Solved Can't remove Google redirect virus

[Resolved] Can't remove Google redirect virus

Here is the combofix log:

ComboFix 11-03-15.03 - Robert 03/16/2011 11:31:11.8.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1021.619 [GMT -5:00]
Running from: c:\users\Robert\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-02-16 to 2011-03-16 )))))))))))))))))))))))))))))))
.
.
2011-03-16 16:34 . 2011-03-16 16:34 -------- d-----w- c:\users\Robert\AppData\Local\temp
2011-03-16 16:34 . 2011-03-16 16:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-16 16:34 . 2011-03-16 16:34 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-03-14 18:46 . 2011-02-03 12:04 139768 ----a-w- c:\windows\system32\drivers\dwprot.sys
2011-03-14 18:46 . 2011-01-26 09:45 93944 ----a-w- c:\windows\system32\drivers\spiderg3.sys
2011-03-14 18:46 . 2011-03-14 18:46 -------- d-----w- c:\programdata\Doctor Web
2011-03-14 18:46 . 2011-03-15 22:33 -------- d-----w- c:\program files\DrWeb
2011-03-14 18:46 . 2011-03-14 18:46 -------- d-----w- c:\program files\Common Files\Doctor Web
2011-03-09 22:11 . 2011-03-09 22:11 -------- d-----w- c:\program files\ESET
2011-03-09 21:48 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 21:48 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-09 21:48 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 21:48 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 21:48 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 21:48 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-03-08 21:21 . 2011-03-08 21:21 -------- d-----w- c:\users\Robert\AppData\Roaming\Malwarebytes
2011-03-08 21:21 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-08 21:21 . 2011-03-15 16:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-08 21:21 . 2011-03-08 21:21 -------- d-----w- c:\programdata\Malwarebytes
2011-03-08 21:21 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-08 17:27 . 2011-03-08 17:27 -------- d-----w- c:\users\Robert\AppData\Roaming\Windows Live Writer
2011-03-08 17:27 . 2011-03-08 17:27 -------- d-----w- c:\users\Robert\AppData\Local\Windows Live Writer
2011-03-07 23:12 . 2011-03-15 15:05 -------- d-----w- c:\users\Robert\DoctorWeb
2011-03-07 22:56 . 2011-03-07 22:56 -------- d-----w- c:\program files\CCleaner
2011-03-07 22:30 . 2011-03-07 22:30 -------- d-----w- c:\program files\Common Files\Java
2011-03-07 20:38 . 2011-03-07 20:38 -------- d-----w- c:\users\Robert\AppData\Roaming\SUPERAntiSpyware.com
2011-03-07 20:38 . 2011-03-07 20:38 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-02-28 18:26 . 2011-02-28 18:26 52736 --sha-r- c:\users\Robert\AppData\Roaming\dxdiago.dll
2011-02-27 06:34 . 2011-02-27 06:34 -------- d-----w- c:\windows\Speeditup Free
2011-02-27 06:33 . 2011-02-27 06:33 9216 ----a-r- c:\users\Robert\AppData\Roaming\Microsoft\Installer\{7426428E-71D4-452C-BA13-B14E5EB52859}\Icon7426428E16.exe
2011-02-27 06:33 . 2011-02-27 06:33 -------- d-----w- c:\program files\AWS
2011-02-23 20:16 . 2011-02-28 17:40 -------- d-----w- c:\users\Robert\AppData\Local\Tific
2011-02-23 20:16 . 2011-02-23 20:16 -------- d-----w- c:\users\Robert\AppData\Roaming\Tific
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-08 21:11 . 2010-06-24 17:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-03 03:40 . 2011-01-25 17:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 16:37 . 2011-02-09 12:20 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 12:20 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 12:20 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 12:20 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08 . 2011-02-09 12:20 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 12:20 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07 . 2011-02-09 12:20 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 12:20 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 12:20 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 12:20 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 12:20 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 12:20 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 12:20 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 12:20 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 12:20 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 12:20 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 12:20 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 12:20 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24 . 2011-02-09 12:20 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 12:20 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 12:20 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 12:20 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14 . 2011-02-09 12:20 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12 . 2011-02-09 12:20 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 12:20 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 12:20 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-20 13:44 . 2011-02-09 12:20 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-01-20 13:44 . 2011-02-09 12:20 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-01-13 09:41 . 2011-02-11 07:49 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E6D90D74-4052-45DA-8479-239B9C858584}\mpengine.dll
2011-01-08 08:47 . 2011-02-09 12:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 12:20 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:57 . 2011-02-09 12:20 2039808 ----a-w- c:\windows\system32\win32k.sys
2010-12-28 15:55 . 2011-01-19 19:34 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-18 06:27 . 2011-02-09 12:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-18 06:22 . 2011-02-09 12:20 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-18 06:22 . 2011-02-09 12:20 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-18 06:22 . 2011-02-09 12:20 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-12-18 06:22 . 2011-02-09 12:20 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-12-18 05:25 . 2011-02-09 12:20 385024 ----a-w- c:\windows\system32\html.iec
2010-12-18 04:48 . 2011-02-09 12:20 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-12-18 04:47 . 2011-02-09 12:20 1638912 ----a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((( SnapShot_2011-03-14_16.58.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2011-03-15 15:07 36838 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2011-03-15 15:07 56916 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2011-01-06 21:02 . 2011-03-10 19:47 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-01-06 21:02 . 2011-03-15 15:46 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-01-06 21:02 . 2011-03-15 15:46 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-01-06 21:02 . 2011-03-10 19:47 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-01-06 21:02 . 2011-03-10 19:47 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-01-06 21:02 . 2011-03-15 15:46 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-01-19 19:48 . 2011-03-10 22:18 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-01-19 19:48 . 2011-03-15 15:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-01-19 19:48 . 2011-03-10 22:18 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-01-19 19:48 . 2011-03-15 15:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-03-14 18:46 . 2011-03-14 18:46 32038 c:\windows\Installer\{3B5661DA-C3BA-4FAA-AC8C-C6EF02729670}\ARPPRODUCTICON.exe
+ 2011-01-06 21:44 . 2011-03-15 15:07 7370 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2129897722-2078608623-2969488967-1000_UserData.bin
- 2011-03-14 16:52 . 2011-03-14 16:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-03-15 17:09 . 2011-03-15 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-03-15 17:09 . 2011-03-15 17:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-03-14 16:52 . 2011-03-14 16:52 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2011-03-15 17:15 606420 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2011-03-14 16:57 606420 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2011-03-14 16:57 104430 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2011-03-15 17:15 104430 c:\windows\System32\perfc009.dat
- 2011-01-19 22:19 . 2011-03-10 19:47 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-01-19 22:19 . 2011-03-15 15:38 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2011-02-13 08:54 . 2011-03-10 22:31 252892 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-13 08:54 . 2011-03-15 16:12 252892 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-03-14 18:46 . 2011-03-14 18:46 3716608 c:\windows\Installer\5cf03.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"WindowsWelcomeCenter "= "oobefldr.dll" [2009-04-11 2153472]
"WeatherBugAlert "= "c:\program files\AWS\WeatherBug Alert\WeatherBugAlert.exe" [2010-02-22 442368]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"SBQM "= "c:\users\Robert\AppData\Roaming\dxdiago.dll" [2011-02-28 52736]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SpIDerAgent "= "c:\program files\DrWeb\SpIDerAgent.exe" [2011-02-03 1477872]
"SpIDerMail "= "c:\program files\DrWeb\spiderml.exe" [2011-01-26 1572592]
"Malwarebytes' Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv "= "grpconv -o" [X]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
.
c:\users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 0 (0x0)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
R1 SASDIFSV;SASDIFSV;c:\users\Robert\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\Robert\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.SYS [x]
R2 0324881299610170mcinstcleanup;McAfee Application Installer Cleanup (0324881299610170);c:\users\Robert\AppData\Local\Temp\032488~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [2011-02-09 1667416]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 136176]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [2011-02-03 139768]
S0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys [2011-01-26 93944]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - Dwsh000035DE
*Deregistered* - klmd25
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-14 c:\windows\Tasks\Dr.Web Daily scan.job
- c:\program files\DrWeb\DrWeb32w.exe [2010-03-18 13:14]
.
2011-03-15 c:\windows\Tasks\Dr.Web Update.job
- c:\program files\DrWeb\DrWebUpW.exe [2010-04-07 12:04]
.
2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 01:01]
.
2011-03-15 c:\windows\Tasks\User_Feed_Synchronization-{CC3DDFB0-522C-4689-A671-5BD8A129D0D2}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=127.0.0.1:25494
LSP: c:\program files\DrWeb\drwebsp.dll
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-RunOnce-<NO NAME> - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-16 11:34
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath "= "system32\drivers\dwprot.sys "
"Name "= "ImagePath "
.
Completion time: 2011-03-16 11:35:24
ComboFix-quarantined-files.txt 2011-03-16 16:35

