2010/12/23 11:47:06.0718 Angel (d9b99ec3c1ce74d1a451b349255c69ef) C:\WINDOWS\system32\DRIVERS\Angel.sys
    2010/12/23 11:47:06.0812 ANIO (920298c7aef97d8168d219d35975d295) C:\WINDOWS\system32\ANIO.SYS
    2010/12/23 11:47:07.0218 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
    2010/12/23 11:47:07.0281 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    2010/12/23 11:47:07.0343 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
    2010/12/23 11:47:07.0406 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\ASPI32.sys
    2010/12/23 11:47:07.0484 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2010/12/23 11:47:07.0546 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2010/12/23 11:47:07.0703 ati2mtag (e9375396f55b58c2042c7c9844d297e3) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
    2010/12/23 11:47:07.0843 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2010/12/23 11:47:07.0859 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2010/12/23 11:47:07.0906 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2010/12/23 11:47:07.0921 Suspicious service (NoAccess): bmwaqk
    2010/12/23 11:47:07.0984 bmwaqk (a1c7941c0b4c0b4502f2fae8fdb13b52) C:\WINDOWS\system32\drivers\bmwaqk.sys
    2010/12/23 11:47:07.0984 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\bmwaqk.sys. md5: a1c7941c0b4c0b4502f2fae8fdb13b52
    2010/12/23 11:47:07.0984 bmwaqk - detected Locked service (1)
    2010/12/23 11:47:08.0140 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    2010/12/23 11:47:08.0156 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2010/12/23 11:47:08.0187 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2010/12/23 11:47:08.0234 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    2010/12/23 11:47:08.0296 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2010/12/23 11:47:08.0359 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2010/12/23 11:47:08.0437 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2010/12/23 11:47:08.0484 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
    2010/12/23 11:47:08.0515 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    2010/12/23 11:47:08.0625 cpudrv (d01f685f8b4598d144b0cce9ff95d8d5) C:\Program Files\SystemRequirementsLab\cpudrv.sys
    2010/12/23 11:47:08.0953 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    2010/12/23 11:47:09.0015 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    2010/12/23 11:47:09.0062 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2010/12/23 11:47:09.0140 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2010/12/23 11:47:09.0265 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    2010/12/23 11:47:09.0328 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2010/12/23 11:47:09.0406 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2010/12/23 11:47:09.0437 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    2010/12/23 11:47:09.0484 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2010/12/23 11:47:09.0656 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
    2010/12/23 11:47:09.0703 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys
    2010/12/23 11:47:09.0734 E100B (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    2010/12/23 11:47:09.0828 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2010/12/23 11:47:09.0859 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2010/12/23 11:47:09.0937 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2010/12/23 11:47:09.0984 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2010/12/23 11:47:10.0078 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2010/12/23 11:47:10.0109 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2010/12/23 11:47:10.0187 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2010/12/23 11:47:10.0234 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
    2010/12/23 11:47:10.0281 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2010/12/23 11:47:10.0343 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2010/12/23 11:47:10.0421 HidIr (bb1a6fb7d35a91e599973fa74a619056) C:\WINDOWS\system32\DRIVERS\hidir.sys
    2010/12/23 11:47:10.0546 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2010/12/23 11:47:10.0609 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
    2010/12/23 11:47:10.0687 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2010/12/23 11:47:10.0718 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
    2010/12/23 11:47:10.0750 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
    2010/12/23 11:47:10.0812 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2010/12/23 11:47:10.0875 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2010/12/23 11:47:10.0890 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
    2010/12/23 11:47:10.0937 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2010/12/23 11:47:10.0984 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2010/12/23 11:47:11.0046 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2010/12/23 11:47:11.0062 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2010/12/23 11:47:11.0093 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2010/12/23 11:47:11.0125 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2010/12/23 11:47:11.0203 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2010/12/23 11:47:11.0265 IrBus (b43b36b382aea10861f7c7a37f9d4ae2) C:\WINDOWS\system32\DRIVERS\IrBus.sys
    2010/12/23 11:47:11.0281 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2010/12/23 11:47:11.0343 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2010/12/23 11:47:11.0437 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2010/12/23 11:47:11.0453 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2010/12/23 11:47:11.0500 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2010/12/23 11:47:11.0593 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2010/12/23 11:47:11.0703 LHidKe (31b582394da3290dff300f10952e9a4d) C:\WINDOWS\system32\DRIVERS\LHidKE.Sys
