Solved Malicious software EXE file

dave1234 · 2011/01/05

[Resolved] Malicious software EXE file

HELP!

Tricked into installing EXE file containing fake anti-virus software.

Cannot access internet, or any files. Clicking any icon prompts link to company site.

Thanks
Dave

broni · 2011/01/05

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===============================================================

See, if same issue happens in Safe Mode with Networking.

dave1234 · 2011/01/06

I am able to run Safe Mode with Networking. I ran Microsoft Security Essentials but does not pickup virus.

Admin. · 2011/01/06

Hi,

Read this post as indicated at the top of this forum & follow the instructions.

dave1234 · 2011/01/06

I am sending this from a laptop,my PC is infected and cannot connect to internet.
I ran virus check with Microsoft Security Essentials, ran Malwarebytes, nothing came up.
Ran Temp File Cleaner.
Cannot download GMER or MBR Check or DDS.

PeteC · 2011/01/06

Download the programs to your laptop, transfer via USB pen drive to the desktop of the infected computer.

Run the programs and transfer the logs to the laptop and post here.

broni · 2011/01/06

Thanks guys

dave1234 · 2011/01/06

Logs

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

1/6/2011 7:11:51 AM
mbam-log-2011-01-06 (07-11-51).txt

Scan type: Quick scan
Objects scanned: 125074
Time elapsed: 6 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-06 19:18:09
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e Maxtor_6L080M0 rev.BANC1G10
Running: eflix8xy.exe; Driver: C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\ffdoapod.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF86D387E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF86D3BFE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000000cc

Kernel Drivers (total 95):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FF000 \WINDOWS\system32\hal.dll
0xF8B83000 \WINDOWS\system32\KDCOM.DLL
0xF8A93000 \WINDOWS\system32\BOOTVID.dll
0xF8634000 ACPI.sys
0xF8B85000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF8623000 pci.sys
0xF8683000 isapnp.sys
0xF8C4B000 pciide.sys
0xF8903000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF8693000 MountMgr.sys
0xF8604000 ftdisk.sys
0xF890B000 PartMgr.sys
0xF86A3000 VolSnap.sys
0xF85EC000 atapi.sys
0xF86B3000 disk.sys
0xF86C3000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF85CC000 fltmgr.sys
0xF85BA000 sr.sys
0xF86D3000 Lbd.sys
0xF86E3000 PxHelp20.sys
0xF85A3000 KSecDD.sys
0xF8590000 WudfPf.sys
0xF8503000 Ntfs.sys
0xF84D6000 NDIS.sys
0xF84BC000 Mup.sys
0xF843B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF894B000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF8417000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF8953000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF83F1000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF8703000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF8713000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF8723000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF83CE000 \SystemRoot\system32\DRIVERS\ks.sys
0xF896B000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF8733000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF8B1F000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF83B7000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF8743000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8753000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF898B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF83A6000 \SystemRoot\system32\DRIVERS\psched.sys
0xF8763000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF899B000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF89AB000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF8773000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF89B3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF89BB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF8B8F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF8348000 \SystemRoot\system32\DRIVERS\update.sys
0xF8B33000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8783000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8793000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8B95000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8B67000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF8B99000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8C61000 \SystemRoot\System32\Drivers\Null.SYS
0xF8B9D000 \SystemRoot\System32\Drivers\Beep.SYS
0xF89E3000 \SystemRoot\System32\drivers\vga.sys
0xF830C000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xF8BA1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF89F3000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8A03000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8B73000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF82D9000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF8280000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF8258000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF8232000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF8210000 \SystemRoot\System32\drivers\afd.sys
0xF87A3000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF81BD000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF814D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF8463000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF87D3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF8A23000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF8B1B000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF8A33000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF8340000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF87E3000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF8095000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8BAF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF8B37000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8A5B000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8D91000 \SystemRoot\System32\drivers\dxgthk.sys
0xBFF50000 \SystemRoot\System32\framebuf.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF7B49000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF791D000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7679000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF8A8B000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF7481000 \??\C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\ffdoapod.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 21):
0 System Idle Process
4 System
500 C:\WINDOWS\system32\smss.exe
564 csrss.exe
588 C:\WINDOWS\system32\winlogon.exe
632 C:\WINDOWS\system32\services.exe
644 C:\WINDOWS\system32\lsass.exe
780 C:\WINDOWS\system32\svchost.exe
884 svchost.exe
936 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
1024 C:\WINDOWS\system32\svchost.exe
1048 svchost.exe
1108 svchost.exe
1184 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1376 unsecapp.exe
1464 wmiprvse.exe
1688 C:\WINDOWS\explorer.exe
284 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
1544 C:\WINDOWS\system32\ctfmon.exe
992 H:\eflix8xy.exe
796 H:\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)

PhysicalDrive0 Model Number: <error opening>

Size Device Name MBR Status
--------------------------------------------
ERROR Opening: \\.\PhysicalDrive0 (32)

Done!

DDS (Ver_10-12-12.02) - NTFSx86 NETWORK
Run by David Peters at 19:23:44.87 on Thu 01/06/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.231 [GMT -5:00]

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
H:\eflix8xy.exe
H:\MBRCheck.exe
H:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:8074
uURLSearchHooks: DVDVideoSoftTB Toolbar: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - c:\program files\dvdvideosoft\tbDVD2.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: DVDVideoSoftTB Toolbar: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - c:\program files\dvdvideosoft\tbDVD2.dll
TB: DVDVideoSoftTB Toolbar: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - c:\program files\dvdvideosoft\tbDVD2.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [lxkkjojp] c:\docume~1\davidp~1\locals~1\temp\fnvwabmis\gcweobjlajb.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
Trusted Zone: musicmatch.com\online
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxp://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab
DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - hxxp://www.photogize.com/bponet/PhotogizeImageUploader4.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - hxxp://download.abacast.com/download/files/abasetup162.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-15 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-3-18 28552]
S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-4 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-4 74480]
S2 gupdate1c9c3951be7f6a0;Google Update Service (gupdate1c9c3951be7f6a0);c:\program files\google\update\GoogleUpdate.exe [2009-4-22 133104]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-4 7408]

=============== Created Last 30 ================

2011-01-06 02:17:03 -------- d-----w- C:\c4754b31f44a3c68e206b76bf0
2011-01-05 10:17:49 6273872 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{67dcb740-1211-400c-af3a-0043b1abbab2}\mpengine.dll
2010-12-17 15:56:29 -------- d-sh--w- c:\documents and settings\david peters\IECompatCache
2010-12-15 19:29:29 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys

==================== Find3M ====================

2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-15 06:27:44 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-22 09:55:31 0 ----a-w- c:\windows\Lyejepefoqesod.bin
2010-10-19 20:51:33 222080 ------w- c:\windows\system32\MpSigStub.exe
2004-08-04 11:00:00 94784 -csh--w- c:\windows\twain.dll
2008-04-14 00:12:07 50688 -csh--w- c:\windows\twain_32.dll
2010-09-18 06:53:25 974848 --sha-w- c:\windows\system32\mfc42.dll
2008-04-14 00:12:01 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-04-14 00:12:02 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12:02 84992 --sh--w- c:\windows\system32\olepro32.dll
2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe

============= FINISH: 19:24:10.09 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 11/14/2005 10:50:12 AM
System Uptime: 1/6/2011 4:40:43 AM (15 hours ago)