Pre-Run: 283,619,082,240 bytes free
Post-Run: 283,727,515,648 bytes free
.
- - End Of File - - 655A1F7A55E8DF23A1F904E5C42FC1A0

 

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6079

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

3/16/2011 3:11:25 PM
mbam-log-2011-03-16 (15-11-25).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 235758
Time elapsed: 21 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Intel Corporation
BIOS Manufacturer: Intel Corp.
System Manufacturer: Seanix Technology Inc.
System Product Name:
Logical Drives Mask: 0x000003fc

Kernel Drivers (total 134):
0x81A0E000 \SystemRoot\system32\ntkrnlpa.exe
0x81DC8000 \SystemRoot\system32\hal.dll
0x80406000 \SystemRoot\system32\kdcom.dll
0x8040D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8047D000 \SystemRoot\system32\PSHED.dll
0x8048E000 \SystemRoot\system32\BOOTVID.dll
0x80496000 \SystemRoot\system32\CLFS.SYS
0x804D7000 \SystemRoot\system32\CI.dll
0x80600000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067C000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80689000 \SystemRoot\system32\drivers\acpi.sys
0x806CF000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806D8000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E0000 \SystemRoot\system32\drivers\pci.sys
0x80707000 \SystemRoot\System32\drivers\partmgr.sys
0x80716000 \SystemRoot\system32\drivers\volmgr.sys
0x80725000 \SystemRoot\System32\drivers\volmgrx.sys
0x8076F000 \SystemRoot\system32\drivers\intelide.sys
0x80776000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80784000 \SystemRoot\System32\drivers\mountmgr.sys
0x80794000 \SystemRoot\system32\drivers\atapi.sys
0x8079C000 \SystemRoot\system32\drivers\ataport.SYS
0x807BA000 \SystemRoot\system32\drivers\fltmgr.sys
0x807EC000 \SystemRoot\system32\drivers\fileinfo.sys
0x805B7000 \SystemRoot\system32\drivers\spiderg3.sys
0x805CD000 \SystemRoot\system32\drivers\dwprot.sys
0x82407000 \SystemRoot\system32\drivers\msrpc.sys
0x82432000 \SystemRoot\system32\drivers\NETIO.SYS
0x8246D000 \SystemRoot\system32\drivers\NDIS.SYS
0x82578000 \SystemRoot\system32\drivers\TDI.SYS
0x82583000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82605000 \SystemRoot\System32\drivers\tcpip.sys
0x826F2000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x85E00000 \SystemRoot\System32\Drivers\Ntfs.sys
0x85F10000 \SystemRoot\system32\drivers\volsnap.sys
0x85F49000 \SystemRoot\System32\Drivers\spldr.sys
0x85F51000 \SystemRoot\System32\Drivers\mup.sys
0x85F60000 \SystemRoot\System32\drivers\ecache.sys
0x85F87000 \SystemRoot\system32\drivers\disk.sys
0x85F98000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x85FB9000 \SystemRoot\system32\drivers\crcdisk.sys
0x85FE2000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x85FED000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8270D000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8A7A1000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x8271C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8A7A3000 \SystemRoot\System32\drivers\watchdog.sys
0x8980F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8989C000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x898A7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x898E5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x898F4000 \SystemRoot\system32\DRIVERS\e100b325.sys
0x8991B000 \SystemRoot\system32\DRIVERS\parport.sys
0x89933000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x89946000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x89951000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8995C000 \SystemRoot\system32\DRIVERS\serial.sys
0x89976000 \SystemRoot\system32\DRIVERS\serenum.sys
0x89980000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x89998000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8A7AF000 \SystemRoot\system32\DRIVERS\storport.sys
0x899C7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x899DE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x827BC000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x899E9000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x827DF000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x89A0E000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x89A23000 \SystemRoot\system32\DRIVERS\termdd.sys
0x89A33000 \SystemRoot\system32\DRIVERS\swenum.sys
0x89A35000 \SystemRoot\system32\DRIVERS\ks.sys
0x89A5F000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x89A69000 \SystemRoot\system32\DRIVERS\umbus.sys
0x89A76000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x89AAB000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x89ABC000 \SystemRoot\system32\drivers\HdAudio.sys
0x89AFB000 \SystemRoot\system32\drivers\portcls.sys
0x89B28000 \SystemRoot\system32\drivers\drmk.sys
0x89B4D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x89B56000 \SystemRoot\System32\Drivers\Null.SYS
0x89B5D000 \SystemRoot\System32\Drivers\Beep.SYS
0x89B6D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x89B74000 \SystemRoot\System32\drivers\vga.sys
0x89B80000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x89BA1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x89BA9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x89BB1000 \SystemRoot\System32\Drivers\Msfs.SYS
0x89BBC000 \SystemRoot\System32\Drivers\Npfs.SYS
