Solved Malware issue (Browser redirect and no go Auto Updates/MS Update

[Resolved] Malware issue (Browser redirect and no go Auto Updates/MS Update

My pc has been working just dandy lately but for some unkown reason 3 days ago I started getting browser redirects and application associations were all deleted ... on trying to fix the associations I found auto updates were blanked out and I was unable to access MS update.

I run WIndows XP SP3.
My virus protection is up to date as was all updates.

I fixed the file associations using this website http://www.dougknox.com/xp/file_assoc.htm

I then run malwarebytes but it found nothing so I ran combofix. Am unable to install SUPERAntiSpyware.

Still have the same probs tho so here I am looking for help!

Will post all logs below.

 

Malwarebytes Anti-Malware Log


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6633

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 7.0.5730.13

22/05/2011 6:53:58 PM
mbam-log-2011-05-22 (18-53-58).txt

Scan type: Quick scan
Objects scanned: 166949
Time elapsed: 16 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

GMER Log


GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-22 20:28:23
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 ST94019A rev.3.09
Running: gmer.exe; Driver: C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\pxlyapog.sys


---- Kernel code sections - GMER 1.0.15 ----

init C:\WINDOWS\system32\drivers\tiumflt.sys entry point in "init" section [0xF8345E00]
init C:\WINDOWS\system32\drivers\tiumfwl.sys entry point in "init" section [0xF8263F00]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[256] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CC000A
.text C:\WINDOWS\Explorer.EXE[256] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00DD000A
.text C:\WINDOWS\Explorer.EXE[256] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C2000C
.text C:\WINDOWS\system32\svchost.exe[1192] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00EB000A
.text C:\WINDOWS\system32\svchost.exe[1192] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00EC000A
.text C:\WINDOWS\system32\svchost.exe[1192] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00EA000C
.text C:\WINDOWS\system32\svchost.exe[1192] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 01EA000A
.text C:\WINDOWS\system32\svchost.exe[1192] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 01EB000A
.text C:\WINDOWS\system32\svchost.exe[1192] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 01EC000A
.text C:\WINDOWS\system32\svchost.exe[1192] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 01BC000A

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 83AF253B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 83AF253B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 83AF253B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 83AF253B

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

 

MBRCheck Log



MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000d

Kernel Drivers (total 107):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x80700000 \WINDOWS\system32\hal.dll
0x83AA7000 \WINDOWS\system32\KDCOM.DLL
0xF8335000 \WINDOWS\system32\BOOTVID.dll
0xF7ED2000 ACPI.sys
0xF8421000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7EC1000 pci.sys
0xF7F21000 isapnp.sys
0xF7F31000 ohci1394.sys
0xF7F41000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF8339000 compbatt.sys
0xF833D000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF84E9000 pciide.sys
0xF81A1000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7EA3000 pcmcia.sys
0xF7F51000 MountMgr.sys
0xF7E84000 ftdisk.sys
0xF8341000 ACPIEC.sys
0xF84EA000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF81A9000 PartMgr.sys
0xF8423000 atiide.sys
0xF7F61000 VolSnap.sys
0xF7E6C000 atapi.sys
0xF7F71000 disk.sys
0xF7F81000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7E4C000 fltmgr.sys
0xF7E3A000 sr.sys
0xF7F91000 PxHelp20.sys
0xF7E23000 KSecDD.sys
0xF7E0C000 WudfPf.sys
0xF7D7F000 Ntfs.sys
0xF7D52000 NDIS.sys
0xF7FA1000 Serial.sys
0xF7D38000 Mup.sys
0xF8345000 tiumflt.sys
0xF8349000 atisgkaf.sys
0xF83C5000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF8289000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF7CBB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7FC1000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7FD1000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7FE1000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF7C98000 \SystemRoot\system32\DRIVERS\ks.sys
0xF8301000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF7FF1000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF8329000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7C81000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xF8201000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF8211000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF8261000 \SystemRoot\system32\drivers\tiumfwl.sys
0xF8279000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF8001000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF83E5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF7C29000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF8011000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8021000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF82C9000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7BF0000 \SystemRoot\system32\DRIVERS\psched.sys
0xF8031000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF82F1000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF8309000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF8041000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF842B000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF7B92000 \SystemRoot\system32\DRIVERS\update.sys
0xF83FD000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8051000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF842F000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8061000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8249000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF8435000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8540000 \SystemRoot\System32\Drivers\Null.SYS
0xF8439000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8271000 \SystemRoot\System32\drivers\vga.sys
0xF7AB6000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xF843D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF82A1000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7CF8000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF80B1000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF82B9000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF82D1000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7CF0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF7A83000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7A2A000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF7A04000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF79DC000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF80E1000 \SystemRoot\System32\Drivers\usbaapl.sys
0xF79BA000 \SystemRoot\System32\drivers\afd.sys
0xF7C25000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF80F1000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF82F9000 \SystemRoot\system32\DRIVERS\point32.sys
0xF798F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF791F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF8111000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF78DF000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF844B000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF78FB000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8319000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8589000 \SystemRoot\System32\drivers\dxgthk.sys
0xBFF50000 \SystemRoot\System32\framebuf.dll
0xBF012000 \SystemRoot\System32\ATMFD.DLL
0xF5069000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF4D25000 \SystemRoot\system32\DRIVERS\srv.sys
0xF4AF9000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF4950000 \??\C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\pxlyapog.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 18):
0 System Idle Process
4 System
532 C:\WINDOWS\system32\smss.exe
644 csrss.exe
668 C:\WINDOWS\system32\winlogon.exe
724 C:\WINDOWS\system32\services.exe
736 C:\WINDOWS\system32\lsass.exe
892 C:\WINDOWS\system32\svchost.exe
988 svchost.exe
1104 C:\WINDOWS\system32\svchost.exe
1192 C:\WINDOWS\system32\svchost.exe
1260 svchost.exe
1312 svchost.exe
256 C:\WINDOWS\explorer.exe
1376 C:\Program Files\Windows Defender\MsMpEng.exe
1224 wmiprvse.exe
464 C:\Program Files\Microsoft Office\Office\WINWORD.EXE
1388 C:\Documents and Settings\Michael and Arlene\desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST94019A, Rev: 3.09

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

 