    2010/12/23 11:47:11.0750 LMouKE (90a794d0a0bf3531c4ba1c0510449629) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
    2010/12/23 11:47:11.0812 MBAMSwissArmy (d68e165c3123aba3b1282eddb4213bd8) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2010/12/23 11:47:11.0843 MDC8021X (d7010580bf4e45d5e793a1fe75758c69) C:\WINDOWS\system32\DRIVERS\mdc8021x.sys
    2010/12/23 11:47:11.0906 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
    2010/12/23 11:47:11.0953 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2010/12/23 11:47:12.0000 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2010/12/23 11:47:12.0078 motmodem (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motmodem.sys
    2010/12/23 11:47:12.0125 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2010/12/23 11:47:12.0171 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2010/12/23 11:47:12.0218 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2010/12/23 11:47:12.0234 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    2010/12/23 11:47:12.0281 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2010/12/23 11:47:12.0375 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2010/12/23 11:47:12.0468 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2010/12/23 11:47:12.0546 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2010/12/23 11:47:12.0562 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2010/12/23 11:47:12.0625 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2010/12/23 11:47:12.0687 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2010/12/23 11:47:12.0750 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    2010/12/23 11:47:12.0812 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2010/12/23 11:47:12.0875 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2010/12/23 11:47:12.0937 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2010/12/23 11:47:13.0000 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2010/12/23 11:47:13.0046 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2010/12/23 11:47:13.0062 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2010/12/23 11:47:13.0078 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2010/12/23 11:47:13.0093 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
    2010/12/23 11:47:13.0171 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2010/12/23 11:47:13.0234 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2010/12/23 11:47:13.0296 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2010/12/23 11:47:13.0359 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2010/12/23 11:47:13.0421 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2010/12/23 11:47:13.0562 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2010/12/23 11:47:13.0703 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2010/12/23 11:47:13.0718 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2010/12/23 11:47:13.0750 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
    2010/12/23 11:47:13.0812 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    2010/12/23 11:47:13.0859 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2010/12/23 11:47:13.0906 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2010/12/23 11:47:13.0984 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/12/23 11:47:14.0031 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2010/12/23 11:47:14.0078 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2010/12/23 11:47:14.0140 PD0620VID (ea296b87ba381c640b441d95f90785f8) C:\WINDOWS\system32\DRIVERS\P0620Vid.sys
    2010/12/23 11:47:14.0234 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
    2010/12/23 11:47:14.0250 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    2010/12/23 11:47:14.0312 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2010/12/23 11:47:14.0375 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2010/12/23 11:47:14.0421 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2010/12/23 11:47:14.0453 PxHelp20 (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2010/12/23 11:47:14.0515 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
    2010/12/23 11:47:14.0531 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    2010/12/23 11:47:14.0546 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
    2010/12/23 11:47:14.0562 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
    2010/12/23 11:47:14.0578 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
    2010/12/23 11:47:14.0609 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2010/12/23 11:47:14.0640 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2010/12/23 11:47:14.0656 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2010/12/23 11:47:14.0671 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2010/12/23 11:47:14.0765 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2010/12/23 11:47:14.0796 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/12/23 11:47:14.0843 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2010/12/23 11:47:14.0906 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2010/12/23 11:47:15.0000 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2010/12/23 11:47:15.0093 RT73 (b01b2c25bd80770878285fb569090d7b) C:\WINDOWS\system32\DRIVERS\Dr71WU.sys
    2010/12/23 11:47:15.0171 s217bus (0266151de3f36429f6ac3c4b28085061) C:\WINDOWS\system32\DRIVERS\s217bus.sys
    2010/12/23 11:47:15.0187 s217mdfl (a43c0af0e46be7ef0c7e8ccf0f058600) C:\WINDOWS\system32\DRIVERS\s217mdfl.sys
    2010/12/23 11:47:15.0218 s217mdm (005f5ded1ed8f8a9d2399d765ead20f1) C:\WINDOWS\system32\DRIVERS\s217mdm.sys
    2010/12/23 11:47:15.0250 s217mgmt (de9562ad0c91e1857d11f65a91ee1a47) C:\WINDOWS\system32\DRIVERS\s217mgmt.sys
    2010/12/23 11:47:15.0296 s217nd5 (11cc5d7f992799e7e75d018e9c018563) C:\WINDOWS\system32\DRIVERS\s217nd5.sys
    2010/12/23 11:47:15.0359 s217obex (0f9f4045799afb66b85eef999d0609ec) C:\WINDOWS\system32\DRIVERS\s217obex.sys
    2010/12/23 11:47:15.0437 s217unic (1c91e1023f07b6407d84b5a43537d984) C:\WINDOWS\system32\DRIVERS\s217unic.sys