0x89BCA000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x89BD3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x89BE9000 \SystemRoot\system32\DRIVERS\smb.sys
0x8AA0D000 \SystemRoot\system32\drivers\afd.sys
0x8AA55000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8AA87000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8AA90000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8AAA6000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8AAB4000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8AAC7000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8AB03000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8AB0D000 \SystemRoot\System32\Drivers\dfsc.sys
0x8AB24000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8AB31000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8AB3C000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x8AB44000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8AB59000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91AC0000 \SystemRoot\System32\win32k.sys
0x8AB5B000 \SystemRoot\System32\drivers\Dxapi.sys
0x91CD0000 \SystemRoot\System32\drivers\dxg.sys
0x91D00000 \SystemRoot\System32\TSDDD.dll
0x91D80000 \SystemRoot\System32\framebuf.dll
0x8AB65000 \SystemRoot\system32\drivers\luafv.sys
0x89E00000 \SystemRoot\system32\drivers\spsys.sys
0x8AB80000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8AB90000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x8ABA3000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x89EB0000 \SystemRoot\system32\drivers\HTTP.sys
0x8ABAC000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x8ABC9000 \SystemRoot\system32\DRIVERS\bowser.sys
0x8ABE2000 \SystemRoot\System32\drivers\mpsdrv.sys
0x89F1D000 \SystemRoot\system32\drivers\mrxdav.sys
0x89F3E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x89F5D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x89F96000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x89FAE000 \SystemRoot\System32\DRIVERS\srv2.sys
0x89FD6000 \SystemRoot\System32\DRIVERS\srv.sys
0x8ABF7000 \SystemRoot\system32\DRIVERS\parvdm.sys
0x8A024000 \SystemRoot\system32\drivers\peauth.sys
0x8AA00000 \SystemRoot\System32\Drivers\secdrv.SYS
0x89A00000 \SystemRoot\System32\drivers\tcpipreg.sys
0x8A102000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x8A117000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x8A129000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x8A13F000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8A167000 \??\C:\Users\Robert\AppData\Local\Temp\pwtyqpow.sys
0x774A0000 \Windows\System32\ntdll.dll

Processes (total 59):
0 System Idle Process
4 System
452 C:\Windows\System32\smss.exe
520 csrss.exe
568 C:\Windows\System32\wininit.exe
580 csrss.exe
612 C:\Windows\System32\services.exe
624 C:\Windows\System32\lsass.exe
632 C:\Windows\System32\lsm.exe
704 C:\Windows\System32\winlogon.exe
828 C:\Windows\System32\svchost.exe
872 C:\Windows\System32\nvvsvc.exe
900 C:\Windows\System32\svchost.exe
972 C:\Windows\System32\svchost.exe
1040 C:\Windows\System32\svchost.exe
1052 C:\Windows\System32\svchost.exe
1140 C:\Windows\System32\audiodg.exe
1180 C:\Windows\System32\svchost.exe
1200 C:\Windows\System32\SLsvc.exe
1236 C:\Windows\System32\svchost.exe
1336 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1416 C:\Windows\System32\svchost.exe
1692 C:\Windows\System32\spoolsv.exe
1748 C:\Windows\System32\svchost.exe
1828 C:\Windows\System32\taskeng.exe
1916 C:\Windows\System32\dwm.exe
488 C:\Windows\explorer.exe
628 C:\Program Files\Common Files\Java\Java Update\jusched.exe
836 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
1192 C:\Program Files\DrWeb\spideragent.exe
1248 C:\Program Files\DrWeb\spiderml.exe
1308 C:\Program Files\Windows Media Player\wmpnscfg.exe
1448 C:\Program Files\AWS\WeatherBug Alert\WeatherBugAlert.exe
1516 C:\Program Files\Windows Sidebar\sidebar.exe
1348 C:\Windows\System32\rundll32.exe
1496 C:\Windows\ehome\ehtray.exe
1576 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
1984 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
2100 C:\Windows\ehome\ehmsas.exe
2136 C:\Windows\System32\taskeng.exe
2376 C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
2568 C:\Windows\System32\svchost.exe
2584 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2708 C:\Program Files\Google\Update\GoogleUpdate.exe
2716 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
2808 C:\Windows\System32\svchost.exe
2908 C:\Windows\System32\svchost.exe
2920 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
3020 C:\Windows\System32\SearchIndexer.exe
3092 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
3112 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
3308 WUDFHost.exe
3320 C:\Program Files\Windows Media Player\wmpnetwk.exe
3396 C:\Windows\System32\svchost.exe
3860 C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
4080 C:\Windows\System32\svchost.exe
3040 C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\SearchProtocolHost.exe
2984 C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6002.18005_none_3d746908b76294a3\SearchFilterHost.exe
1632 C:\Users\Robert\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000049`2e000000 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200AAKS-00SBA0, Rev: 12.01B01