DDS.TXT


.
DDS (Ver_11-05-19.01) - NTFSx86 NETWORK
Internet Explorer: 7.0.5730.13
Run by Michael and Arlene at 20:31:18 on 2011-05-22
Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.703.231 [GMT 10:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\Michael and Arlene\Desktop\dds.pif
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.ninemsn.com/
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [einee] c:\program files\pnuikpamkrfh\jvtaoq.exe yn
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [phein] c:\program files\pnuikpamkrfh\jvtaoq.exe ar
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [einee] c:\program files\pnuikpamkrfh\jvtaoq.exe yn
mRun: [phein] c:\program files\pnuikpamkrfh\jvtaoq.exe ar
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - res://c:\program files\common files\justdo\IECatcher.DLL/FlashCatcher.htm
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\michael and arlene\application data\mozilla\firefox\profiles\ekrq2nw8.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 60283
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2007-6-16 5632]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys --> c:\windows\system32\drivers\fsbts.sys [?]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-5 162640]
S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-7-5 11608]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-7-5 136360]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-7-5 269480]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-5 19024]
S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-7-5 61960]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664]
S3 AVFSFilter;AVFSFilter;c:\windows\system32\drivers\avfsfilter.sys --> c:\windows\system32\drivers\avfsfilter.sys [?]
S3 cpuz135;cpuz135;\??\c:\docume~1\michae~1\locals~1\temp\cpuz135\cpuz135_x32.sys --> c:\docume~1\michae~1\locals~1\temp\cpuz135\cpuz135_x32.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-12-7 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-12-7 8320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-26 42000]
S3 SDVC05;USB SDVC05;c:\windows\system32\drivers\SDVC05.sys [2007-8-18 18088]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
.
=============== Created Last 30 ================
.
2011-05-22 08:14:43 -------- d-----w- c:\windows\system32\CatRoot2
2011-05-21 15:43:32 -------- dcs---w- C:\ComboFix
2011-05-21 15:31:44 -------- d-----w- c:\program files\Uniblue
2011-05-21 15:31:36 -------- d-----w- c:\documents and settings\michael and arlene\local settings\application data\PackageAware
2011-05-20 16:53:40 388096 ----a-r- c:\documents and settings\michael and arlene\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-05-20 16:53:32 -------- d-----w- c:\program files\Trend Micro
2011-05-20 16:26:41 -------- d-----w- c:\documents and settings\michael and arlene\local settings\application data\Google
2011-05-20 15:28:58 8192 ----a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll
2011-05-20 15:28:10 140864 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2011-05-20 15:27:52 94208 ----a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll
2011-05-20 15:27:39 -------- d-----w- c:\program files\common files\xing shared
2011-05-20 15:25:29 569397 ----a-w- c:\program files\internet explorer\plugins\richfx\player\nprfxins.dll
2011-05-20 15:07:59 -------- d-----w- c:\program files\AnvSoft
2011-05-20 15:07:16 -------- d-----w- c:\program files\Any Video Converter Professional
2011-05-20 13:21:45 -------- dc----w- C:\OutputFolder
2011-05-20 13:21:12 -------- d-----w- c:\program files\Digiarty
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin7.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin6.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin5.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin4.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin3.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin2.dll
2011-05-20 12:59:32 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin.dll
2011-05-20 07:05:00 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{f9dc651f-c668-4fc1-a426-687983629a92}\mpengine.dll
2011-05-16 12:52:05 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-16 12:52:04 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-16 12:52:02 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-16 12:52:01 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-16 12:52:01 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-16 12:51:59 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-16 12:51:55 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-16 12:51:51 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-15 04:35:11 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-04-06 06:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 06:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45:07 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
2009-01-16 06:09:03 3989706 -c--a-w- c:\program files\common files\keysetup.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST94019A rev.3.09 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x83AF26F0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x83af8a10]; MOV EAX, [0x83af8a8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x83B37958]
3 CLASSPNP[0xF7F81FD7] -> nt!IofCallDriver[0x804E13B9] -> \Device\0000007f[0x83B3C318]
5 ACPI[0xF7ED8620] -> nt!IofCallDriver[0x804E13B9] -> [0x83B6E940]
\Driver\atapi[0x83B2D2F0] -> IRP_MJ_CREATE -> 0x83AF26F0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x83AF253B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 20:33:12.82 ===============

 

Attach.Log ... I tried to attach it but couldn't find a way on the forum - Sorry!