Motherboard: Dell Inc. | | 0RD203
Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 71 GiB total, 45.326 GiB free.
D: is CDROM ()
G: is CDROM (CDFS)
H: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1479: 10/7/2010 10:52:02 PM - Software Distribution Service 3.0
RP1480: 10/9/2010 8:20:16 AM - System Checkpoint
RP1481: 10/10/2010 8:48:19 AM - System Checkpoint
RP1482: 10/11/2010 8:54:55 AM - System Checkpoint
RP1483: 10/12/2010 8:13:55 PM - System Checkpoint
RP1484: 10/13/2010 8:17:09 PM - System Checkpoint
RP1485: 10/13/2010 9:55:17 PM - Software Distribution Service 3.0
RP1486: 10/14/2010 10:27:03 PM - System Checkpoint
RP1487: 10/17/2010 2:40:31 PM - System Checkpoint
RP1488: 10/18/2010 3:26:24 PM - System Checkpoint
RP1489: 10/19/2010 8:25:23 PM - System Checkpoint
RP1490: 10/20/2010 8:36:33 PM - System Checkpoint
RP1491: 10/21/2010 6:43:58 AM - Installed Registry Reviver.
RP1492: 10/21/2010 7:26:05 AM - Removed Registry Reviver.
RP1493: 10/21/2010 7:26:18 AM - Installed RegistryReviver.
RP1494: 10/22/2010 8:39:21 AM - System Checkpoint
RP1495: 10/22/2010 6:47:58 PM - Removed AVG Free 9.0
RP1496: 10/22/2010 6:53:01 PM - Installed AVG Free 9.0
RP1497: 10/22/2010 6:58:08 PM - Software Distribution Service 3.0
RP1498: 10/22/2010 8:29:22 PM - Removed RegistryReviver.
RP1499: 10/23/2010 7:40:22 PM - Software Distribution Service 3.0
RP1500: 10/24/2010 1:56:41 AM - Software Distribution Service 3.0
RP1501: 10/25/2010 5:41:28 AM - Software Distribution Service 3.0
RP1502: 10/26/2010 6:00:09 AM - Software Distribution Service 3.0
RP1503: 10/27/2010 8:51:07 AM - System Checkpoint
RP1504: 10/27/2010 5:53:01 PM - Software Distribution Service 3.0
RP1505: 10/28/2010 6:41:58 PM - Software Distribution Service 3.0
RP1506: 10/29/2010 11:13:09 PM - System Checkpoint
RP1507: 10/30/2010 5:02:08 AM - Software Distribution Service 3.0
RP1508: 10/31/2010 6:24:48 AM - Software Distribution Service 3.0
RP1509: 11/1/2010 6:19:30 AM - Software Distribution Service 3.0
RP1510: 11/2/2010 6:20:45 AM - Software Distribution Service 3.0
RP1511: 11/3/2010 9:18:36 AM - System Checkpoint
RP1512: 11/4/2010 5:38:58 AM - Software Distribution Service 3.0
RP1513: 11/5/2010 5:43:34 AM - Software Distribution Service 3.0
RP1514: 11/6/2010 8:39:04 AM - System Checkpoint
RP1515: 11/7/2010 4:54:54 AM - Software Distribution Service 3.0
RP1516: 11/8/2010 5:07:17 AM - Software Distribution Service 3.0
RP1517: 11/9/2010 8:28:43 AM - System Checkpoint
RP1518: 11/9/2010 10:32:51 PM - Software Distribution Service 3.0
RP1519: 11/10/2010 3:00:19 AM - Software Distribution Service 3.0
RP1520: 11/15/2010 1:30:26 AM - Software Distribution Service 3.0
RP1521: 11/16/2010 1:24:53 AM - Software Distribution Service 3.0
RP1522: 11/17/2010 5:00:52 AM - Software Distribution Service 3.0
RP1523: 11/18/2010 6:06:04 AM - Software Distribution Service 3.0
RP1524: 11/18/2010 6:18:42 AM - Software Distribution Service 3.0
RP1525: 11/19/2010 9:15:13 AM - System Checkpoint
RP1526: 11/19/2010 4:44:19 PM - Software Distribution Service 3.0
RP1527: 11/20/2010 5:13:26 PM - System Checkpoint
RP1528: 11/21/2010 6:25:58 AM - Software Distribution Service 3.0
RP1529: 11/22/2010 9:04:56 AM - System Checkpoint
RP1530: 11/23/2010 5:22:32 AM - Software Distribution Service 3.0
RP1531: 11/24/2010 8:56:50 AM - System Checkpoint
RP1532: 11/25/2010 5:52:45 AM - Software Distribution Service 3.0
RP1533: 11/26/2010 6:31:58 AM - Software Distribution Service 3.0
RP1534: 11/27/2010 9:36:40 AM - System Checkpoint
RP1535: 11/28/2010 1:58:48 AM - Software Distribution Service 3.0
RP1536: 11/29/2010 9:25:20 AM - System Checkpoint
RP1537: 11/30/2010 5:06:43 AM - Software Distribution Service 3.0
RP1538: 12/1/2010 8:56:10 AM - System Checkpoint
RP1539: 12/2/2010 4:54:39 AM - Software Distribution Service 3.0
RP1540: 12/3/2010 4:59:41 AM - Software Distribution Service 3.0
RP1541: 12/4/2010 9:47:38 AM - System Checkpoint
RP1542: 12/5/2010 6:16:18 AM - Software Distribution Service 3.0
RP1543: 12/6/2010 8:50:05 AM - System Checkpoint
RP1544: 12/7/2010 4:53:33 AM - Software Distribution Service 3.0
RP1545: 12/8/2010 5:44:33 AM - Software Distribution Service 3.0
RP1546: 12/9/2010 8:15:53 AM - System Checkpoint
RP1547: 12/9/2010 4:53:03 PM - Software Distribution Service 3.0
RP1548: 12/10/2010 5:45:58 PM - System Checkpoint
RP1549: 12/11/2010 5:29:22 AM - Software Distribution Service 3.0
RP1550: 12/12/2010 1:38:31 AM - Software Distribution Service 3.0
RP1551: 12/13/2010 8:03:49 AM - System Checkpoint
RP1552: 12/13/2010 11:04:12 PM - Software Distribution Service 3.0
RP1553: 12/15/2010 5:32:27 AM - Software Distribution Service 3.0
RP1554: 12/15/2010 9:48:34 PM - Software Distribution Service 3.0
RP1555: 12/16/2010 7:14:29 PM - Software Distribution Service 3.0
RP1556: 12/17/2010 8:16:23 PM - System Checkpoint
RP1557: 12/17/2010 10:22:39 PM - Software Distribution Service 3.0
RP1558: 12/19/2010 5:54:05 AM - Software Distribution Service 3.0
RP1559: 12/20/2010 8:42:21 AM - System Checkpoint
RP1560: 12/20/2010 10:52:15 PM - Software Distribution Service 3.0
RP1561: 12/22/2010 2:06:23 AM - Software Distribution Service 3.0
RP1562: 12/23/2010 6:12:58 AM - Software Distribution Service 3.0
RP1563: 12/24/2010 6:54:05 AM - Software Distribution Service 3.0
RP1564: 12/25/2010 10:02:12 AM - System Checkpoint
RP1565: 12/25/2010 3:51:53 PM - Software Distribution Service 3.0
RP1566: 12/26/2010 5:01:41 PM - System Checkpoint
RP1567: 12/27/2010 6:17:33 AM - Software Distribution Service 3.0
RP1568: 12/28/2010 8:42:59 AM - System Checkpoint
RP1569: 12/28/2010 6:17:06 PM - Software Distribution Service 3.0
RP1570: 12/29/2010 6:31:27 PM - System Checkpoint
RP1571: 12/29/2010 9:41:40 PM - Software Distribution Service 3.0
RP1572: 12/31/2010 6:14:48 AM - Software Distribution Service 3.0
RP1573: 1/1/2011 6:42:01 AM - Software Distribution Service 3.0
RP1574: 1/2/2011 9:32:47 AM - System Checkpoint
RP1575: 1/2/2011 7:30:05 PM - Software Distribution Service 3.0
RP1576: 1/3/2011 7:49:47 PM - System Checkpoint
RP1577: 1/4/2011 5:06:32 AM - Software Distribution Service 3.0
RP1578: 1/5/2011 5:16:54 AM - Software Distribution Service 3.0

==== Installed Programs ======================

7-Zip 4.65
Abacast Client
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.4
AdsGone Popup Killer Spyware Blocker by A1Tech.com
AOL Instant Messenger
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft Panorama Maker 4
AutoUpdate
BlackBerry Desktop Software 4.3
Bonjour
Critical Update for Windows Media Player 11 (KB959772)
Cucusoft iPod Movie/Video Converter 2.00
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Support Center (Support Software)
Dell System Restore
DellSupport
Digital Content Portal
DivX
DivX Player
DVDVideoSoft Toolbar
ESET Online Scanner v3
Free Audio CD Burner version 1.2
Free YouTube to MP3 Converter version 3.2
Google Earth
Google Update Helper
High Definition Audio Driver Package - KB835221
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
HP Photo Imaging Software
HP Photo Printing Software
hp print screen utility
HP Share-to-Web
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet for Wired Connections
Internet Explorer Default Page
iPod for Windows 2005-10-12
iTunes
Java Auto Updater
Java(TM) 6 Update 18
LimeWire 5.4.6
Macromedia Flash Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Security Essentials
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch for Windows Media Player
Musicmatch® Jukebox
Nikon Message Center
Nikon Transfer
Options 360â„¢
Panda ActiveScan 2.0
Photo Viewer 2.4
PowerDVD 5.5
Qualxserve Service Agreement
Quick Startup 2.7.0.686
QuickBooks Simple Start Special Edition
QuickTime
Roxio Media Manager
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SIW version 2010.07.14
Sonic RecordNow Copy
Sonic RecordNow Data
Spybot - Search & Destroy 1.3
SUPERAntiSpyware Free Edition
Tracks Eraser Pro v7.0
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC 9.0 Runtime
View22
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
WinZip Self-Extractor
WordPerfect Office 12

==== Event Viewer Messages From Past Week ========

12/30/2010 10:43:12 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
1/6/2011 7:17:04 AM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.
1/5/2011 9:55:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/5/2011 9:55:23 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm MpFilter pavboot SASDIFSV SASKUTIL
1/5/2011 8:01:51 PM, error: Dhcp [1002] - The IP address lease 192.168.100.2 for the Network Card with network address 00123FB07423 has been denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).
1/5/2011 8:01:27 PM, error: Dhcp [1002] - The IP address lease 24.186.128.166 for the Network Card with network address 00123FB07423 has been denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).
1/5/2011 10:24:04 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
1/5/2011 10:12:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
1/4/2011 9:45:02 PM, error: Microsoft Antimalware [1008] - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Adware:JS/Pornpop.A&threatid=153970 User: D124YR81\David Peters Name: Adware:JS/Pornpop.A ID: 153970 Severity: Medium Category: Adware Path: Action: Remove Error Code: 0x80508023 Error description: The program could not find the spyware and other potentially unwanted software on this computer. Status: Signature Version: AV: 1.95.3177.0, AS: 1.95.3177.0 Engine Version: 1.1.6402.0

==== End Of File ===========================

Thanks guys.

broni · 2011/01/06

Download Bootkit Remover to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/

After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator).