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

 

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-03-16 16:20:56
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD3200AAKS-00SBA0 rev.12.01B01
Running: gmer.exe; Driver: C:\Users\Robert\AppData\Local\Temp\pwtyqpow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwAllocateVirtualMemory [0x805E1D90]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwCreateThread [0x805E31E4]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwFreeVirtualMemory [0x805E200E]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwQueueApcThread [0x805E32E6]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwSetContextThread [0x805E3332]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwWriteVirtualMemory [0x805E211E]
SSDT \SystemRoot\system32\drivers\dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.) ZwCreateThreadEx [0x805E32BA]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 131 81ABA8B4 4 Bytes [90, 1D, 5E, 80]
.text ntkrnlpa.exe!KeSetEvent + 221 81ABA9A4 4 Bytes [E4, 31, 5E, 80]
.text ntkrnlpa.exe!KeSetEvent + 335 81ABAAB8 4 Bytes [0E, 20, 5E, 80] {PUSH CS; AND [ESI-0x80], BL}
.text ntkrnlpa.exe!KeSetEvent + 4E5 81ABAC68 4 Bytes [E6, 32, 5E, 80]
.text ntkrnlpa.exe!KeSetEvent + 56D 81ABACF0 4 Bytes [32, 33, 5E, 80]
.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\DrWeb\spideragent.exe[1192] kernel32.dll!SetUnhandledExceptionFilter 76FAA84F 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\DrWeb\spideragent.exe[1192] USER32.dll!SetScrollInfo + 7A8 77677980 4 Bytes [C2, 0C, 02, 00]
.text C:\Program Files\DrWeb\spiderml.exe[1248] kernel32.dll!SetUnhandledExceptionFilter 76FAA84F 5 Bytes JMP 004535D0 C:\Program Files\DrWeb\spiderml.exe (SpIDer Mail ® for Windows Workstation /Doctor Web, Ltd.)
.text C:\Program Files\DrWeb\spiderml.exe[1248] USER32.dll!SetScrollInfo + 7A8 77677980 4 Bytes [C2, 0C, 02, 00]
.text C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe[2376] USER32.dll!SetScrollInfo + 7A8 77677980 4 Bytes [C2, 0C, 02, 00]
.text C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe[3860] USER32.dll!SetScrollInfo + 7A8 77677980 4 Bytes [C2, 0C, 02, 00]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74367817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [743BA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7436BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7435F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [743675E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7435E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74398395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7436DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7435FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7435FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [743571CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [743ECAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7438C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7435D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74356853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7435687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74362AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
AttachedDevice \Driver\tdx \Device\Tcp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
AttachedDevice \Driver\tdx \Device\Udp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
AttachedDevice \Driver\tdx \Device\RawIp dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat dwprot.sys (Dr.Web Protection for Windows/Doctor Web, Ltd.)

---- EOF - GMER 1.0.15 ----

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/6/2011 4:53:54 PM
System Uptime: 3/16/2011 2:19:58 PM (2 hours ago)
.
Motherboard: Intel Corporation | | D946GZIS
Processor: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz | LGA 775 | 2128/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 291 GiB total, 260.734 GiB free.
D: is FIXED (NTFS) - 5 GiB total, 2.438 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e968-e325-11ce-bfc1-08002be10318}
Description: NVIDIA GeForce 8500 GT
Device ID: PCI\VEN_10DE&DEV_0421&SUBSYS_09401462&REV_A1\4&1D6CED30&0&0008
Manufacturer: NVIDIA
Name: NVIDIA GeForce 8500 GT
PNP Device ID: PCI\VEN_10DE&DEV_0421&SUBSYS_09401462&REV_A1\4&1D6CED30&0&0008
Service: nvlddmkm
.
==== System Restore Points ===================
.
RP100: 3/14/2011 1:45:48 PM - Installed Dr.Web anti-virus for Windows 6.0 (x86).
RP101: 3/15/2011 10:35:47 AM - Scheduled Checkpoint
RP102: 3/16/2011 1:11:49 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Adobe Shockwave Player 11.5
Bing Bar
Bing Bar Platform
BufferChm
CCleaner
CustomerResearchQFolder
D3DX10
DeviceManagementQFolder
Dr.Web anti-virus for Windows 6.0 (x86)
ESET Online Scanner v3
eSupportQFolder
Google Toolbar for Internet Explorer
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 8.0
HP Imaging Device Functions 8.0
HP Photosmart Essential
HP Solution Center 8.0
HP Update
HPProductAssistant
HPSSupply
inTuneMP3
Java Auto Updater
Java(TM) 6 Update 24
Junk Mail filter update
Malwarebytes' Anti-Malware
MarketResearch
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
MSVCRT
NVIDIA 3D Vision Driver 260.99
NVIDIA Control Panel 260.99
NVIDIA Graphics Driver 260.99
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.10.0514
NVIDIA Stereoscopic 3D Driver
QuickTime
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Segoe UI
SolutionCenter
Status
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2412171)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2508979)
WeatherBug Alert
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Yahoo! Software Update
.
==== Event Viewer Messages From Past Week ========
.
3/9/2011 2:41:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service NVSvc with arguments " " in order to run the server: {DCAB0989-1301-4319-BE5F-ADE89F88581C}
3/9/2011 10:41:20 AM, Error: EventLog [6008] - The previous system shutdown at 10:36:31 AM on 3/9/2011 was unexpected.
3/16/2011 2:21:58 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL
3/16/2011 11:34:18 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/16/2011 11:30:24 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments " " in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
3/15/2011 12:11:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments " " in order to run the server: {375FF000-DD27-11D9-8F9C-0002B3988E81}
3/15/2011 12:11:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
3/15/2011 12:11:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL spldr Wanarpv6
3/15/2011 12:11:06 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
3/15/2011 12:09:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
3/15/2011 12:09:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
3/15/2011 12:09:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/15/2011 12:09:40 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
3/14/2011 11:59:48 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:54:00 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/14/2011 11:53:29 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
3/14/2011 11:53:29 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
.
==== End Of File ===========================

 