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-05-19.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 16/06/2007 5:18:30 PM
System Uptime: 22/05/2011 6:12:18 PM (2 hours ago)
.
Motherboard: Hewlett-Packard | | 089C
Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz | JP8 | 3200/mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 7.454 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139/810x Family Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_006B103C&REV_10\4&253A0906&0&18A4
Manufacturer: Realtek Semiconductor Corp.
Name: Realtek RTL8139/810x Family Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_006B103C&REV_10\4&253A0906&0&18A4
Service: RTL8023xp
.
==== System Restore Points ===================
.
RP869: 10/04/2011 8:14:59 PM - System Checkpoint
RP870: 12/04/2011 9:42:45 PM - Software Distribution Service 3.0
RP871: 14/04/2011 2:22:28 AM - System Checkpoint
RP872: 15/04/2011 8:33:24 AM - System Checkpoint
RP873: 15/04/2011 11:42:50 PM - Software Distribution Service 3.0
RP874: 17/04/2011 12:14:39 AM - Software Distribution Service 3.0
RP875: 19/04/2011 2:22:29 AM - System Checkpoint
RP876: 19/04/2011 9:51:30 AM - Software Distribution Service 3.0
RP877: 21/04/2011 2:10:51 AM - System Checkpoint
RP878: 21/04/2011 5:00:25 PM - Software Distribution Service 3.0
RP879: 21/04/2011 7:29:58 PM - Software Distribution Service 3.0
RP880: 22/04/2011 5:05:02 PM - Software Distribution Service 3.0
RP881: 23/04/2011 12:30:38 AM - Software Distribution Service 3.0
RP882: 23/04/2011 7:26:27 PM - Software Distribution Service 3.0
RP883: 24/04/2011 12:10:01 AM - Software Distribution Service 3.0
RP884: 24/04/2011 11:54:08 PM - Software Distribution Service 3.0
RP885: 25/04/2011 8:26:09 PM - Software Distribution Service 3.0
RP886: 26/04/2011 1:59:31 PM - Software Distribution Service 3.0
RP887: 26/04/2011 5:02:34 PM - Software Distribution Service 3.0
RP888: 27/04/2011 1:58:56 PM - Software Distribution Service 3.0
RP889: 28/04/2011 9:37:44 AM - Software Distribution Service 3.0
RP890: 29/04/2011 1:24:21 AM - Software Distribution Service 3.0
RP891: 30/04/2011 12:23:14 AM - Software Distribution Service 3.0
RP892: 2/05/2011 10:20:48 PM - System Checkpoint
RP893: 3/05/2011 12:29:41 AM - Software Distribution Service 3.0
RP894: 4/05/2011 3:11:37 PM - System Checkpoint
RP895: 4/05/2011 5:00:21 PM - Software Distribution Service 3.0
RP896: 5/05/2011 8:49:52 PM - System Checkpoint
RP897: 7/05/2011 1:22:30 PM - System Checkpoint
RP898: 7/05/2011 5:00:28 PM - Software Distribution Service 3.0
RP899: 9/05/2011 8:00:55 PM - Software Distribution Service 3.0
RP900: 10/05/2011 1:12:01 PM - Software Distribution Service 3.0
RP901: 10/05/2011 11:45:08 PM - Software Distribution Service 3.0
RP902: 12/05/2011 1:22:29 PM - Software Distribution Service 3.0
RP903: 14/05/2011 1:00:55 AM - System Checkpoint
RP904: 14/05/2011 5:01:02 PM - Software Distribution Service 3.0
RP905: 16/05/2011 2:14:03 AM - System Checkpoint
RP906: 17/05/2011 2:35:02 AM - System Checkpoint
RP907: 17/05/2011 9:06:42 PM - Software Distribution Service 3.0
RP908: 19/05/2011 9:25:43 PM - System Checkpoint
RP909: 20/05/2011 5:04:40 PM - Software Distribution Service 3.0
RP910: 21/05/2011 2:53:23 AM - Installed HiJackThis
RP911: 21/05/2011 10:17:33 PM - Restore Operation
RP912: 22/05/2011 1:38:07 AM - Restore Operation
.
==== Installed Programs ======================
.
Adobe Acrobat 9 Pro - English, Français, Deutsch
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Shockwave Player 11.5
Advanced Office Password Recovery (remove only)
Agere Systems AC'97 Modem
AI RoboForm
ALPS Touch Pad Driver
Any Video Converter Professional 3.2.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
µTorrent
Avira AntiVir Personal - Free Antivirus
Bonjour
Broadcom 802.11 Driver
CamfrogWEB Advanced ActiveX Plugin (remove only)
CCleaner
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
Defraggler
Dropbox
e-tax 2008
Excel Invoice Manager 2.9.1013
Facebook Plug-In
GiftAuto 5.0
Google Talk (remove only)
Google Toolbar for Firefox
Google Toolbar for Internet Explorer
Google Update Helper
HiJackThis
Home Business Manager
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
iSkysoft FLV Converter(Build 2.3.3.1)
iTunes
Java Auto Updater
Java(TM) 6 Update 23
Junk Mail filter update
Malwarebytes' Anti-Malware
Messenger Plus! 5
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft ActiveSync 3.7
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.9
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MobileMe Control Panel
Movie Maker Background Music Files
Movie Maker Sound Effects
Movie Maker Title Images
Mozilla Firefox 4.0.1 (x86 en-GB)
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
MyDefrag v4.3.1
neroxml
Nokia Connectivity Cable Driver
Nokia Ovi Suite
Nokia Ovi Suite Software Updater
Nokia Software Updater
OGA Notifier 1.7.0105.35.0
Ovi Desktop Sync Engine
OviMPlatform
Pamela Pro 4.6
PC Connectivity Solution
PCI 1620 Cardbus Controller and Software
PDF Editor 2
Personal License Update Wizard for Windows Media Player
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Recuva
Registry Clean Expert
Replay Video Capture
Rhapsody Player Engine
ROUTE 66 Sync
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
Skypeâ„¢ 5.3
SmartRoster
SolidCapture
SolveigMM AVI Trimmer
Sonic RecordNow!
Sonic Update Manager
Sothink SWF Quicker
Speccy
TI1620/1520
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC_MergeModuleToMSI
VuePrint
WebFldrs XP
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Management Framework Core
Windows Media Bonus Pack for Windows XP
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Playlist Import to Excel Wizard
Windows Media Player Skin Importer
Windows Media Player Tray Control
Windows Presentation Foundation
Windows XP Service Pack 3
WinPcap 4.0
WinRAR archiver
WinX Free VOB to MP4 Converter 2.0.7
WM Recorder 12.3
WordPerfect Office 11
XML Paper Specification Shared Components Pack 1.0
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
22/05/2011 7:25:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
22/05/2011 6:14:39 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 ASPI32 aswSP aswTdi avgio avipbb eabfiltr Fips intelppm ssmdrv
22/05/2011 5:14:24 AM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
22/05/2011 5:01:39 PM, error: System Error [1003] - Error code 1000000a, parameter1 00000004, parameter2 0000001c, parameter3 00000001, parameter4 804edaf7.
22/05/2011 4:57:48 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
22/05/2011 4:57:48 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/05/2011 3:09:52 PM, error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s).
22/05/2011 3:07:49 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA) service to connect.
22/05/2011 3:07:49 PM, error: Service Control Manager [7000] - The Windows Image Acquisition (WIA) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/05/2011 12:00:14 AM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
22/05/2011 1:05:20 AM, error: System Error [1003] - Error code 1000000a, parameter1 00000009, parameter2 00000002, parameter3 00000000, parameter4 804ee25b.
21/05/2011 2:21:50 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.
21/05/2011 2:21:50 AM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
21/05/2011 2:06:07 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
21/05/2011 11:59:48 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
21/05/2011 1:53:58 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
21/05/2011 1:53:06 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
21/05/2011 1:49:54 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
21/05/2011 1:43:36 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
21/05/2011 1:43:26 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD ASPI32 aswSP aswTdi avgio avipbb eabfiltr Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:43:26 AM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
21/05/2011 1:33:32 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
19/05/2011 8:42:07 PM, error: Print [23] - Printer hp psc 2500 series fax failed to initialize because a suitable hp psc 2500 series fax driver could not be found.
19/05/2011 8:42:07 PM, error: Print [23] - Printer hp psc 2500 series failed to initialize because a suitable hp psc 2500 series driver could not be found.
19/05/2011 8:34:44 PM, error: Service Control Manager [7000] - The adfs service failed to start due to the following error: The system cannot find the file specified.
18/05/2011 2:11:38 PM, error: Service Control Manager [7031] - The Windows Defender service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
18/05/2011 1:10:32 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
17/05/2011 10:42:14 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.
17/05/2011 10:42:14 AM, error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
17/05/2011 10:42:14 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
15/05/2011 6:56:28 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
15/05/2011 2:34:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
15/05/2011 2:34:24 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
15/05/2011 2:22:31 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Avira\AntiVir Desktop\rcimage.dll. Reference error message: Error Message is unavailable .
15/05/2011 2:20:24 PM, error: Srv [2000] - The server's call to a system service failed unexpectedly.
.
==== End Of File ===========================

 

utorrent removed :c)

 

Thanks!

Avast does not seem installed - so Isarched and deleted referene to it.

I did all scans in safe mode as I got the blue screen death when I tried doing them logge in.