It will show a Black screen with some data on it.

Right click on the screen and click Select All.

Press CTRL+C

Open a Notepad and press CTRL+V

Post the output back here.

==============================================================

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

dave1234 · 2011/01/06

Logs

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-06 19:21:13
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e Maxtor_6L080M0 rev.BANC1G10
Running: eflix8xy.exe; Driver: C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\ffdoapod.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF86D387E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF86D3BFE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

ComboFix 11-01-06.03 - David Peters 01/06/2011 20:24:53.4.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.251 [GMT -5:00]
Running from: H:\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\David Peters\Application Data\PriceGong
c:\documents and settings\David Peters\Application Data\PriceGong\Data\1.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\a.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\b.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\c.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\d.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\e.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\f.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\g.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\h.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\i.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\J.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\k.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\l.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\m.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\n.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\o.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\p.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\q.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\r.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\s.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\t.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\u.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\v.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\w.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\x.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\y.xml
c:\documents and settings\David Peters\Application Data\PriceGong\Data\z.xml
c:\documents and settings\David Peters\GoToAssistDownloadHelper.exe
c:\documents and settings\David Peters\Local Settings\Application Data\{600C68BD-DA74-4DD4-A94E-FE8DC590BA5F}
c:\documents and settings\David Peters\Local Settings\Application Data\{600C68BD-DA74-4DD4-A94E-FE8DC590BA5F}\chrome.manifest
c:\documents and settings\David Peters\Local Settings\Application Data\{600C68BD-DA74-4DD4-A94E-FE8DC590BA5F}\chrome\content\_cfg.js
c:\documents and settings\David Peters\Local Settings\Application Data\{600C68BD-DA74-4DD4-A94E-FE8DC590BA5F}\chrome\content\overlay.xul
c:\documents and settings\David Peters\Local Settings\Application Data\{600C68BD-DA74-4DD4-A94E-FE8DC590BA5F}\install.rdf
c:\documents and settings\David Peters\Recent\121888821274576856636572933491883348815369623688838716139269439421872583671726414338595421241818985237731725539729124975848446123.966
c:\documents and settings\David Peters\Recent\126738292687877627431625745175845236246394663532429678251749776727132556511867823183358621458811842281438932418884181689978356955.287
c:\documents and settings\David Peters\Recent\1449384488439734113851967892869729659373179917923482194315923496761478899832571783268737538973653369691331435126261.479
c:\documents and settings\David Peters\Recent\169286743819532641777359119632911579917518561885271267982171185292688587969179858399463395818184686598699387148739675834253985589.813
c:\documents and settings\David Peters\Recent\189836632134676983595173118773828161165886847895979994385618834529632976348546721596396655348225963194962824976897552426125199712.568
c:\documents and settings\David Peters\Recent\198832267683364753149888524149545558453222335789315915573824615178887471857941867848524678992351642467235826442899657613778365973.351
c:\documents and settings\David Peters\Recent\199131772692533441668533489793966671532734815355663961678982266674374152539162925442347277833872651429416526293417272425251858239.397
c:\documents and settings\David Peters\Recent\2178479161489627952386761496199439221213153674593952638689126673261333257358789263294839738649424436367553961583762.248
c:\documents and settings\David Peters\Recent\234267497288221238337821359545733821883958275811453844339582369838292566355934678352143268237155253426121619964964981779263545238.188
c:\documents and settings\David Peters\Recent\2486342949159769448991971283938739593915434851567452811734348715776414798853975777661211539383272892825226226333949.789
c:\documents and settings\David Peters\Recent\251431469166595524157439433943699987194296665227523455376686198814712266739244392235843896762577538816682277445216249893451426152.747
c:\documents and settings\David Peters\Recent\26267181957693862533163834254723172217576345675536672452167354497867989292174117326235271911726949152123.332
c:\documents and settings\David Peters\Recent\262975467625816135374585428893945564739399948139296367753622391241237254334559561731599931797953663138786663459181567818377651963.493
c:\documents and settings\David Peters\Recent\293369934457718224643745255175617938515968112375689981644997134274442988781433949454829451562223766815585872369882227886423249659.724
c:\documents and settings\David Peters\Recent\317532582212125533829477694511283212314739298793412114973131334465284799869295214537813942522136331211857552837212479325861492341.825
c:\documents and settings\David Peters\Recent\324735269989138138218631382918954677873439639641336893497788767887863415788565414356199873941833459714113171774262918466268144271.338
c:\documents and settings\David Peters\Recent\33217697782653947832292852727695592778358777227946938768148587914171276476722395499787186154719119439193.665
c:\documents and settings\David Peters\Recent\361676576318595838674796124933728572241614114875657295336259619977786683721512863689616385784241753259555134276914969164643144859.266
c:\documents and settings\David Peters\Recent\373628768845433344734766727736985587147697481667798947829166254187354619583149437599736152959719578373363415911145277272388112562.867
c:\documents and settings\David Peters\Recent\385738179323221529965123243327955124287498258955113549164488441835245481977448585758971622184213657175189286479459838412331868825.481
c:\documents and settings\David Peters\Recent\413663398184539522623154258443887949681444649867914661386519589789623289844524488647185484896892622879371434589192712971745112629.115
c:\documents and settings\David Peters\Recent\419124611178173831264545157365627223384611951592189218383261881562749275321848838224781561985359741942483724385344281557758196582.115
c:\documents and settings\David Peters\Recent\428664222647959698725391133486441178554484593986821112327125831886267754537716388257262595218177893667913446539693394351787547998.523
c:\documents and settings\David Peters\Recent\434233753739471483244214541661723593314528139788162442828474386212595155448746332572878495414554761852668688921913853872694356171.174
c:\documents and settings\David Peters\Recent\4824964279548173834866773444893183127256299215999693795564899538714579747882118728861563269537784413296782797886941682.527
c:\documents and settings\David Peters\Recent\492164576697274184972151363162657732474436397828465672931232998254168334521823988478637746345684635346851742194829794254116158431.684
c:\documents and settings\David Peters\Recent\493372378638136953636935693394725842513238458984953687274341377348884715899531111889375473979427915789313481849877386727421941531.874
c:\documents and settings\David Peters\Recent\518861842249434624547764763763788862497234494831885111993517381924816579841935556465243888665521528986567677648133143623291892738.476
c:\documents and settings\David Peters\Recent\546547477276535875193845245234921832454315544596684752513476869743179159254418547883911723654477392742389541798299799555733434248.467
c:\documents and settings\David Peters\Recent\5672542624686975255441941415198131991959648243491815691726216394463123957568298527263482318374916456897129831848125.788
c:\documents and settings\David Peters\Recent\573278356196437811493662825241813415849418167259131544619349353943581925967842828368385244527536859881782539826644255726281619585.648
c:\documents and settings\David Peters\Recent\58537699331313677521186274979412786857743737241663339414824132718583525943483485973287552614263311726755.729
c:\documents and settings\David Peters\Recent\624141795241699123818677874565437371587785783988117515172382697893423987927643415599568922591155266113695269362158987855777665423.552
c:\documents and settings\David Peters\Recent\624495334233527475954436496258676861684987919996959779235592159712267498858115582758177234264253144749494848142345617463414297844.738
c:\documents and settings\David Peters\Recent\627579841259948647514181896949721549461242899241145484543569157416687433286884967639776839791853416721255319182337845877631557989.853
c:\documents and settings\David Peters\Recent\663131167999452745368161366752124744994636926976777313781411179886455769242149724415921834234237164939565489139328487443883884679.943
c:\documents and settings\David Peters\Recent\678561943917175856295635593898348169877163276417213712952513856188778828755538388677217753561344323633175124498864654313449612533.448
c:\documents and settings\David Peters\Recent\761455155421158671932261649685949777732475583531551541281881745782596457224286644943924971833774235556947797264438933384431184339.411
c:\documents and settings\David Peters\Recent\845396493579987933923751876992339283367351395276932813532198636257969778557883852362452187238133557749152.111
c:\documents and settings\David Peters\Recent\963867649559211743785886387728762466452583381941877485546492754952938569768659453251979241247213837354694748217972234288413667679.983
c:\windows\twain_16.dll

.
((((((((((((((((((((((((( Files Created from 2010-12-07 to 2011-01-07 )))))))))))))))))))))))))))))))
.