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Robert at 16:30:29.01 on Wed 03/16/2011
Internet Explorer: 8.0.6001.19019
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1021.298 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\DrWeb\spideragent.exe
C:\Program Files\DrWeb\spiderml.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\AWS\WeatherBug Alert\WeatherBugAlert.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Doctor Web\Scanning Engine\dwengine.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Robert\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyServer = http=127.0.0.1:25494
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: @c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [WeatherBugAlert] "c:\program files\aws\weatherbug alert\WeatherBugAlert.exe" /st
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [SBQM] rundll32 "c:\users\robert\appdata\roaming\dxdiago.dll ",Gzjpdkl
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [SpIDerAgent] "c:\program files\drweb\SpIDerAgent.exe "
mRun: [SpIDerMail] "c:\program files\drweb\spiderml.exe" -autorun
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\users\robert\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {925DAB62-F9AC-4221-806A-057BFB1014AA}
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: c:\program files\drweb\drwebsp.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
.
============= SERVICES / DRIVERS ===============
.
R0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [2011-3-14 139768]
R0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys [2011-3-14 93944]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\common files\doctor web\scanning engine\dwengine.exe [2010-4-1 1667416]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]
S2 0324881299610170mcinstcleanup;McAfee Application Installer Cleanup (0324881299610170);c:\users\robert\appdata\local\temp\032488~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\users\robert\appdata\local\temp\032488~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-7 136176]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-2-13 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-03-16 16:35:26 -------- d-----w- c:\users\robert\appdata\local\temp
2011-03-16 16:35:03 -------- d-sh--w- C:\$RECYCLE.BIN
2011-03-14 18:46:50 139768 ----a-w- c:\windows\system32\drivers\dwprot.sys
2011-03-14 18:46:44 93944 ----a-w- c:\windows\system32\drivers\spiderg3.sys
2011-03-14 18:46:21 -------- d-----w- c:\progra~2\Doctor Web
2011-03-14 18:46:16 -------- d-----w- c:\program files\DrWeb
2011-03-14 18:46:16 -------- d-----w- c:\program files\common files\Doctor Web
2011-03-09 22:11:55 -------- d-----w- c:\program files\ESET
2011-03-09 21:48:20 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 21:48:20 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 21:48:20 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 21:48:20 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-09 21:48:19 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 21:48:18 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-03-08 21:21:26 -------- d-----w- c:\users\robert\appdata\roaming\Malwarebytes
2011-03-08 21:21:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-08 21:21:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-08 21:21:21 -------- d--h--w- c:\program files\Malwarebytes' Anti-Malware
2011-03-08 21:21:21 -------- d-----w- c:\progra~2\Malwarebytes
2011-03-08 17:27:04 -------- d-----w- c:\users\robert\appdata\roaming\Windows Live Writer
2011-03-08 17:27:04 -------- d-----w- c:\users\robert\appdata\local\Windows Live Writer
2011-03-08 16:28:45 98816 ----a-w- c:\windows\sed.exe
2011-03-08 16:28:45 89088 ----a-w- c:\windows\MBR.exe
2011-03-08 16:28:45 256512 ----a-w- c:\windows\PEV.exe
2011-03-08 16:28:45 161792 ----a-w- c:\windows\SWREG.exe
2011-03-07 23:12:22 -------- d-----w- c:\users\robert\DoctorWeb
2011-03-07 22:56:16 -------- d-----w- c:\program files\CCleaner
2011-03-07 22:31:41 -------- d-----w- c:\windows\pss
2011-03-07 20:38:59 -------- d-----w- c:\users\robert\appdata\roaming\SUPERAntiSpyware.com
2011-03-07 20:38:59 -------- d-----w- c:\progra~2\SUPERAntiSpyware.com
2011-02-28 18:26:57 52736 --sha-r- c:\users\robert\appdata\roaming\dxdiago.dll
2011-02-27 06:34:02 -------- d-----w- c:\windows\Speeditup Free
2011-02-27 06:33:14 9216 ----a-r- c:\users\robert\appdata\roaming\microsoft\installer\{7426428e-71d4-452c-ba13-b14e5eb52859}\Icon7426428E16.exe
2011-02-27 06:33:13 -------- d-----w- c:\program files\AWS
2011-02-23 20:16:54 -------- d-----w- c:\users\robert\appdata\roaming\Tific
2011-02-23 20:16:54 -------- d-----w- c:\users\robert\appdata\local\Tific
2011-02-19 15:51:42 15256 ----a-w- c:\users\robert\appdata\roaming\microsoft\identitycrl\production\ppcrlconfig.dll
.
==================== Find3M ====================
.
2011-02-03 03:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 16:08:16 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08:06 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08:06 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08:06 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08:06 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07:58 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07:42 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07:16 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06:38 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06:35 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04:54 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 16:04:54 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 14:28:38 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27:50 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26:30 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25:25 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24:32 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24:26 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15:10 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14:39 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14:03 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14:03 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12:46 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11:34 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47:51 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-20 13:44:05 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-01-20 13:44:03 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-01-08 08:47:50 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-08 06:28:49 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:57:01 2039808 ----a-w- c:\windows\system32\win32k.sys
2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-18 06:27:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-18 06:22:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-18 06:22:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-18 06:22:11 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-12-18 06:22:11 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-12-18 05:25:26 385024 ----a-w- c:\windows\system32\html.iec
2010-12-18 04:48:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-12-18 04:47:11 1638912 ----a-w- c:\windows\system32\mshtml.tlb
.
============= FINISH: 16:30:52.34 ===============

 

Thanks broni for your quick reply.

IE is getting redirected.