=======================================================
TDSSKiller Log


2011/05/24 23:19:34.0672 3092 TDSS rootkit removing tool 2.5.2.0 May 24 2011 11:01:23
2011/05/24 23:19:35.0828 3092 ================================================================================
2011/05/24 23:19:35.0828 3092 SystemInfo:
2011/05/24 23:19:35.0828 3092
2011/05/24 23:19:35.0828 3092 OS Version: 5.1.2600 ServicePack: 3.0
2011/05/24 23:19:35.0828 3092 Product type: Workstation
2011/05/24 23:19:35.0828 3092 ComputerName: LEENIEHP
2011/05/24 23:19:35.0828 3092 UserName: Michael and Arlene
2011/05/24 23:19:35.0828 3092 Windows directory: C:\WINDOWS
2011/05/24 23:19:35.0828 3092 System windows directory: C:\WINDOWS
2011/05/24 23:19:35.0828 3092 Processor architecture: Intel x86
2011/05/24 23:19:35.0828 3092 Number of processors: 2
2011/05/24 23:19:35.0828 3092 Page size: 0x1000
2011/05/24 23:19:35.0828 3092 Boot type: Normal boot
2011/05/24 23:19:35.0828 3092 ================================================================================
2011/05/24 23:19:39.0890 3092 Initialize success
2011/05/24 23:19:45.0047 1360 ================================================================================
2011/05/24 23:19:45.0062 1360 Scan started
2011/05/24 23:19:45.0062 1360 Mode: Manual;
2011/05/24 23:19:45.0062 1360 ================================================================================
2011/05/24 23:19:48.0562 1360 Aavmker4 (d5d75edd02157fcd3eb576d4681e8c3e) C:\WINDOWS\system32\drivers\Aavmker4.sys
2011/05/24 23:19:49.0968 1360 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/05/24 23:19:50.0515 1360 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/05/24 23:19:51.0875 1360 aeaudio (3cb6ae5435987b1f8c83fd2730479878) C:\WINDOWS\system32\drivers\aeaudio.sys
2011/05/24 23:19:52.0593 1360 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/05/24 23:19:53.0281 1360 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/05/24 23:19:54.0609 1360 AgereSoftModem (029e01cb2938bec5af31bf47b6af0159) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/05/24 23:19:57.0968 1360 ApfiltrService (d3da11b88ab29076b78ff79f35f0586b) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2011/05/24 23:19:58.0593 1360 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/05/24 23:20:00.0422 1360 ASPI32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\ASPI32.sys
2011/05/24 23:20:01.0031 1360 aswFsBlk (fb6a381c32a87ee6588eed61d22dc03b) C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/05/24 23:20:01.0515 1360 aswMon2 (1a10cbecfdd0a597b27e2d0998d95cf9) C:\WINDOWS\system32\drivers\aswMon2.sys
2011/05/24 23:20:02.0062 1360 aswRdr (7827f70b86b29fbf112cbce547205acc) C:\WINDOWS\system32\drivers\aswRdr.sys
2011/05/24 23:20:02.0656 1360 aswSP (39bf48164a958f4bf0c0ec6cdc447db5) C:\WINDOWS\system32\drivers\aswSP.sys
2011/05/24 23:20:03.0343 1360 aswTdi (755e4afb683e3306886a0f4df02a1575) C:\WINDOWS\system32\drivers\aswTdi.sys
2011/05/24 23:20:03.0953 1360 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/05/24 23:20:04.0531 1360 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/05/24 23:20:05.0781 1360 ati2mtag (83f24e252908e59c4a7ef203bf7f4c02) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/05/24 23:20:06.0750 1360 atiide (899c9f94ed5ec5eff71aa6e17a084419) C:\WINDOWS\system32\DRIVERS\atiide.sys
2011/05/24 23:20:07.0265 1360 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/05/24 23:20:07.0812 1360 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/05/24 23:20:08.0484 1360 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/05/24 23:20:09.0078 1360 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/05/24 23:20:09.0672 1360 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/05/24 23:20:10.0437 1360 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/05/24 23:20:10.0968 1360 caboagp (10d5fb74ee18ea49c30daaa203c0e0ec) C:\WINDOWS\system32\DRIVERS\atisgkaf.sys
2011/05/24 23:20:11.0640 1360 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/05/24 23:20:12.0687 1360 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/05/24 23:20:13.0328 1360 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/05/24 23:20:13.0812 1360 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/05/24 23:20:14.0875 1360 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/05/24 23:20:15.0843 1360 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/05/24 23:20:17.0656 1360 DevUpper (5dc28c3458fcc7258edd9f817bad8cc7) C:\WINDOWS\system32\DRIVERS\tiumflt.sys
2011/05/24 23:20:18.0187 1360 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/05/24 23:20:19.0078 1360 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/05/24 23:20:20.0047 1360 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/05/24 23:20:20.0625 1360 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/05/24 23:20:21.0203 1360 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/05/24 23:20:22.0234 1360 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/05/24 23:20:22.0765 1360 eabfiltr (81b7808d3b5892388f33273119c2dc31) C:\WINDOWS\system32\drivers\EABFiltr.sys
2011/05/24 23:20:23.0406 1360 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/05/24 23:20:24.0047 1360 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/05/24 23:20:24.0562 1360 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/05/24 23:20:25.0187 1360 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/05/24 23:20:25.0765 1360 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/05/24 23:20:26.0718 1360 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/05/24 23:20:27.0297 1360 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/05/24 23:20:27.0843 1360 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/05/24 23:20:28.0375 1360 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/05/24 23:20:29.0031 1360 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/05/24 23:20:30.0156 1360 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/05/24 23:20:30.0828 1360 hwdatacard (4a77f036f7234ed24351ac486d2a29b9) C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
2011/05/24 23:20:32.0328 1360 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/05/24 23:20:32.0937 1360 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/05/24 23:20:34.0390 1360 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/05/24 23:20:35.0093 1360 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/05/24 23:20:35.0656 1360 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/05/24 23:20:36.0250 1360 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/05/24 23:20:36.0828 1360 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/05/24 23:20:37.0406 1360 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/05/24 23:20:38.0031 1360 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/05/24 23:20:38.0547 1360 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
2011/05/24 23:20:39.0125 1360 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/05/24 23:20:39.0625 1360 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/05/24 23:20:40.0203 1360 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/05/24 23:20:40.0812 1360 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/05/24 23:20:41.0515 1360 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/05/24 23:20:42.0515 1360 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/05/24 23:20:43.0109 1360 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/05/24 23:20:43.0672 1360 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/05/24 23:20:44.0218 1360 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/05/24 23:20:44.0781 1360 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/05/24 23:20:45.0812 1360 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/05/24 23:20:46.0547 1360 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/05/24 23:20:47.0234 1360 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/05/24 23:20:47.0734 1360 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/05/24 23:20:48.0297 1360 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/05/24 23:20:48.0828 1360 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/05/24 23:20:49.0375 1360 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/05/24 23:20:49.0937 1360 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/05/24 23:20:50.0453 1360 NCHSSVAD (0df9cc7b5cc173f545723f23e68fac93) C:\WINDOWS\system32\drivers\nchssvad.sys
2011/05/24 23:20:51.0140 1360 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/05/24 23:20:51.0687 1360 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/05/24 23:20:52.0234 1360 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/05/24 23:20:52.0812 1360 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/05/24 23:20:53.0422 1360 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/05/24 23:20:54.0015 1360 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/05/24 23:20:54.0593 1360 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/05/24 23:20:55.0609 1360 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/05/24 23:20:56.0172 1360 nm (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
2011/05/24 23:20:56.0718 1360 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/05/24 23:20:57.0297 1360 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/05/24 23:20:57.0922 1360 nmwcdnsu (338f83ee9cb9e15eeacf0cbb90218cbf) C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2011/05/24 23:20:58.0531 1360 nmwcdnsuc (d15bac979144fb69ed28f97b2dd84d48) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2011/05/24 23:20:59.0140 1360 NPF (b15e0180c43d8b5219196d76878cc2dd) C:\WINDOWS\system32\drivers\npf.sys
2011/05/24 23:20:59.0687 1360 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/05/24 23:21:00.0562 1360 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/05/24 23:21:01.0359 1360 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/05/24 23:21:01.0859 1360 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/05/24 23:21:02.0390 1360 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/05/24 23:21:03.0031 1360 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/05/24 23:21:03.0593 1360 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/05/24 23:21:04.0187 1360 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/05/24 23:21:04.0672 1360 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/05/24 23:21:05.0203 1360 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/05/24 23:21:05.0812 1360 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/05/24 23:21:06.0734 1360 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/05/24 23:21:07.0265 1360 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/05/24 23:21:10.0422 1360 Point32 (b4f59a953ef9e507f0d00c3a68580b8b) C:\WINDOWS\system32\DRIVERS\point32.sys
2011/05/24 23:21:11.0000 1360 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/05/24 23:21:11.0578 1360 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/05/24 23:21:12.0172 1360 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/05/24 23:21:12.0797 1360 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/05/24 23:21:15.0453 1360 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/05/24 23:21:16.0031 1360 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/05/24 23:21:16.0593 1360 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/05/24 23:21:17.0156 1360 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/05/24 23:21:17.0672 1360 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/05/24 23:21:18.0312 1360 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/05/24 23:21:18.0828 1360 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/05/24 23:21:19.0422 1360 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/05/24 23:21:20.0078 1360 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/05/24 23:21:20.0718 1360 RTL8023 (265e3427e74cf322126c83e12c7869ec) C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys
2011/05/24 23:21:21.0312 1360 RTL8023xp (cf84b1f0e8b14d4120aaf9cf35cbb265) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
2011/05/24 23:21:21.0953 1360 rtl8139 (2ef9c0dc26b30b2318b1fc3faa1f0ae7) C:\WINDOWS\system32\DRIVERS\R8139n51.SYS
2011/05/24 23:21:22.0500 1360 SDVC05 (83a7fc4ebcdb9d75e88adf99a2213fc0) C:\WINDOWS\system32\Drivers\SDVC05.sys
2011/05/24 23:21:23.0078 1360 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/05/24 23:21:23.0656 1360 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/05/24 23:21:24.0234 1360 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/05/24 23:21:25.0500 1360 smwdm (66c7649b84f4d2aadf7e02cc9c4f6b68) C:\WINDOWS\system32\drivers\smwdm.sys
2011/05/24 23:21:26.0765 1360 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/05/24 23:21:27.0359 1360 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/05/24 23:21:28.0047 1360 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/05/24 23:21:28.0750 1360 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/05/24 23:21:29.0328 1360 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/05/24 23:21:29.0890 1360 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/05/24 23:21:32.0187 1360 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/05/24 23:21:32.0906 1360 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/05/24 23:21:34.0218 1360 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/05/24 23:21:34.0765 1360 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/05/24 23:21:35.0312 1360 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/05/24 23:21:35.0984 1360 tiumfwl (65e8e81c2f40abce9db98fd232f86bf8) C:\WINDOWS\system32\drivers\tiumfwl.sys
2011/05/24 23:21:36.0984 1360 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/05/24 23:21:38.0187 1360 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/05/24 23:21:38.0968 1360 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/05/24 23:21:39.0562 1360 USBAAPL (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/05/24 23:21:40.0140 1360 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/05/24 23:21:40.0718 1360 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/05/24 23:21:41.0312 1360 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/05/24 23:21:41.0859 1360 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/05/24 23:21:42.0359 1360 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/05/24 23:21:42.0937 1360 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
2011/05/24 23:21:43.0484 1360 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/05/24 23:21:44.0078 1360 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/05/24 23:21:44.0625 1360 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/05/24 23:21:45.0687 1360 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/05/24 23:21:46.0359 1360 W8335XP (738244934c71118a21f8d678067d057d) C:\WINDOWS\system32\DRIVERS\WG511v2XP.sys
2011/05/24 23:21:47.0000 1360 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/05/24 23:21:47.0718 1360 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/05/24 23:21:48.0953 1360 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/05/24 23:21:49.0593 1360 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/05/24 23:21:50.0250 1360 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/05/24 23:21:50.0797 1360 Wpsnuio (b3eb8a41eedafc62902f081851f7ba48) C:\WINDOWS\system32\DRIVERS\wpsnuio.sys
2011/05/24 23:21:51.0375 1360 WudfPf (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/05/24 23:21:51.0953 1360 WudfRd (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/05/24 23:21:52.0172 1360 MBR (0x1B8) (2839639fa37b8353e792a2a30a12ced3) \Device\Harddisk0\DR0
2011/05/24 23:21:52.0203 1360 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/05/24 23:21:52.0203 1360 ================================================================================
2011/05/24 23:21:52.0203 1360 Scan finished
2011/05/24 23:21:52.0203 1360 ================================================================================
2011/05/24 23:21:52.0234 2632 Detected object count: 1
2011/05/24 23:21:52.0234 2632 Actual detected object count: 1
2011/05/24 23:23:19.0218 2632 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/24 23:23:19.0218 2632 \Device\Harddisk0\DR0 - ok
2011/05/24 23:23:19.0218 2632 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
2011/05/24 23:23:27.0109 1900 Deinitialize success