2011-01-06 02:17 . 2011-01-06 02:17 -------- d-----w- C:\c4754b31f44a3c68e206b76bf0
2011-01-05 10:17 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{67DCB740-1211-400C-AF3A-0043B1ABBAB2}\mpengine.dll
2010-12-17 15:56 . 2010-12-17 15:56 -------- d-sh--w- c:\documents and settings\David Peters\IECompatCache
2010-12-15 19:29 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2004-08-10 19:02 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-15 06:27 . 2010-11-15 06:27 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2010-11-10 04:33 . 2010-10-23 23:41 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-06 00:26 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2004-08-10 18:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2004-08-10 18:51 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2004-08-10 18:51 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2004-08-10 18:50 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2004-08-10 18:51 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51 . 2010-10-22 22:58 222080 ------w- c:\windows\system32\MpSigStub.exe
2004-08-04 11:00 94784 -csh--w- c:\windows\twain.dll
2008-04-14 00:12 50688 -csh--w- c:\windows\twain_32.dll
2010-09-18 06:53 974848 --sha-w- c:\windows\system32\mfc42.dll
2008-04-14 00:12 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-04-14 00:12 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12 84992 --sh--w- c:\windows\system32\olepro32.dll
2008-04-14 00:12 11776 --sh--w- c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\DVDVideoSoft\tbDVD2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2005-07-20 77824]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"dellsupportcenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 15:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon "=c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
"MMTray "= "c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe "
"MimBoot "=c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"DVDLauncher "= "c:\program files\CyberLink\PowerDVD\DVDLauncher.exe "
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe "
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\StubInstaller.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\AIM\\aim.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/15/2009 1:07 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/18/2010 6:01 PM 28552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 1:50 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 1:49 PM 74480]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 1029456]
S2 gupdate1c9c3951be7f6a0;Google Update Service (gupdate1c9c3951be7f6a0);c:\program files\Google\Update\GoogleUpdate.exe [4/22/2009 4:55 PM 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 1:50 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2011-01-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 00:49]

2010-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2011-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 21:55]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 21:55]

2011-01-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:8074
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-06 20:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3352)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2011-01-06 21:02:35 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-07 02:02

Pre-Run: 48,647,213,056 bytes free
Post-Run: 48,152,043,520 bytes free

- - End Of File - - 32B11EED9A6CAB851C675134EEF9939E

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 01/06/2011 at 21:08:09.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

Rkill completed on 01/06/2011 at 21:08:14.

Thanks Again!

broni · 2011/01/06

I still need Bootkit Remover log.

dave1234 · 2011/01/06

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-06 19:21:13
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e Maxtor_6L080M0 rev.BANC1G10
Running: eflix8xy.exe; Driver: C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\ffdoapod.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF86D387E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF86D3BFE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Sorry, hope this works