 

ComboFix 11-03-15.03 - Robert 03/16/2011 17:04:21.9.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1021.356 [GMT -5:00]
Running from: c:\users\Robert\Desktop\ComboFix.exe
Command switches used :: c:\users\Robert\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-02-16 to 2011-03-16 )))))))))))))))))))))))))))))))
.
.
2011-03-16 22:08 . 2011-03-16 22:08 -------- d-----w- c:\users\Robert\AppData\Local\temp
2011-03-16 22:08 . 2011-03-16 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-16 22:08 . 2011-03-16 22:08 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-03-14 18:46 . 2011-02-03 12:04 139768 ----a-w- c:\windows\system32\drivers\dwprot.sys
2011-03-14 18:46 . 2011-01-26 09:45 93944 ----a-w- c:\windows\system32\drivers\spiderg3.sys
2011-03-14 18:46 . 2011-03-14 18:46 -------- d-----w- c:\programdata\Doctor Web
2011-03-14 18:46 . 2011-03-16 21:46 -------- d-----w- c:\program files\DrWeb
2011-03-14 18:46 . 2011-03-14 18:46 -------- d-----w- c:\program files\Common Files\Doctor Web
2011-03-09 22:11 . 2011-03-09 22:11 -------- d-----w- c:\program files\ESET
2011-03-09 21:48 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 21:48 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-09 21:48 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 21:48 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 21:48 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 21:48 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-03-08 21:21 . 2011-03-08 21:21 -------- d-----w- c:\users\Robert\AppData\Roaming\Malwarebytes
2011-03-08 21:21 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-08 21:21 . 2011-03-16 19:24 -------- d--h--w- c:\program files\Malwarebytes' Anti-Malware
2011-03-08 21:21 . 2011-03-08 21:21 -------- d-----w- c:\programdata\Malwarebytes
2011-03-08 21:21 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-08 17:27 . 2011-03-08 17:27 -------- d-----w- c:\users\Robert\AppData\Roaming\Windows Live Writer
2011-03-08 17:27 . 2011-03-08 17:27 -------- d-----w- c:\users\Robert\AppData\Local\Windows Live Writer
2011-03-07 23:12 . 2011-03-15 15:05 -------- d-----w- c:\users\Robert\DoctorWeb
2011-03-07 22:56 . 2011-03-07 22:56 -------- d-----w- c:\program files\CCleaner
2011-03-07 22:30 . 2011-03-07 22:30 -------- d-----w- c:\program files\Common Files\Java
2011-03-07 20:38 . 2011-03-07 20:38 -------- d-----w- c:\users\Robert\AppData\Roaming\SUPERAntiSpyware.com
2011-03-07 20:38 . 2011-03-07 20:38 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-02-28 18:26 . 2011-02-28 18:26 52736 --sha-r- c:\users\Robert\AppData\Roaming\dxdiago.dll
2011-02-27 06:34 . 2011-02-27 06:34 -------- d-----w- c:\windows\Speeditup Free
2011-02-27 06:33 . 2011-02-27 06:33 9216 ----a-r- c:\users\Robert\AppData\Roaming\Microsoft\Installer\{7426428E-71D4-452C-BA13-B14E5EB52859}\Icon7426428E16.exe
2011-02-27 06:33 . 2011-02-27 06:33 -------- d-----w- c:\program files\AWS
2011-02-23 20:16 . 2011-02-28 17:40 -------- d-----w- c:\users\Robert\AppData\Local\Tific
2011-02-23 20:16 . 2011-02-23 20:16 -------- d-----w- c:\users\Robert\AppData\Roaming\Tific
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-08 21:11 . 2010-06-24 17:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-03 03:40 . 2011-01-25 17:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 16:37 . 2011-02-09 12:20 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 12:20 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 12:20 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 12:20 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08 . 2011-02-09 12:20 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 12:20 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07 . 2011-02-09 12:20 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 12:20 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 12:20 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 12:20 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 12:20 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 12:20 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 12:20 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 12:20 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 12:20 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 12:20 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 12:20 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 12:20 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24 . 2011-02-09 12:20 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 12:20 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 12:20 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 12:20 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14 . 2011-02-09 12:20 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12 . 2011-02-09 12:20 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 12:20 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 12:20 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-20 13:44 . 2011-02-09 12:20 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-01-20 13:44 . 2011-02-09 12:20 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-01-13 09:41 . 2011-02-11 07:49 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E6D90D74-4052-45DA-8479-239B9C858584}\mpengine.dll
2011-01-08 08:47 . 2011-02-09 12:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 12:20 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:57 . 2011-02-09 12:20 2039808 ----a-w- c:\windows\system32\win32k.sys
2010-12-28 15:55 . 2011-01-19 19:34 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-18 06:27 . 2011-02-09 12:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-18 06:22 . 2011-02-09 12:20 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-18 06:22 . 2011-02-09 12:20 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-18 06:22 . 2011-02-09 12:20 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-12-18 06:22 . 2011-02-09 12:20 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-12-18 05:25 . 2011-02-09 12:20 385024 ----a-w- c:\windows\system32\html.iec
2010-12-18 04:48 . 2011-02-09 12:20 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-12-18 04:47 . 2011-02-09 12:20 1638912 ----a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"WindowsWelcomeCenter "= "oobefldr.dll" [2009-04-11 2153472]
"WeatherBugAlert "= "c:\program files\AWS\WeatherBug Alert\WeatherBugAlert.exe" [2010-02-22 442368]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"SBQM "= "c:\users\Robert\AppData\Roaming\dxdiago.dll" [2011-02-28 52736]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SpIDerAgent "= "c:\program files\DrWeb\SpIDerAgent.exe" [2011-02-03 1477872]
"SpIDerMail "= "c:\program files\DrWeb\spiderml.exe" [2011-01-26 1572592]
.
c:\users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 0 (0x0)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
R1 SASDIFSV;SASDIFSV;c:\users\Robert\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\Robert\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.SYS [x]
R2 0324881299610170mcinstcleanup;McAfee Application Installer Cleanup (0324881299610170);c:\users\Robert\AppData\Local\Temp\032488~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 136176]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [2011-02-03 139768]
S0 SpiderG3;DrWeb file system scanner;c:\windows\system32\drivers\spiderg3.sys [2011-01-26 93944]
S2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine);c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe [2011-02-09 1667416]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - PWTYQPOW
*Deregistered* - pwtyqpow
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-14 c:\windows\Tasks\Dr.Web Daily scan.job
- c:\program files\DrWeb\DrWeb32w.exe [2010-03-18 13:14]
.
2011-03-16 c:\windows\Tasks\Dr.Web Update.job
- c:\program files\DrWeb\DrWebUpW.exe [2010-04-07 12:04]
.
2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 01:01]
.
2011-03-16 c:\windows\Tasks\User_Feed_Synchronization-{CC3DDFB0-522C-4689-A671-5BD8A129D0D2}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Supplementary Scan -------
.
LSP: c:\program files\DrWeb\drwebsp.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-16 17:08
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath "= "system32\drivers\dwprot.sys "
"Name "= "ImagePath "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(496)
c:\program files\DrWeb\drwebsp.dll
.
Completion time: 2011-03-16 17:09:57
ComboFix-quarantined-files.txt 2011-03-16 22:09
ComboFix2.txt 2011-03-16 16:35
.
Pre-Run: 279,945,814,016 bytes free
Post-Run: 279,924,654,080 bytes free
.
- - End Of File - - CD3B6A279E0BF8BD9CFBE863C78576BF

 

I have no other browser.