 

Thanks!

Okay ... pc seems to load faster and there aren't redirects! I can access MS update site but it just searches for hours ... still can't access to set automatic updates.
Unable to update AV - it seems to download then fails at installation.

Logs below :c)



aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-25 23:54:25
-----------------------------
23:54:25.921 OS Version: Windows 5.1.2600 Service Pack 3
23:54:25.921 Number of processors: 2 586 0x209
23:54:25.921 ComputerName: LEENIEHP UserName:
23:54:30.250 Initialize success
23:55:03.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
23:55:03.750 Disk 0 Vendor: ST94019A 3.09 Size: 38154MB BusType: 3
23:55:03.781 Disk 0 MBR read successfully
23:55:03.812 Disk 0 MBR scan
23:55:03.828 Disk 0 Windows XP default MBR code
23:55:03.843 Disk 0 scanning sectors +78124095
23:55:03.906 Disk 0 scanning C:\WINDOWS\system32\drivers
23:55:38.984 Service scanning
23:55:44.328 Disk 0 trace - called modules:
23:55:44.343 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys atiide.sys
23:55:44.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83b62ab8]
23:55:44.359 3 CLASSPNP.SYS[f7f81fd7] -> nt!IofCallDriver -> \Device\0000007f[0x83b8bf18]
23:55:44.359 5 ACPI.sys[f7ed8620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x83b68940]
23:55:44.375 Scan finished successfully
23:56:16.468 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Michael and Arlene\Desktop\MBR.dat "
23:56:16.468 The log file has been saved successfully to "C:\Documents and Settings\Michael and Arlene\Desktop\aswMBR.txt "