dave1234 · 2011/01/06

.\debug.cpp(238) : Debug log started at 07.01.2011 - 01:19:45
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x804d7000 0x00228000 "\WINDOWS\system32\ntoskrnl.exe "
.\debug.cpp(256) : 0x806ff000 0x00020d00 "\WINDOWS\system32\hal.dll "
.\debug.cpp(256) : 0xf8b83000 0x00002000 "\WINDOWS\system32\KDCOM.DLL "
.\debug.cpp(256) : 0xf8a93000 0x00003000 "\WINDOWS\system32\BOOTVID.dll "
.\debug.cpp(256) : 0xf8634000 0x0002e000 "ACPI.sys "
.\debug.cpp(256) : 0xf8b85000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS "
.\debug.cpp(256) : 0xf8623000 0x00011000 "pci.sys "
.\debug.cpp(256) : 0xf8683000 0x0000a000 "isapnp.sys "
.\debug.cpp(256) : 0xf8c4b000 0x00001000 "pciide.sys "
.\debug.cpp(256) : 0xf8903000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS "
.\debug.cpp(256) : 0xf8693000 0x0000b000 "MountMgr.sys "
.\debug.cpp(256) : 0xf8604000 0x0001f000 "ftdisk.sys "
.\debug.cpp(256) : 0xf890b000 0x00005000 "PartMgr.sys "
.\debug.cpp(256) : 0xf86a3000 0x0000d000 "VolSnap.sys "
.\debug.cpp(256) : 0xf85ec000 0x00018000 "atapi.sys "
.\debug.cpp(256) : 0xf86b3000 0x00009000 "disk.sys "
.\debug.cpp(256) : 0xf86c3000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS "
.\debug.cpp(256) : 0xf85cc000 0x00020000 "fltmgr.sys "
.\debug.cpp(256) : 0xf85ba000 0x00012000 "sr.sys "
.\debug.cpp(256) : 0xf86d3000 0x0000f000 "Lbd.sys "
.\debug.cpp(256) : 0xf86e3000 0x00009000 "PxHelp20.sys "
.\debug.cpp(256) : 0xf85a3000 0x00017000 "KSecDD.sys "
.\debug.cpp(256) : 0xf8590000 0x00013000 "WudfPf.sys "
.\debug.cpp(256) : 0xf8503000 0x0008d000 "Ntfs.sys "
.\debug.cpp(256) : 0xf84d6000 0x0002d000 "NDIS.sys "
.\debug.cpp(256) : 0xf84bc000 0x0001a000 "Mup.sys "
.\debug.cpp(256) : 0xf843b000 0x00028000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys "
.\debug.cpp(256) : 0xf894b000 0x00006000 "\SystemRoot\system32\DRIVERS\usbuhci.sys "
.\debug.cpp(256) : 0xf8417000 0x00024000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS "
.\debug.cpp(256) : 0xf8953000 0x00008000 "\SystemRoot\system32\DRIVERS\usbehci.sys "
.\debug.cpp(256) : 0xf83f1000 0x00026000 "\SystemRoot\system32\DRIVERS\e100b325.sys "
.\debug.cpp(256) : 0xf8703000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys "
.\debug.cpp(256) : 0xf8713000 0x00010000 "\SystemRoot\system32\DRIVERS\cdrom.sys "
.\debug.cpp(256) : 0xf8723000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys "
.\debug.cpp(256) : 0xf83ce000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys "
.\debug.cpp(256) : 0xf896b000 0x00006000 "\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys "
.\debug.cpp(256) : 0xf8733000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys "
.\debug.cpp(256) : 0xf8b1f000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys "
.\debug.cpp(256) : 0xf83b7000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys "
.\debug.cpp(256) : 0xf8743000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys "
.\debug.cpp(256) : 0xf8753000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys "
.\debug.cpp(256) : 0xf898b000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS "
.\debug.cpp(256) : 0xf83a6000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys "
.\debug.cpp(256) : 0xf8763000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys "
.\debug.cpp(256) : 0xf899b000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys "
.\debug.cpp(256) : 0xf89ab000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys "
.\debug.cpp(256) : 0xf8773000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys "
.\debug.cpp(256) : 0xf89b3000 0x00006000 "\SystemRoot\system32\DRIVERS\kbdclass.sys "
.\debug.cpp(256) : 0xf89bb000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys "
.\debug.cpp(256) : 0xf8b8f000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys "
.\debug.cpp(256) : 0xf8348000 0x0005e000 "\SystemRoot\system32\DRIVERS\update.sys "
.\debug.cpp(256) : 0xf8b33000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys "
.\debug.cpp(256) : 0xf8783000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS "
.\debug.cpp(256) : 0xf8793000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys "
.\debug.cpp(256) : 0xf8b95000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS "
.\debug.cpp(256) : 0xf8b67000 0x00003000 "\SystemRoot\System32\Drivers\i2omgmt.SYS "
.\debug.cpp(256) : 0xf8b99000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS "
.\debug.cpp(256) : 0xf8c61000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS "
.\debug.cpp(256) : 0xf8b9d000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS "
.\debug.cpp(256) : 0xf89e3000 0x00006000 "\SystemRoot\System32\drivers\vga.sys "
.\debug.cpp(256) : 0xf830c000 0x00014000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS "
.\debug.cpp(256) : 0xf8ba1000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys "
.\debug.cpp(256) : 0xf89f3000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS "
.\debug.cpp(256) : 0xf8a03000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS "
.\debug.cpp(256) : 0xf8b73000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys "
.\debug.cpp(256) : 0xf82d9000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys "
.\debug.cpp(256) : 0xf8280000 0x00059000 "\SystemRoot\system32\DRIVERS\tcpip.sys "
.\debug.cpp(256) : 0xf8258000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys "
.\debug.cpp(256) : 0xf8232000 0x00026000 "\SystemRoot\system32\DRIVERS\ipnat.sys "
.\debug.cpp(256) : 0xf8210000 0x00022000 "\SystemRoot\System32\drivers\afd.sys "
.\debug.cpp(256) : 0xf87a3000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys "
.\debug.cpp(256) : 0xf81bd000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys "
.\debug.cpp(256) : 0xf814d000 0x00070000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys "
.\debug.cpp(256) : 0xf8463000 0x00003000 "\SystemRoot\system32\DRIVERS\hidusb.sys "
.\debug.cpp(256) : 0xf87d3000 0x00009000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS "
.\debug.cpp(256) : 0xf8a23000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS "
.\debug.cpp(256) : 0xf8b1b000 0x00003000 "\SystemRoot\system32\DRIVERS\mouhid.sys "
.\debug.cpp(256) : 0xf8a33000 0x00007000 "\SystemRoot\system32\DRIVERS\usbprint.sys "
.\debug.cpp(256) : 0xf8340000 0x00004000 "\SystemRoot\system32\DRIVERS\kbdhid.sys "
.\debug.cpp(256) : 0xf87e3000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS "
.\debug.cpp(256) : 0xf8095000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys "
.\debug.cpp(256) : 0xf8baf000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS "
.\debug.cpp(256) : 0xbf800000 0x001c5000 "\SystemRoot\System32\win32k.sys "
.\debug.cpp(256) : 0xf8b37000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys "
.\debug.cpp(256) : 0xf8a5b000 0x00005000 "\SystemRoot\System32\watchdog.sys "
.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys "
.\debug.cpp(256) : 0xf8d91000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys "
.\debug.cpp(256) : 0xbff50000 0x00003000 "\SystemRoot\System32\framebuf.dll "
.\debug.cpp(256) : 0xbffa0000 0x00047000 "\SystemRoot\System32\ATMFD.DLL "
.\debug.cpp(256) : 0xf7b49000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys "
.\debug.cpp(256) : 0xf791d000 0x00058000 "\SystemRoot\system32\DRIVERS\srv.sys "
.\debug.cpp(256) : 0xf7679000 0x00024000 "\SystemRoot\System32\Drivers\Fastfat.SYS "
.\debug.cpp(256) : 0xf8a8b000 0x00007000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS "
.\debug.cpp(256) : 0xf7481000 0x00018000 "\??\C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\ffdoapod.sys "
.\debug.cpp(256) : 0xf89a3000 0x00007000 "\??\C:\DOCUME~1\DAVIDP~1\LOCALS~1\Temp\mbr.sys "
.\debug.cpp(256) : 0x7c900000 0x000b2000 "\WINDOWS\system32\ntdll.dll "
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WUDFLpcDevice "
.\debug.cpp(400) : Destination "\Device\WUDFLpcDevice "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1 "
.\debug.cpp(400) : Destination "\Device\Video0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_413c&Pid_2005#5&9c01587&0&2#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-7 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS "
.\debug.cpp(400) : Destination "\Device\Ndis "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D: "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\0000003b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002d "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{CC0CA6FB-51B8-4ED4-89FC-80EDB99FFE7E} "
.\debug.cpp(400) : Destination "\Device\{CC0CA6FB-51B8-4ED4-89FC-80EDB99FFE7E} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&2e7b224f&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2 "
.\debug.cpp(400) : Destination "\Device\Video1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_03f0&Pid_6004#MY26R1M2VM2L#{28d78fad-5a12-11d1-ae5b-0000f803a8c2} "
.\debug.cpp(400) : Destination "\Device\USBPDO-6 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&14c69700&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip "
.\debug.cpp(400) : Destination "\Device\Ip "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002c "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27DC&SUBSYS_01AB1028&REV_01#4&5855be9&0&40F0#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev "
.\debug.cpp(400) : Destination "\Device\IPSEC "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{B5F4C6B0-76EB-4E30-9A0E-792716F90FD8} "
.\debug.cpp(400) : Destination "\Device\{B5F4C6B0-76EB-4E30-9A0E-792716F90FD8} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27C9&SUBSYS_01D21028&REV_01#3&172e68dd&0&E9#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0007 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice "
.\debug.cpp(400) : Destination "\Device\WMIDataDevice "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{DB319038-DAC1-40CE-91B3-B577DFF6945F} "
.\debug.cpp(400) : Destination "\Device\{DB319038-DAC1-40CE-91B3-B577DFF6945F} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a9d2782b-198b-11e0-966f-00123fb07423} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE "
.\debug.cpp(400) : Destination "\Device\NamedPipe "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Lbd "
.\debug.cpp(400) : Destination "\Device\Lbd "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice "
.\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched "
.\debug.cpp(400) : Destination "\Device\PSched "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27C8&SUBSYS_01D21028&REV_01#3&172e68dd&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0006 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT "
.\debug.cpp(400) : Destination "\Device\IPNAT "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC "
.\debug.cpp(400) : Destination "\Device\Mup "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\G: "
.\debug.cpp(400) : Destination "\Device\CdRom6 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg "
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0 "
.\debug.cpp(400) : Destination "\Device\USBFDO-0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&159e21c4&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-4 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\I2OExec "
.\debug.cpp(400) : Destination "\Device\I2OExec "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp "
.\debug.cpp(400) : Destination "\Device\Tcp "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{AA2EA78A-45E4-40BB-8533-75631664F7D4} "
.\debug.cpp(400) : Destination "\Device\{AA2EA78A-45E4-40BB-8533-75631664F7D4} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_08ec&Pid_0016#0DC0D6610232095D#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-10 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000031 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1 "
.\debug.cpp(400) : Destination "\Device\USBFDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_03f0&Pid_6004#MY26R1M2VM2L#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-6 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0 "
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000030 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2 "
.\debug.cpp(400) : Destination "\Device\USBFDO-2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN "
.\debug.cpp(400) : Destination "\DosDevices\LPT1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\H: "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0 "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD3 "
.\debug.cpp(400) : Destination "\Device\USBFDO-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap "
.\debug.cpp(400) : Destination "\Device\FsWrap "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1 "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DR14 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_CDRW#DVD_CRX330E___________________MDK3____#3032353038303033303031303532333720202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T1L0-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\INTELPRO_{AA2EA78A-45E4-40BB-8533-75631664F7D4} "
.\debug.cpp(400) : Destination "\Device\INTELPRO_{AA2EA78A-45E4-40BB-8533-75631664F7D4} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD4 "
.\debug.cpp(400) : Destination "\Device\USBFDO-4 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{9acfd0b4-5525-11da-a8b5-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#CdRom&Ven_Memorex&Prod_Mini_TravelDrive&Rev_6.17#0DC0D6610232095D&1#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\0000006a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureD0F4738COffset2738A00Length11DD30E000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857} "
.\debug.cpp(400) : Destination "\Device\00000041 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global "
.\debug.cpp(400) : Destination "\GLOBAL?? "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{560B6ABD-EDE8-41DE-9351-327521EFA423} "
.\debug.cpp(400) : Destination "\Device\{560B6ABD-EDE8-41DE-9351-327521EFA423} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskMaxtor_6L080M0__________________________BANC1G10#324c59305346474820202020324c593053464748#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#CdRom&Ven_Memorex&Prod_Mini_TravelDrive&Rev_6.17#0DC0D6610232095D&1#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\0000006a "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{B51E43FB-660A-4ADC-B5A8-F4898BDC32DE} "
.\debug.cpp(400) : Destination "\Device\{B51E43FB-660A-4ADC-B5A8-F4898BDC32DE} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&a8b173&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom6 "
.\debug.cpp(400) : Destination "\Device\CdRom6 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&3b6bf0b6&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} "
.\debug.cpp(400) : Destination "\Device\USBPDO-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_CDRW#DVD_CRX330E___________________MDK3____#3032353038303033303031303532333720202020#{53f56308-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T1L0-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager "
.\debug.cpp(400) : Destination "\Device\MountPointManager "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CB&SUBSYS_01D21028&REV_01#3&172e68dd&0&EB#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0009 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&3b7ed56&0&RM#{53f5630a-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000002 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{BE656344-CB99-4D79-B2DC-D43D55293D96} "
.\debug.cpp(400) : Destination "\Device\{BE656344-CB99-4D79-B2DC-D43D55293D96} "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2005#6&2c7ce6df&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\0000005b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a9d2782a-198b-11e0-966f-00123fb07423} "
.\debug.cpp(400) : Destination "\Device\CdRom6 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP "
.\debug.cpp(400) : Destination "\Device\NdisWanIp "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ffdoapod "
.\debug.cpp(400) : Destination "\Device\ffdoapod "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{9acfd0b5-5525-11da-a8b5-806d6172696f} "
.\debug.cpp(400) : Destination "\Device\CdRom0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_CDRW#DVD_CRX330E___________________MDK3____#3032353038303033303031303532333720202020#{1186654d-47b8-48b9-beb9-7df113ae3c67} "
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T1L0-3 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1 "
.\debug.cpp(400) : Destination "\Device\ParTechInc0 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c} "
.\debug.cpp(400) : Destination "\Device\0000002e "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_2005#6&2c7ce6df&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\0000005b "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#RemovableMedia#7&3b7ed56&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\Harddisk1\DP(1)0-0+f "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2 "
.\debug.cpp(400) : Destination "\Device\ParTechInc1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan "
.\debug.cpp(400) : Destination "\Device\NdisWan "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407} "
.\debug.cpp(400) : Destination "\Device\00000036 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST "
.\debug.cpp(400) : Destination "\Device\IPMULTICAST "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_3200#6&117c1427&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000059 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3 "
.\debug.cpp(400) : Destination "\Device\ParTechInc2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow "
.\debug.cpp(400) : Destination "\Device\LanmanRedirector "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl "
.\debug.cpp(400) : Destination "\Device\FtControl "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr "
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Memorex&Prod_Mini_TravelDrive&Rev_6.17#0DC0D6610232095D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} "
.\debug.cpp(400) : Destination "\Device\00000069 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C: "
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX "
.\debug.cpp(400) : Destination "\DosDevices\COM1 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT "
.\debug.cpp(400) : Destination "\Device\MailSlot "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mbr "
.\debug.cpp(400) : Destination "\Device\mbr "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT "
.\debug.cpp(400) : Destination " "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CC&SUBSYS_01D21028&REV_01#3&172e68dd&0&EF#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0010 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2: "
.\debug.cpp(400) : Destination "\Device\Ide\IdePort2 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#Vid_413c&Pid_3200#5&2e32ec62&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed} "
.\debug.cpp(400) : Destination "\Device\USBPDO-5 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000035 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio "
.\debug.cpp(400) : Destination "\Device\Ndisuio "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL "
.\debug.cpp(400) : Destination "\Device\Null "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_27CA&SUBSYS_01D21028&REV_01#3&172e68dd&0&EA#{3abf6f2d-71c4-462a-8a92-1e6861e6af27} "
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0008 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#Vid_413c&Pid_3200#6&117c1427&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030} "
.\debug.cpp(400) : Destination "\Device\00000059 "
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd} "
.\debug.cpp(400) : Destination "\Device\00000034 "
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************
.\boot_cleaner.cpp(565) : System volume is \\.\C:
.\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`02738a00
.\boot_cleaner.cpp(276) : Boot sector MD5 is: e7e6f498a5aad54bc8d066e2192a8456
.\boot_cleaner.cpp(1060) :
.\boot_cleaner.cpp(1061) : Size Device Name MBR Status
.\boot_cleaner.cpp(1062) : --------------------------------------------
.\boot_cleaner.cpp(1106) : 74 GB \\.\PhysicalDrive0 Unknown boot code
.\boot_cleaner.cpp(1112) :
.\boot_cleaner.cpp(1118) : Unknown boot code has been found on some of your physical disks.
.\boot_cleaner.cpp(1120) : To inspect the boot code manually, dump the master boot sector:
.\boot_cleaner.cpp(1121) : remover.exe dump <device_name> [output_file]
.\boot_cleaner.cpp(1125) : To disinfect the master boot sector, use the following command:
.\boot_cleaner.cpp(1126) : remover.exe fix <device_name>
.\boot_cleaner.cpp(1129) :
.\boot_cleaner.cpp(1151) : Done;