    2010/12/23 11:47:15.0515 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2010/12/23 11:47:15.0578 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2010/12/23 11:47:15.0656 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    2010/12/23 11:47:15.0703 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2010/12/23 11:47:15.0781 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
    2010/12/23 11:47:15.0796 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2010/12/23 11:47:15.0859 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
    2010/12/23 11:47:15.0921 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2010/12/23 11:47:16.0031 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2010/12/23 11:47:16.0125 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
    2010/12/23 11:47:16.0218 STHDA (2a2dc39623adef8ab3703ab9fac4b440) C:\WINDOWS\system32\drivers\sthda.sys
    2010/12/23 11:47:16.0312 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2010/12/23 11:47:16.0375 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2010/12/23 11:47:16.0421 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2010/12/23 11:47:16.0468 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
    2010/12/23 11:47:16.0515 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    2010/12/23 11:47:16.0546 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    2010/12/23 11:47:16.0578 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    2010/12/23 11:47:16.0609 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2010/12/23 11:47:16.0718 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2010/12/23 11:47:16.0734 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2010/12/23 11:47:16.0765 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2010/12/23 11:47:16.0812 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2010/12/23 11:47:16.0875 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
    2010/12/23 11:47:16.0953 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2010/12/23 11:47:17.0031 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
    2010/12/23 11:47:17.0125 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2010/12/23 11:47:17.0203 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2010/12/23 11:47:17.0250 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2010/12/23 11:47:17.0328 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2010/12/23 11:47:17.0375 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2010/12/23 11:47:17.0437 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2010/12/23 11:47:17.0500 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2010/12/23 11:47:17.0515 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2010/12/23 11:47:17.0546 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2010/12/23 11:47:17.0578 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
    2010/12/23 11:47:17.0625 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2010/12/23 11:47:17.0671 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
    2010/12/23 11:47:17.0703 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    2010/12/23 11:47:17.0750 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2010/12/23 11:47:17.0781 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2010/12/23 11:47:17.0859 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
    2010/12/23 11:47:17.0953 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2010/12/23 11:47:18.0078 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2010/12/23 11:47:18.0156 WinDriver6 (097a8291df541f9b9af2c500797cdcaa) C:\WINDOWS\system32\drivers\windrvr6.sys
    2010/12/23 11:47:18.0281 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2010/12/23 11:47:18.0312 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2010/12/23 11:47:18.0375 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2010/12/23 11:47:18.0437 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2010/12/23 11:47:18.0515 ZD1211BU(WLAN) (478b4415dfb3a45b6fe61ec781e07d7b) C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys
    2010/12/23 11:47:18.0593 ZD1211U(WLAN) (7597e0c770bd8ce1beb552b0a756bdb7) C:\WINDOWS\system32\DRIVERS\zd1211u.sys
    2010/12/23 11:47:18.0640 ZDPNDIS5 (29c917279d79848b3dd94909fc00e2a8) C:\WINDOWS\system32\ZDPNDIS5.SYS
    2010/12/23 11:47:18.0812 ZDPSp50 (00ae175b903d45ed4a62384d3315dc2a) C:\WINDOWS\system32\Drivers\ZDPSp50.sys
    2010/12/23 11:47:18.0859 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
    2010/12/23 11:47:18.0875 ================================================================================
    2010/12/23 11:47:18.0875 Scan finished
    2010/12/23 11:47:18.0875 ================================================================================
    2010/12/23 11:47:18.0875 Detected object count: 2
    2010/12/23 11:47:41.0250 Locked service(bmwaqk) - User select action: Skip
    2010/12/23 11:47:41.0265 \HardDisk0 - will be cured after reboot
    2010/12/23 11:47:41.0265 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
    2010/12/23 11:47:51.0078 Deinitialize success
     
  17. 2010/12/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
  18. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    okay, i'm download avast please check back soon!
     
  19. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    okay i cant seem to download any of the two link, everytime i go to the download page it wont load ... help..

    nvm i attempted to download it in safe mode and it worked ! check back soon
     
    Last edited: 2010/12/23
  20. 2010/12/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok.....
     
  21. 2010/12/23
    Davidx510

    Davidx510 Inactive Thread Starter

    Joined:
    2010/12/22
    Messages:
    46
    Likes Received:
    0
    um finishing scanning using avast and i got 2 infected files.
     
    Last edited: 2010/12/23
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.