==================================================================

ComboFix 11-05-24.06 - Michael and Arlene 26/05/2011 0:08.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.703.321 [GMT 10:00]
Running from: c:\documents and settings\Michael and Arlene\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Files Created from 2011-04-25 to 2011-05-25 )))))))))))))))))))))))))))))))
.
.
2011-05-25 11:55 . 2011-05-09 20:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{7547A8B3-5ACA-4749-B458-FB6A528A26FE}\mpengine.dll
2011-05-24 13:34 . 2011-05-24 13:34 -------- d-sh--w- c:\documents and settings\Michael and Arlene\PrivacIE
2011-05-24 12:44 . 2011-05-24 12:44 -------- d-sh--w- c:\documents and settings\Michael and Arlene\IECompatCache
2011-05-24 07:21 . 2011-05-24 07:21 -------- d-sh--w- c:\documents and settings\Michael and Arlene\IETldCache
2011-05-23 16:14 . 2011-05-23 16:20 -------- dc-h--w- c:\windows\ie8
2011-05-22 08:14 . 2011-05-25 14:07 -------- d-----w- c:\windows\system32\CatRoot2
2011-05-21 15:31 . 2011-05-21 15:31 -------- d-----w- c:\program files\Uniblue
2011-05-21 15:31 . 2011-05-21 15:31 -------- d-----w- c:\documents and settings\Michael and Arlene\Local Settings\Application Data\PackageAware
2011-05-20 18:57 . 2011-05-23 12:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-05-20 16:53 . 2011-05-20 16:53 388096 ----a-r- c:\documents and settings\Michael and Arlene\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-20 16:53 . 2011-05-20 16:53 -------- d-----w- c:\program files\Trend Micro
2011-05-20 16:26 . 2011-05-20 16:29 -------- d-----w- c:\documents and settings\Michael and Arlene\Local Settings\Application Data\Google
2011-05-20 15:28 . 2011-05-20 15:28 8192 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-05-20 15:28 . 2011-05-20 15:28 140864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-05-20 15:27 . 2011-05-20 15:27 94208 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2011-05-20 15:27 . 2011-05-20 15:27 -------- d-----w- c:\program files\Common Files\xing shared
2011-05-20 15:25 . 2011-05-20 15:25 569397 ----a-w- c:\program files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll
2011-05-20 15:07 . 2011-05-20 15:07 -------- d-----w- c:\program files\AnvSoft
2011-05-20 15:07 . 2011-05-21 15:29 -------- d-----w- c:\program files\Any Video Converter Professional
2011-05-20 13:21 . 2011-05-20 16:07 -------- dc----w- C:\OutputFolder
2011-05-20 13:21 . 2011-05-20 13:21 -------- d-----w- c:\program files\Digiarty
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2011-05-16 12:52 . 2011-05-16 12:52 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-16 12:52 . 2011-05-16 12:52 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-16 12:52 . 2011-05-16 12:52 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-16 12:52 . 2011-05-16 12:52 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-16 12:52 . 2011-05-16 12:52 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-16 12:51 . 2011-05-16 12:52 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-16 12:51 . 2011-05-16 12:51 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-16 12:51 . 2011-05-16 12:51 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-15 04:35 . 2011-05-15 04:35 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-09 20:46 . 2007-06-16 15:42 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-04-06 06:20 . 2011-04-06 06:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 06:20 . 2011-04-06 06:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-19 01:54 . 2010-07-05 11:37 137656 -c--a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-07 05:33 . 2007-06-16 07:12 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys
2009-01-16 06:09 . 2009-01-16 06:08 3989706 -c--a-w- c:\program files\Common Files\keysetup.exe
2011-05-16 12:51 . 2011-05-16 12:51 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-23_11.34.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-06-16 11:59 . 2009-01-07 08:21 26144 c:\windows\system32\spupdsvc.exe
- 2007-06-16 11:59 . 2008-11-07 08:55 26144 c:\windows\system32\spupdsvc.exe
+ 2009-01-16 13:46 . 2009-01-07 08:20 16928 c:\windows\system32\spmsg.dll
- 2009-01-16 13:46 . 2008-11-07 08:55 16928 c:\windows\system32\spmsg.dll
+ 2004-08-04 12:00 . 2009-03-07 18:31 46592 c:\windows\system32\pngfilt.dll
- 2006-06-28 21:05 . 2009-01-07 07:20 23552 c:\windows\system32\normaliz.dll
+ 2006-06-28 21:05 . 2009-01-07 08:20 23552 c:\windows\system32\normaliz.dll
+ 2006-06-28 06:59 . 2009-01-07 08:20 24576 c:\windows\system32\nlsdl.dll
- 2006-06-28 06:59 . 2009-01-07 07:20 24576 c:\windows\system32\nlsdl.dll
- 2004-08-04 12:00 . 2007-08-13 07:01 48128 c:\windows\system32\mshtmler.dll
+ 2004-08-04 12:00 . 2009-03-07 18:31 48128 c:\windows\system32\mshtmler.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 66560 c:\windows\system32\mshtmled.dll
+ 2004-08-04 12:00 . 2009-03-07 18:31 45568 c:\windows\system32\mshta.exe
- 2004-08-04 12:00 . 2007-08-13 07:32 45568 c:\windows\system32\mshta.exe
+ 2007-08-13 07:36 . 2009-03-07 18:31 13312 c:\windows\system32\msfeedssync.exe
+ 2007-08-13 07:54 . 2011-02-22 23:06 55296 c:\windows\system32\msfeedsbs.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 43520 c:\windows\system32\licmgr10.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 94720 c:\windows\system32\inseng.dll
+ 2004-08-04 12:00 . 2009-03-07 18:31 34816 c:\windows\system32\imgutil.dll
+ 2007-08-13 07:39 . 2009-03-07 18:32 36864 c:\windows\system32\ieudinit.exe
- 2007-08-13 07:39 . 2009-03-07 17:32 36864 c:\windows\system32\ieudinit.exe
+ 2004-08-04 12:00 . 2009-03-07 18:32 71680 c:\windows\system32\iesetup.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 55808 c:\windows\system32\iernonce.dll
+ 2006-06-28 21:05 . 2009-01-07 08:20 26112 c:\windows\system32\idndl.dll
- 2006-06-28 21:05 . 2009-01-07 07:20 26112 c:\windows\system32\idndl.dll
+ 2007-08-13 07:36 . 2009-03-07 18:31 59904 c:\windows\system32\icardie.dll
- 2009-08-05 13:47 . 2010-06-24 12:22 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-08-05 13:47 . 2011-02-22 23:06 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2007-08-13 07:36 . 2009-03-07 18:31 46592 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-08-13 07:01 . 2009-03-07 18:31 48128 c:\windows\system32\dllcache\mshtmler.dll