Is this it? Thank you again for all your help

broni · 2011/01/06

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
DDS::
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:8074
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

dave1234 · 2011/01/06

Log

ComboFix 11-01-06.03 - David Peters 01/06/2011 21:47:41.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.271 [GMT -5:00]
Running from: H:\ComboFix.exe
Command switches used :: H:\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((( Files Created from 2010-12-07 to 2011-01-07 )))))))))))))))))))))))))))))))
.

2011-01-07 02:08 . 2011-01-07 02:08 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-01-06 02:17 . 2011-01-06 02:17 -------- d-----w- C:\c4754b31f44a3c68e206b76bf0
2011-01-05 10:17 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{67DCB740-1211-400C-AF3A-0043B1ABBAB2}\mpengine.dll
2010-12-17 15:56 . 2010-12-17 15:56 -------- d-sh--w- c:\documents and settings\David Peters\IECompatCache
2010-12-15 19:29 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2004-08-10 19:02 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-15 06:27 . 2010-11-15 06:27 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2010-11-10 04:33 . 2010-10-23 23:41 6273872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-06 00:26 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2004-08-10 18:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2004-08-10 18:51 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2004-08-10 18:51 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2004-08-10 18:50 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2004-08-10 18:51 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51 . 2010-10-22 22:58 222080 ------w- c:\windows\system32\MpSigStub.exe
2004-08-04 11:00 94784 -csh--w- c:\windows\twain.dll
2008-04-14 00:12 50688 -csh--w- c:\windows\twain_32.dll
2010-09-18 06:53 974848 --sha-w- c:\windows\system32\mfc42.dll
2008-04-14 00:12 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-04-14 00:12 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12 11776 --sh--w- c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\DVDVideoSoft\tbDVD2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} "= "c:\program files\DVDVideoSoft\tbDVD2.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2005-07-20 77824]
"MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"dellsupportcenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 15:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon "=c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
"MMTray "= "c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe "
"MimBoot "=c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"DVDLauncher "= "c:\program files\CyberLink\PowerDVD\DVDLauncher.exe "
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe "
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\StubInstaller.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\AIM\\aim.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/15/2009 1:07 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/18/2010 6:01 PM 28552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 1:50 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 1:49 PM 74480]
S2 gupdate1c9c3951be7f6a0;Google Update Service (gupdate1c9c3951be7f6a0);c:\program files\Google\Update\GoogleUpdate.exe [4/22/2009 4:55 PM 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 4:34 PM 1029456]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 1:50 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2011-01-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 00:49]

2010-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2011-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 21:55]

2011-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 21:55]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-06 21:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3088)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-06 21:58:07
ComboFix-quarantined-files.txt 2011-01-07 02:58
ComboFix2.txt 2011-01-07 02:02

Pre-Run: 48,150,831,104 bytes free
Post-Run: 48,136,802,304 bytes free

- - End Of File - - 63F2DC28C32E42EA9B04994E2E4880B2

broni · 2011/01/06

Good job

Now, we have to fix your MBR.

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

Place a blank CD in your CD drive.

Double click on NTBR_CD.exe file and a folder of the same name will appear.

Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.

Follow the prompts to burn the CD.

Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)

If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

Insert the newly created CD into your infected PC and reboot your computer.

Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!

Read the warning and then continue as prompted.

You first need to select your keyboard layout - press Enter for English.

Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK

On the following screen enter 5 to select Install Standard MBR code.

Enter 1 to overwrite the infected MBR Code with the Standard MBR code.

When asked to confirm please do so.

Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.

Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, run MBRCheck again and post its log.

**Important note to Dell users - fixing the MBR may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. If this is Dell computer, let me know before proceeding.

dave1234 · 2011/01/06

Broni,

Having issues opening the NTBR_CD file that I transferred to the desktop. Also, my computer is a Dell computer. Is this the reason?

broni · 2011/01/06

OK. We'll leave it for now...

How is computer doing at the moment?
Click to expand...