Thanks

Wil

 

I tried Google in Firefox and it was redirected also.

Wil

 

Hey broni,

I completed your instructions and:

IE worked once and reverted back to redirecting Google afterwards.

Firefox was redirected immediately.

Anymore help would be greatly appreciated.

Thanks

Wil

 

2011/03/18 09:20:43.0871 3600 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/18 09:20:44.0012 3600 ================================================================================
2011/03/18 09:20:44.0012 3600 SystemInfo:
2011/03/18 09:20:44.0012 3600
2011/03/18 09:20:44.0012 3600 OS Version: 6.0.6002 ServicePack: 2.0
2011/03/18 09:20:44.0012 3600 Product type: Workstation
2011/03/18 09:20:44.0012 3600 ComputerName: ROBERT-PC
2011/03/18 09:20:44.0012 3600 UserName: Robert
2011/03/18 09:20:44.0012 3600 Windows directory: C:\Windows
2011/03/18 09:20:44.0012 3600 System windows directory: C:\Windows
2011/03/18 09:20:44.0012 3600 Processor architecture: Intel x86
2011/03/18 09:20:44.0012 3600 Number of processors: 2
2011/03/18 09:20:44.0012 3600 Page size: 0x1000
2011/03/18 09:20:44.0012 3600 Boot type: Normal boot
2011/03/18 09:20:44.0012 3600 ================================================================================
2011/03/18 09:20:44.0762 3600 Initialize success
2011/03/18 09:20:48.0137 3808 ================================================================================
2011/03/18 09:20:48.0137 3808 Scan started
2011/03/18 09:20:48.0137 3808 Mode: Manual;
2011/03/18 09:20:48.0137 3808 ================================================================================
2011/03/18 09:20:52.0043 3808 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/03/18 09:20:52.0231 3808 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/03/18 09:20:52.0434 3808 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/03/18 09:20:52.0543 3808 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/03/18 09:20:52.0637 3808 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/03/18 09:20:52.0856 3808 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/03/18 09:20:53.0028 3808 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/03/18 09:20:53.0215 3808 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/18 09:20:53.0324 3808 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/03/18 09:20:53.0465 3808 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/03/18 09:20:53.0559 3808 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/03/18 09:20:53.0653 3808 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/03/18 09:20:53.0715 3808 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/03/18 09:20:53.0918 3808 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/03/18 09:20:54.0028 3808 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/03/18 09:20:54.0121 3808 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/18 09:20:54.0168 3808 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/03/18 09:20:54.0293 3808 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/18 09:20:54.0528 3808 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/03/18 09:20:54.0621 3808 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/18 09:20:54.0762 3808 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/18 09:20:54.0809 3808 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/18 09:20:54.0949 3808 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/18 09:20:55.0028 3808 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/18 09:20:55.0199 3808 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/18 09:20:55.0262 3808 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/18 09:20:55.0403 3808 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/18 09:20:55.0637 3808 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/18 09:20:55.0762 3808 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/18 09:20:55.0934 3808 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/03/18 09:20:56.0012 3808 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/03/18 09:20:56.0121 3808 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/03/18 09:20:56.0231 3808 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys
2011/03/18 09:20:56.0309 3808 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/03/18 09:20:56.0403 3808 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/03/18 09:20:56.0543 3808 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/03/18 09:20:56.0793 3808 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/03/18 09:20:56.0934 3808 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/18 09:20:56.0981 3808 DwProt (249a3ed0b70e4aba4d11c9f07a10209f) C:\Windows\system32\drivers\dwprot.sys
2011/03/18 09:20:57.0184 3808 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/18 09:20:57.0403 3808 E100B (d00eeae1cacd77a1a8396bbc19140bba) C:\Windows\system32\DRIVERS\e100b325.sys
2011/03/18 09:20:57.0684 3808 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/18 09:20:57.0778 3808 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/03/18 09:20:57.0903 3808 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/03/18 09:20:58.0028 3808 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/03/18 09:20:58.0153 3808 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/03/18 09:20:58.0262 3808 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/03/18 09:20:58.0434 3808 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/18 09:20:58.0590 3808 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/18 09:20:58.0684 3808 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/18 09:20:58.0809 3808 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/18 09:20:58.0918 3808 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/03/18 09:20:59.0074 3808 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys
2011/03/18 09:20:59.0137 3808 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/18 09:20:59.0231 3808 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/18 09:20:59.0418 3808 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
2011/03/18 09:20:59.0606 3808 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/18 09:20:59.0746 3808 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/18 09:20:59.0949 3808 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/03/18 09:21:00.0106 3808 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/18 09:21:00.0231 3808 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/03/18 09:21:00.0356 3808 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/03/18 09:21:00.0528 3808 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/03/18 09:21:00.0653 3808 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/18 09:21:00.0793 3808 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/03/18 09:21:00.0918 3808 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/18 09:21:01.0059 3808 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/18 09:21:01.0137 3808 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/18 09:21:01.0262 3808 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/18 09:21:01.0356 3808 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/18 09:21:01.0434 3808 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/18 09:21:01.0496 3808 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/18 09:21:01.0559 3808 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/03/18 09:21:01.0684 3808 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/18 09:21:01.0793 3808 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/18 09:21:01.0887 3808 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/18 09:21:01.0949 3808 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/18 09:21:02.0043 3808 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/18 09:21:02.0215 3808 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/18 09:21:02.0340 3808 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/18 09:21:02.0465 3808 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/18 09:21:03.0293 3808 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/18 09:21:03.0465 3808 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/18 09:21:03.0543 3808 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/18 09:21:03.0699 3808 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/03/18 09:21:03.0762 3808 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/03/18 09:21:03.0871 3808 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/18 09:21:03.0934 3808 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/18 09:21:04.0059 3808 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/18 09:21:04.0184 3808 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/18 09:21:04.0231 3808 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/18 09:21:04.0340 3808 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/03/18 09:21:04.0434 3808 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/18 09:21:04.0528 3808 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/18 09:21:04.0637 3808 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/03/18 09:21:04.0746 3808 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/18 09:21:04.0809 3808 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/18 09:21:04.0965 3808 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/18 09:21:05.0168 3808 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/03/18 09:21:05.0262 3808 