- 2007-08-13 07:01 . 2007-08-13 07:01 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2007-08-13 07:54 . 2011-02-22 23:06 66560 c:\windows\system32\dllcache\mshtmled.dll
- 2007-08-13 07:32 . 2007-08-13 07:32 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-08-13 07:32 . 2009-03-07 18:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2009-03-28 07:06 . 2011-02-22 23:06 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-08-13 07:44 . 2011-02-22 23:06 43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2007-08-13 07:39 . 2009-03-07 18:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2007-08-13 07:36 . 2009-03-07 18:31 34816 c:\windows\system32\dllcache\imgutil.dll
+ 2007-08-13 07:39 . 2009-03-07 18:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2007-08-13 07:39 . 2009-03-07 18:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2009-03-28 07:06 . 2009-03-07 18:31 59904 c:\windows\system32\dllcache\icardie.dll
+ 2007-08-13 07:18 . 2009-03-07 18:24 68608 c:\windows\system32\dllcache\hmmapi.dll
+ 2007-08-13 07:42 . 2009-03-07 18:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 2004-08-04 12:00 . 2009-03-07 18:33 18944 c:\windows\system32\corpol.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 72704 c:\windows\system32\admparse.dll
- 2011-04-16 14:26 . 2011-04-16 14:26 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2011-05-25 11:56 . 2011-05-25 11:56 34632 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2011-05-25 12:02 . 2009-03-07 18:33 12288 c:\windows\ie8updates\KB2497640-IE8\xpshims.dll
+ 2011-05-25 12:02 . 2009-03-07 18:31 66560 c:\windows\ie8updates\KB2497640-IE8\mshtmled.dll
+ 2011-05-25 12:02 . 2009-03-07 18:31 55296 c:\windows\ie8updates\KB2497640-IE8\msfeedsbs.dll
+ 2011-05-25 12:02 . 2009-03-07 18:34 43008 c:\windows\ie8updates\KB2497640-IE8\licmgr10.dll
+ 2011-05-25 12:02 . 2009-03-07 18:33 25600 c:\windows\ie8updates\KB2497640-IE8\jsproxy.dll
+ 2011-05-23 16:17 . 2009-03-08 04:23 58464 c:\windows\ie8\spuninst\iecustom.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 44544 c:\windows\ie8\pngfilt.dll
+ 2011-05-23 16:15 . 2007-08-13 07:01 48128 c:\windows\ie8\mshtmler.dll
+ 2011-05-23 16:15 . 2007-08-13 07:32 45568 c:\windows\ie8\mshta.exe
+ 2011-05-23 16:15 . 2007-08-13 07:36 12288 c:\windows\ie8\msfeedssync.exe
+ 2011-05-23 16:15 . 2011-02-17 19:00 52224 c:\windows\ie8\msfeedsbs.dll
+ 2011-05-23 16:15 . 2007-08-13 07:44 40960 c:\windows\ie8\licmgr10.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 27648 c:\windows\ie8\jsproxy.dll
+ 2011-05-23 16:15 . 2007-08-13 07:39 92672 c:\windows\ie8\inseng.dll
+ 2011-05-23 16:15 . 2007-08-13 07:36 36352 c:\windows\ie8\imgutil.dll
+ 2011-05-23 16:15 . 2007-08-13 07:39 55296 c:\windows\ie8\iesetup.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 44544 c:\windows\ie8\iernonce.dll
+ 2011-05-23 16:14 . 2011-02-17 19:00 78336 c:\windows\ie8\ieencode.dll
+ 2011-05-23 16:15 . 2011-02-17 11:43 70656 c:\windows\ie8\ie4uinit.exe
+ 2011-05-23 16:15 . 2011-02-17 19:00 63488 c:\windows\ie8\icardie.dll
+ 2011-05-23 16:15 . 2007-08-13 07:18 60416 c:\windows\ie8\hmmapi.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 17408 c:\windows\ie8\corpol.dll
+ 2011-05-23 16:15 . 2007-08-13 07:39 71680 c:\windows\ie8\admparse.dll
- 2009-02-18 05:10 . 2009-02-18 05:10 9846 c:\windows\system32\mswhncorem.dll
+ 2009-01-15 11:54 . 2009-01-15 11:54 9846 c:\windows\system32\mswhncorem.dll
+ 2008-05-09 09:45 . 2009-01-07 08:21 121856 c:\windows\system32\xmllite.dll
- 2008-05-09 09:45 . 2009-01-07 07:21 121856 c:\windows\system32\xmllite.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 916480 c:\windows\system32\wininet.dll
+ 2007-08-13 07:45 . 2009-03-07 18:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 2004-08-04 12:00 . 2009-03-07 18:34 236544 c:\windows\system32\webcheck.dll
- 2004-08-04 12:00 . 2011-02-17 19:00 105984 c:\windows\system32\url.dll
+ 2004-08-04 12:00 . 2009-03-07 18:34 105984 c:\windows\system32\url.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 206848 c:\windows\system32\occache.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 611840 c:\windows\system32\mstime.dll
+ 2004-08-04 12:00 . 2009-03-07 18:34 193536 c:\windows\system32\msrating.dll
+ 2004-08-04 12:00 . 2009-03-07 18:22 156160 c:\windows\system32\msls31.dll
- 2004-08-04 12:00 . 2007-08-13 07:54 156160 c:\windows\system32\msls31.dll
+ 2007-08-13 07:54 . 2011-02-22 23:06 602112 c:\windows\system32\msfeeds.dll
- 2010-05-16 07:45 . 2010-05-16 07:45 131072 c:\windows\system32\mseHneernm.dll
+ 2011-01-25 13:31 . 2011-01-25 13:31 131072 c:\windows\system32\mseHneernm.dll
+ 2009-01-07 08:20 . 2009-01-07 08:20 265720 c:\windows\system32\msdbg2.dll
- 2009-01-07 08:20 . 2009-01-07 07:20 265720 c:\windows\system32\msdbg2.dll
+ 2004-08-04 12:00 . 2011-03-04 06:37 726528 c:\windows\system32\jscript.dll
+ 2007-08-13 07:54 . 2009-03-07 18:22 164352 c:\windows\system32\ieui.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 387584 c:\windows\system32\iedkcs32.dll
+ 2007-07-11 01:27 . 2009-03-07 18:11 445952 c:\windows\system32\ieapfltr.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 163840 c:\windows\system32\ieakui.dll
+ 2004-08-04 12:00 . 2009-03-07 18:33 229376 c:\windows\system32\ieaksie.dll
+ 2004-08-04 12:00 . 2009-03-07 18:33 125952 c:\windows\system32\ieakeng.dll
+ 2004-08-04 12:00 . 2011-02-18 11:49 173568 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 12:00 . 2009-03-07 18:31 216064 c:\windows\system32\dxtrans.dll
+ 2004-08-04 12:00 . 2009-03-07 18:31 348160 c:\windows\system32\dxtmsft.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 916480 c:\windows\system32\dllcache\wininet.dll
+ 2007-08-13 07:54 . 2009-03-07 18:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2007-08-13 07:54 . 2009-03-07 18:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2004-08-04 12:00 . 2011-03-04 06:37 420864 c:\windows\system32\dllcache\vbscript.dll
- 2004-08-04 12:00 . 2011-02-17 19:00 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 12:00 . 2009-03-07 18:34 105984 c:\windows\system32\dllcache\url.dll
+ 2009-01-07 08:20 . 2009-01-07 08:20 134144 c:\windows\system32\dllcache\sqmapi.dll
+ 2007-08-13 07:44 . 2011-02-22 23:06 206848 c:\windows\system32\dllcache\occache.dll
+ 2007-08-13 07:54 . 2011-02-22 23:06 611840 c:\windows\system32\dllcache\mstime.dll
+ 2007-08-13 07:44 . 2009-03-07 18:34 193536 c:\windows\system32\dllcache\msrating.dll
- 2004-08-04 12:00 . 2007-08-13 07:54 156160 c:\windows\system32\dllcache\msls31.dll