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

dave1234 · 2011/01/06

Log 1 OTL

OTL logfile created on: 1/6/2011 11:05:01 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = H:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 152.00 Mb Available Physical Memory | 30.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 44.85 Gb Free Space | 62.77% Space Free | Partition Type: NTFS
Drive G: | 4.04 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 482.24 Mb Total Space | 403.95 Mb Free Space | 83.76% Space Free | Partition Type: FAT

Computer Name: D124YR81 | User Name: David Peters | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/06 22:56:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- H:\OTL.exe
PRC - [2010/09/15 03:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/01/06 22:56:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- H:\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/03/01 19:49:33 | 001,029,456 | ---- | M] (Lavasoft) [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/09/23 15:36:06 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2005/10/28 18:59:30 | 000,027,648 | ---- | M] (Acesoft) [On_Demand | Stopped] -- C:\Program Files\Acesoft\Tracks Eraser Pro\delautocomp.exe -- (Autocomplete)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2009/09/04 13:50:02 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/09/04 13:50:00 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/09/04 13:49:58 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/06/30 08:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\pavboot.sys -- (pavboot)
DRV - [2009/04/26 13:26:35 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005/06/14 23:40:08 | 000,180,864 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) High Definition Audio Driver (WDM)
DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2009/02/16 10:48:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Peters\Application Data\Mozilla\Extensions
[2009/02/16 10:48:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Peters\Application Data\Mozilla\Extensions\mozswing@mozswing.org

O1 HOSTS File: ([2011/01/06 20:42:15 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files\DVDVideoSoft\tbDVD2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_18.dll (Sun Microsystems, Inc.)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.photogize.com/bponet/PhotogizeImageUploader4.cab (Image Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} http://download.abacast.com/download/files/abasetup162.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\David Peters\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\David Peters\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005/12/25 10:16:26 | 000,000,145 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/06 22:41:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Peters\Desktop\NTBR_CD
[2011/01/06 22:41:16 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/01/06 21:08:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2011/01/06 20:31:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/01/06 20:22:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/01/06 20:22:37 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/01/06 20:22:37 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/01/06 20:22:37 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/01/06 20:22:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/01/05 21:17:03 | 000,000,000 | ---D | C] -- C:\c4754b31f44a3c68e206b76bf0
[2010/12/17 10:56:29 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\David Peters\IECompatCache
[2010/12/14 06:40:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Peters\My Documents\New Folder
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/06 23:04:05 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/06 22:30:58 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\David Peters\Desktop\NTBR_CD.exe
[2011/01/06 20:47:44 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/01/06 20:42:15 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/06 20:41:49 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/06 20:41:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/01/06 20:41:21 | 526,536,704 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/05 06:54:53 | 000,173,568 | ---- | M] () -- C:\Documents and Settings\David Peters\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/03 13:07:44 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/12/28 20:19:44 | 000,017,815 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\Citibank Online - Check Image.htm
[2010/12/24 21:13:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/20 21:49:28 | 000,073,274 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\JetBlue Itinerary.htm
[2010/12/16 04:54:27 | 000,406,304 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/15 21:58:47 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/06 22:41:09 | 002,565,432 | ---- | C] () -- C:\Documents and Settings\David Peters\Desktop\NTBR_CD.exe
[2011/01/06 20:41:21 | 526,536,704 | -HS- | C] () -- C:\hiberfil.sys
[2011/01/06 20:22:37 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/01/06 20:22:37 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/01/06 20:22:37 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/12/28 20:19:44 | 000,017,815 | ---- | C] () -- C:\Documents and Settings\David Peters\My Documents\Citibank Online - Check Image.htm
[2010/12/20 21:49:28 | 000,073,274 | ---- | C] () -- C:\Documents and Settings\David Peters\My Documents\JetBlue Itinerary.htm
[2010/03/21 19:21:18 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\David Peters\Local Settings\Application Data\housecall.guid.cache
[2008/12/20 15:21:30 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\PreferencePane
[2008/12/20 15:21:30 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\David Peters\Application Data\Plugins
[2008/12/20 15:21:30 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2006/09/08 05:44:46 | 000,000,249 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/14 20:37:51 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2006/03/11 12:54:32 | 000,215,535 | ---- | C] () -- C:\Program Files\hijackthis.zip
[2006/02/05 12:42:26 | 000,001,682 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/01/25 11:44:40 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2006/01/25 11:44:40 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/01/25 11:44:40 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2006/01/25 11:44:40 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2006/01/25 11:44:40 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2006/01/10 20:11:35 | 000,001,759 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/06 11:34:58 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2006/01/05 17:03:41 | 000,000,048 | ---- | C] () -- C:\WINDOWS\VistaEmail.ini
[2005/12/30 09:51:01 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\ldf252.dll
[2005/11/24 08:26:48 | 000,173,568 | ---- | C] () -- C:\Documents and Settings\David Peters\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/11/19 06:47:40 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2005/11/14 10:58:33 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\David Peters\Application Data\PFP120JPR.{PB
[2005/11/14 10:58:33 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\David Peters\Application Data\PFP120JCM.{PB
[2005/11/02 03:40:57 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/11/02 03:32:53 | 000,000,138 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/11/02 03:08:08 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/04/09 18:04:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/10 14:12:05 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 14:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2009/09/11 19:46:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA-SupportBridge
[2008/12/20 15:21:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2010/03/18 18:08:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\F-Secure
[2005/11/24 13:20:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal
[2008/03/05 05:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2008/12/20 15:22:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2010/10/22 19:29:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ReviverSoft
[2008/02/01 05:32:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2008/12/20 15:21:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2005/11/02 03:31:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/10/19 17:01:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZipSE
[2009/11/06 08:47:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/02/15 13:06:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2005/12/30 09:55:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\ACD Systems
[2008/04/06 09:51:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\ACDInTouch
[2005/11/14 11:19:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\Aim
[2010/01/06 05:38:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\GetRightToGo
[2010/12/16 19:01:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\Gevesu
[2009/11/14 08:30:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\GlarySoft
[2005/11/14 11:02:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\Leadertech
[2008/12/20 15:24:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\Nikon
[2010/10/21 05:42:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\OpenCandy
[2010/12/09 07:40:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David Peters\Application Data\Xosyi
[2011/01/03 13:07:44 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/01/06 20:41:17 | 000,222,201 | ---- | M] () -- C:\aaw7boot.log
[2009/02/15 13:04:37 | 034,543,112 | ---- | M] (Lavasoft ) -- C:\Ad-AwareAE.exe
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/26 05:12:01 | 000,891,208 | ---- | M] (AVG Technologies) -- C:\avg_free_stb_en_9_40.exe
[2009/08/30 05:15:42 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/03/21 07:06:16 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2011/01/06 21:58:08 | 000,010,633 | ---- | M] () -- C:\ComboFix.txt
[2004/08/10 14:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2005/11/02 21:06:56 | 000,004,604 | ---- | M] () -- C:\data
[2005/11/02 03:11:20 | 000,005,040 | RH-- | M] () -- C:\dell.sdr
[2006/01/06 03:19:41 | 004,193,599 | ---- | M] () -- C:\EasyShare.dmp
[2006/03/11 18:06:29 | 007,984,736 | ---- | M] () -- C:\ewido-setup.exe
[2006/03/12 16:49:17 | 000,167,608 | ---- | M] (Symantec Corporation) -- C:\FxIstbar.exe
[2011/01/06 20:41:21 | 526,536,704 | -HS- | M] () -- C:\hiberfil.sys
[2006/03/12 16:47:59 | 000,218,112 | ---- | M] (Soeperman Enterprises Ltd.) -- C:\HijackThis.exe
[2009/09/12 15:55:48 | 000,010,301 | ---- | M] () -- C:\hijackthis.log
[2011/01/01 21:25:21 | 000,243,390 | ---- | M] () -- C:\hpfr5550.log
[2005/11/28 19:17:24 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2005/11/02 03:31:11 | 000,000,826 | -H-- | M] () -- C:\IPH.PH
[2009/10/16 12:30:11 | 000,155,822 | ---- | M] () -- C:\iPod_log.txt
[2010/12/25 16:50:33 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2004/08/10 14:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/01/10 11:04:15 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/01/06 20:41:19 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys
[2011/01/06 21:08:14 | 000,000,359 | ---- | M] () -- C:\rkill.log
[2005/10/31 10:56:00 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe
[2009/09/13 08:12:51 | 000,001,637 | ---- | M] () -- C:\swlist.reg
[2005/11/02 03:31:19 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
[2009/01/10 10:36:22 | 000,267,152 | ---- | M] () -- C:\zaSetup_en.exe

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/03/30 09:09:39 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2007/03/06 06:27:44 | 000,215,535 | ---- | M] () -- C:\Program Files\hijackthis.zip