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/03/18 09:21:05.0356 3808 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/18 09:21:05.0418 3808 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/18 09:21:05.0559 3808 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/18 09:21:05.0637 3808 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/18 09:21:05.0762 3808 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/18 09:21:05.0903 3808 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/03/18 09:21:05.0965 3808 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/18 09:21:06.0028 3808 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/18 09:21:06.0137 3808 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/03/18 09:21:06.0324 3808 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/18 09:21:06.0543 3808 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/03/18 09:21:06.0653 3808 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/18 09:21:06.0731 3808 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/18 09:21:06.0856 3808 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/18 09:21:06.0918 3808 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/18 09:21:06.0981 3808 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/18 09:21:07.0074 3808 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/18 09:21:07.0246 3808 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/18 09:21:07.0324 3808 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/03/18 09:21:07.0403 3808 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/18 09:21:07.0621 3808 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/03/18 09:21:07.0793 3808 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/18 09:21:07.0856 3808 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/18 09:21:08.0949 3808 nvlddmkm (bd409de5681c74c1de51d72427dc202d) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/03/18 09:21:10.0965 3808 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/03/18 09:21:11.0059 3808 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/03/18 09:21:11.0199 3808 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/03/18 09:21:11.0449 3808 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/03/18 09:21:11.0574 3808 Parport (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys
2011/03/18 09:21:11.0668 3808 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/03/18 09:21:11.0715 3808 Parvdm (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys
2011/03/18 09:21:11.0824 3808 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/03/18 09:21:11.0903 3808 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/03/18 09:21:12.0012 3808 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/18 09:21:12.0246 3808 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/18 09:21:12.0465 3808 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/18 09:21:12.0543 3808 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/03/18 09:21:12.0606 3808 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/18 09:21:12.0668 3808 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/03/18 09:21:12.0699 3808 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/18 09:21:12.0731 3808 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/18 09:21:12.0746 3808 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/18 09:21:12.0778 3808 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/18 09:21:12.0809 3808 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/18 09:21:12.0840 3808 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/18 09:21:12.0887 3808 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/18 09:21:12.0903 3808 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/18 09:21:12.0934 3808 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/03/18 09:21:12.0949 3808 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/18 09:21:12.0981 3808 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/03/18 09:21:13.0028 3808 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/18 09:21:13.0137 3808 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/18 09:21:13.0184 3808 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/18 09:21:13.0246 3808 Serenum (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys
2011/03/18 09:21:13.0293 3808 Serial (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys
2011/03/18 09:21:13.0356 3808 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/18 09:21:13.0434 3808 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/03/18 09:21:13.0449 3808 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/18 09:21:13.0465 3808 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/18 09:21:13.0481 3808 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/18 09:21:13.0512 3808 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/03/18 09:21:13.0543 3808 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/03/18 09:21:13.0574 3808 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/03/18 09:21:13.0621 3808 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/03/18 09:21:13.0668 3808 SpiderG3 (8f683d6aac09b0f8c15e4d2d6728758c) C:\Windows\system32\drivers\spiderg3.sys
2011/03/18 09:21:13.0699 3808 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/18 09:21:13.0731 3808 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/03/18 09:21:13.0762 3808 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/18 09:21:13.0778 3808 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/18 09:21:13.0856 3808 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/18 09:21:13.0903 3808 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/18 09:21:13.0934 3808 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/18 09:21:13.0965 3808 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/18 09:21:14.0184 3808 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys
2011/03/18 09:21:14.0231 3808 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/18 09:21:14.0309 3808 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/18 09:21:14.0371 3808 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/18 09:21:14.0403 3808 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/18 09:21:14.0434 3808 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/18 09:21:14.0465 3808 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/18 09:21:14.0512 3808 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/18 09:21:14.0543 3808 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/18 09:21:14.0559 3808 tunnel (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/18 09:21:14.0590 3808 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/03/18 09:21:14.0621 3808 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/18 09:21:14.0684 3808 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/18 09:21:14.0715 3808 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/03/18 09:21:14.0731 3808 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/18 09:21:14.0762 3808 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/18 09:21:14.0793 3808 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/18 09:21:14.0840 3808 usbccgp (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\drivers\usbccgp.sys
2011/03/18 09:21:14.0856 3808 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/18 09:21:14.0918 3808 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/18 09:21:15.0012 3808 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/18 09:21:15.0043 3808 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/03/18 09:21:15.0090 3808 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/18 09:21:15.0106 3808 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/18 09:21:15.0137 3808 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/18 09:21:15.0199 3808 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/18 09:21:15.0231 3808 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/18 09:21:15.0262 3808 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/03/18 09:21:15.0293 3808 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/03/18 09:21:15.0324 3808 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/03/18 09:21:15.0356 3808 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/18 09:21:15.0481 3808 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/03/18 09:21:15.0793 3808 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/03/18 09:21:15.0840 3808 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/03/18 09:21:15.0934 3808 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/18 09:21:15.0949 3808 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/18 09:21:15.0981 3808 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/18 09:21:16.0012 3808 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/03/18 09:21:16.0059 3808 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/18 09:21:16.0184 3808 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys
2011/03/18 09:21:16.0293 3808 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/18 09:21:16.0340 3808 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/18 09:21:16.0403 3808 ================================================================================
2011/03/18 09:21:16.0403 3808 Scan finished
2011/03/18 09:21:16.0403 3808 ================================================================================