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 13:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 13:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 13:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/01/10 11:14:25 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/30 09:14:22 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\David Peters\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 14:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\David Peters\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2005/11/18 19:17:51 | 002,855,080 | ---- | M] () -- C:\Documents and Settings\David Peters\Desktop\aawsepersonal.exe
[2010/03/16 20:51:54 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\David Peters\Desktop\ATF-Cleaner.exe
[2009/09/28 05:52:22 | 003,321,356 | ---- | M] () -- C:\Documents and Settings\David Peters\Desktop\c7yu45hg.exe
[2005/11/20 21:20:51 | 000,532,480 | ---- | M] (Trend Micro Incorporated) -- C:\Documents and Settings\David Peters\Desktop\cwshredder.exe
[2009/09/13 18:14:04 | 017,300,368 | ---- | M] (Doctor Web, Ltd.) -- C:\Documents and Settings\David Peters\Desktop\drweb-cureit.exe
[2010/07/21 20:20:24 | 013,077,024 | ---- | M] (DVDVideoSoft Limited. ) -- C:\Documents and Settings\David Peters\Desktop\FreeAudioConverter.exe
[2010/03/21 19:20:50 | 002,180,256 | ---- | M] (Trend Micro) -- C:\Documents and Settings\David Peters\Desktop\HousecallLauncher64.exe
[2010/01/27 19:15:39 | 000,919,840 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\David Peters\Desktop\JavaSetup6u18-rv.exe
[2009/09/14 22:20:44 | 016,664,352 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\David Peters\Desktop\jre-6u16-windows-i586.exe
[2010/03/16 20:57:57 | 000,924,448 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\David Peters\Desktop\jre-6u18-windows-i586-iftw-rv.exe
[2010/01/28 19:34:04 | 012,143,936 | ---- | M] (DVDVideoSoft Limited. ) -- C:\Documents and Settings\David Peters\Desktop\Mp3Converter.exe
[2010/10/22 17:39:16 | 013,063,352 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\David Peters\Desktop\mssefullinstall-x86fre-en-us-xp.exe
[2011/01/06 22:30:58 | 002,565,432 | ---- | M] () -- C:\Documents and Settings\David Peters\Desktop\NTBR_CD.exe
[2010/10/21 05:40:56 | 002,762,359 | ---- | M] (Topala Software Solutions ) -- C:\Documents and Settings\David Peters\Desktop\siw-setup.exe
[2004/08/04 06:00:00 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\David Peters\Desktop\taskmgr.exe
[2009/09/22 20:18:36 | 000,271,872 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Peters\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2009/04/11 07:32:08 | 000,939,956 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\7z465.exe
[2008/04/06 09:51:05 | 012,962,050 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\acdsee31updater.exe
[2009/04/02 05:28:38 | 102,612,888 | ---- | M] (Macrovision Corporation) -- C:\Documents and Settings\David Peters\My Documents\CVSPhotoEditorPlus_120.exe
[2008/05/18 16:14:01 | 003,309,160 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\eMule0.49a-Installer1.exe
[2009/11/14 08:28:54 | 002,308,608 | ---- | M] (GlarySoft.com ) -- C:\Documents and Settings\David Peters\My Documents\qssetup.exe
[2008/01/28 05:47:16 | 000,325,168 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\David Peters\My Documents\RealPlayer11GOLD.exe
[2008/04/12 08:10:40 | 001,639,504 | ---- | M] (Acesoft, Inc. ) -- C:\Documents and Settings\David Peters\My Documents\te5.exe
[2008/10/19 15:48:05 | 000,195,663 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\unrarw32.exe
[2010/03/28 19:05:05 | 008,287,608 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\View22_Install_3_10_50.exe
[2008/10/19 17:01:21 | 002,131,320 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\wzipse31.exe
[2009/09/01 12:08:29 | 000,366,552 | ---- | M] (Digital River, Inc.) -- C:\Documents and Settings\David Peters\My Documents\X12-30263-DLM.exe
[2007/04/22 06:03:54 | 040,738,456 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\zlsSetup_70_337_000_en.exe
[2007/11/17 10:27:23 | 041,412,496 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\zlsSetup_70_408_000_en.exe
[2008/03/05 05:37:38 | 041,724,304 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\zlsSetup_70_462_000_en.exe
[2008/07/11 19:50:55 | 046,829,456 | ---- | M] () -- C:\Documents and Settings\David Peters\My Documents\zlsSetup_70_483_000_en.exe

< %USERPROFILE%\*.exe >
[2005/11/20 22:02:07 | 000,557,056 | ---- | M] (Citrix Online) -- C:\Documents and Settings\David Peters\chatlnk.exe
[2005/11/18 10:19:36 | 000,000,128 | ---- | M] () -- C:\Documents and Settings\David Peters\zzz.exe

< %systemroot%\ADDINS\*.* >
[2004/08/04 06:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/03/30 09:14:22 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\David Peters\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/01/06 21:57:16 | 004,112,384 | -HS- | M] () -- C:\Documents and Settings\David Peters\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2004/08/04 02:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2004/08/04 02:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2004/08/04 02:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2004/08/04 02:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2004/08/04 02:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2004/08/04 02:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/08/04 02:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

dave1234 · 2011/01/06

Log 2 Extras

OTL Extras logfile created on: 1/6/2011 11:05:01 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = H:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 152.00 Mb Available Physical Memory | 30.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 44.85 Gb Free Space | 62.77% Space Free | Partition Type: NTFS
Drive G: | 4.04 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 482.24 Mb Total Space | 403.95 Mb Free Space | 83.76% Space Free | Partition Type: FAT

Computer Name: D124YR81 | User Name: David Peters | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Shred With Tracks Eraser Pro] -- C:\Program Files\Acesoft\Tracks Eraser Pro\fileshred.exe %1 (Acesoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" =
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -- (LimeWire)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0D048BE8-AE02-4CB5-A428-616B9848E4A7}" = BlackBerry Desktop Software 4.3
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = Qualxserve Service Agreement
"{14374619-0900-4056-BA06-C87C900AF9E6}" = QuickBooks Simple Start Special Edition
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5EED93A8-33AD-46A7-A6AC-4DEAFBEFEEE1}" = Roxio Media Manager
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{748F4870-8350-11D3-B0BF-080009FB4A19}" = HP Share-to-Web
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel(R) PROSet for Wired Connections
"{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.07.14
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{B702CCCE-3176-4DBF-B932-D1B8F402F330}" = Digital Content Portal
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"7-Zip" = 7-Zip 4.65
"Abacast Client" = Abacast Client
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AdsGone_is1" = AdsGone Popup Killer Spyware Blocker by A1Tech.com
"AOL Instant Messenger" = AOL Instant Messenger
"BlackBerry_{0D048BE8-AE02-4CB5-A428-616B9848E4A7}" = BlackBerry Desktop Software 4.3
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Cucusoft iPod Movie/Video Converter_is1" = Cucusoft iPod Movie/Video Converter 2.00
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"ESET Online Scanner" = ESET Online Scanner v3
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"HijackThis" = HijackThis 1.99.1
"hp deskjet 5550 series" = hp deskjet 5550 series (Remove only)
"hp deskjet 5550 series_Driver" = hp deskjet 5550 series
"HP Photo Imaging Software" = HP Photo Imaging Software
"HP Photo Printing Software" = HP Photo Printing Software
"hp print screen utility" = hp print screen utility
"ie8" = Windows Internet Explorer 8
"InstallShield_{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"LimeWire" = LimeWire 5.4.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Photo Viewer_is1" = Photo Viewer 2.4
"PROSet" = Intel(R) PRO Network Connections Drivers
"Quick Startup_is1" = Quick Startup 2.7.0.686
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.3
"Tracks Eraser Pro_is1" = Tracks Eraser Pro v7.0
"Uninstall_is1" = Uninstall 1.0.0.1
"View22" = View22
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip Self-Extractor" = WinZip Self-Extractor
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Options 360â„¢" = Options 360â„¢

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/12/2010 1:40:44 PM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/13/2010 6:02:33 AM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/13/2010 11:43:26 PM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/14/2010 6:38:26 AM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/14/2010 7:24:45 PM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/15/2010 6:21:02 AM | Computer Name = D124YR81 | Source = Application Error | ID = 1000
Description = Faulting application yvuxe.exe, version 10.2.0.15, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

Error - 12/18/2010 6:37:51 AM | Computer Name = D124YR81 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.6402.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 12/19/2010 2:09:18 PM | Computer Name = D124YR81 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 12/30/2010 12:37:38 PM | Computer Name = D124YR81 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 2152759308, P2 unspecified, P3 scanfile,
P4 2.1.6805.0, P5 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 1/6/2011 10:08:55 PM | Computer Name = D124YR81 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 1/6/2011 7:55:42 AM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 8:11:10 AM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 8:11:34 AM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 8:12:57 AM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 8:17:04 AM | Computer Name = D124YR81 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 1/6/2011 8:17:50 PM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 8:23:20 PM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 9:13:43 PM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/6/2011 9:32:18 PM | Computer Name = D124YR81 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/6/2011 10:08:54 PM | Computer Name = D124YR81 | Source = Microsoft Antimalware | ID = 2001
Description = %%861 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.95.3262.0 Update Source: %%859 Update Stage:
%%852 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6402.0 Error
code: 0x8024402c Error description: An unexpected problem occurred while checking
for updates. For information on installing or troubleshooting updates, see Help
and Support.

< End of report >

Log in or Sign up

Solved Malicious software EXE file

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

Admin. Administrator Administrator Staff

dave1234 Well-Known Member Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

dave1234 Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved Malicious software EXE file

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

Admin. Administrator Administrator Staff

dave1234 Well-Known Member Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

broni Moderator Malware Analyst

dave1234 Well-Known Member Thread Starter

dave1234 Well-Known Member Thread Starter

Share This Page

Useful Searches