+ 2004-08-04 12:00 . 2009-03-07 18:22 156160 c:\windows\system32\dllcache\msls31.dll
+ 2009-03-28 07:06 . 2011-02-22 23:06 602112 c:\windows\system32\dllcache\msfeeds.dll
+ 2004-08-04 12:00 . 2011-03-04 06:37 726528 c:\windows\system32\dllcache\jscript.dll
+ 2007-08-13 07:43 . 2009-03-08 04:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2009-08-05 13:47 . 2011-02-22 23:06 247808 c:\windows\system32\dllcache\ieproxy.dll
- 2009-08-05 13:47 . 2010-06-24 12:21 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2007-08-13 07:54 . 2011-02-22 23:06 184320 c:\windows\system32\dllcache\iepeers.dll
- 2010-06-09 12:19 . 2010-06-24 12:21 743424 c:\windows\system32\dllcache\iedvtool.dll
+ 2010-06-09 12:19 . 2011-02-22 23:06 743424 c:\windows\system32\dllcache\iedvtool.dll
+ 2007-08-13 07:39 . 2011-02-22 23:06 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-03-28 07:06 . 2009-03-07 18:11 445952 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2007-08-13 07:39 . 2009-03-07 18:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2007-08-13 07:39 . 2009-03-07 18:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2007-08-13 07:39 . 2011-02-18 11:49 173568 c:\windows\system32\dllcache\ie4uinit.exe
+ 2007-08-13 07:35 . 2009-03-07 18:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-08-13 07:35 . 2009-03-07 18:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2004-08-04 12:00 . 2009-03-07 18:32 128512 c:\windows\system32\advpack.dll
+ 2011-05-25 11:59 . 2009-03-07 18:33 420352 c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-05-25 11:59 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-05-25 11:59 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-05-25 11:59 . 2009-03-07 18:33 726528 c:\windows\ie8updates\KB2510531-IE8\jscript.dll
+ 2011-05-25 12:02 . 2009-03-07 18:34 914944 c:\windows\ie8updates\KB2497640-IE8\wininet.dll
+ 2011-05-25 12:02 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2497640-IE8\spuninst\updspapi.dll
+ 2011-05-25 12:02 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2497640-IE8\spuninst\spuninst.exe
+ 2011-05-25 12:02 . 2009-03-07 18:34 109568 c:\windows\ie8updates\KB2497640-IE8\occache.dll
+ 2011-05-25 12:02 . 2009-03-07 18:32 611840 c:\windows\ie8updates\KB2497640-IE8\mstime.dll
+ 2011-05-25 12:02 . 2009-03-07 18:32 594432 c:\windows\ie8updates\KB2497640-IE8\msfeeds.dll
+ 2011-05-25 12:02 . 2009-03-07 18:33 246784 c:\windows\ie8updates\KB2497640-IE8\ieproxy.dll
+ 2011-05-25 12:02 . 2009-03-07 18:31 183808 c:\windows\ie8updates\KB2497640-IE8\iepeers.dll
+ 2011-05-25 12:02 . 2009-03-07 18:35 742912 c:\windows\ie8updates\KB2497640-IE8\iedvtool.dll
+ 2011-05-25 12:02 . 2009-03-08 04:09 391536 c:\windows\ie8updates\KB2497640-IE8\iedkcs32.dll
+ 2011-05-25 12:02 . 2009-03-07 18:32 173056 c:\windows\ie8updates\KB2497640-IE8\ie4uinit.exe
+ 2011-05-23 16:15 . 2011-02-17 19:00 832512 c:\windows\ie8\wininet.dll
+ 2011-05-23 16:15 . 2007-08-13 07:45 206336 c:\windows\ie8\winfxdocobj.exe
+ 2011-05-23 16:15 . 2011-02-17 19:00 233472 c:\windows\ie8\webcheck.dll
+ 2011-05-23 16:15 . 2008-05-27 17:23 765952 c:\windows\ie8\vgx.dll
+ 2011-05-23 16:15 . 2011-03-04 06:45 434176 c:\windows\ie8\vbscript.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 105984 c:\windows\ie8\url.dll
+ 2011-05-23 16:17 . 2009-01-07 08:21 382496 c:\windows\ie8\spuninst\updspapi.dll
+ 2011-05-23 16:17 . 2009-01-07 08:20 231456 c:\windows\ie8\spuninst\spuninst.exe
+ 2011-05-23 16:14 . 2006-09-06 06:43 213216 c:\windows\ie8\spuninst.exe
+ 2011-05-23 16:15 . 2011-02-17 19:00 102912 c:\windows\ie8\occache.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 671232 c:\windows\ie8\mstime.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 193024 c:\windows\ie8\msrating.dll
+ 2011-05-23 16:15 . 2007-08-13 07:54 156160 c:\windows\ie8\msls31.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 478208 c:\windows\ie8\mshtmled.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 468480 c:\windows\ie8\msfeeds.dll
+ 2011-05-23 16:15 . 2011-03-04 06:45 512000 c:\windows\ie8\jscript.dll
+ 2011-05-23 16:15 . 2011-02-14 12:17 634648 c:\windows\ie8\iexplore.exe
+ 2011-05-23 16:15 . 2007-08-13 07:54 180736 c:\windows\ie8\ieui.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 268288 c:\windows\ie8\iertutil.dll
+ 2011-05-23 16:15 . 2007-08-13 07:54 287744 c:\windows\ie8\ieproxy.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 192512 c:\windows\ie8\iepeers.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 384512 c:\windows\ie8\iedkcs32.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 380928 c:\windows\ie8\ieapfltr.dll
+ 2011-05-23 16:15 . 2011-02-14 12:15 161792 c:\windows\ie8\ieakui.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 230400 c:\windows\ie8\ieaksie.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 153088 c:\windows\ie8\ieakeng.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 214528 c:\windows\ie8\dxtrans.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 347136 c:\windows\ie8\dxtmsft.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 124928 c:\windows\ie8\advpack.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 1210880 c:\windows\system32\urlmon.dll
+ 2004-08-04 12:00 . 2011-02-22 23:06 5962240 c:\windows\system32\mshtml.dll
+ 2007-08-13 07:34 . 2011-02-22 23:06 1991680 c:\windows\system32\iertutil.dll
+ 2007-02-12 05:10 . 2009-02-06 11:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2004-08-04 12:00 . 2011-02-22 23:06 1210880 c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-21 06:44 . 2011-02-22 23:06 5962240 c:\windows\system32\dllcache\mshtml.dll
+ 2009-03-28 07:06 . 2011-02-22 23:06 1991680 c:\windows\system32\dllcache\iertutil.dll
+ 2009-03-28 07:06 . 2009-02-06 11:07 3698584 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-10-16 08:07 . 2009-10-16 08:07 6115328 c:\windows\Installer\172214.msp
+ 2010-06-11 07:55 . 2010-06-11 07:55 1827328 c:\windows\Installer\17220f.msp
+ 2010-08-25 07:06 . 2010-08-25 07:06 6479360 c:\windows\Installer\172207.msp
+ 2011-04-29 02:30 . 2011-04-29 02:30 1197056 c:\windows\Installer\172205.msp
+ 2011-05-25 12:02 . 2009-03-07 18:34 1206784 c:\windows\ie8updates\KB2497640-IE8\urlmon.dll
+ 2011-05-25 12:02 . 2009-03-07 18:41 5937152 c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
+ 2011-05-25 12:02 . 2009-03-07 18:32 1985024 c:\windows\ie8updates\KB2497640-IE8\iertutil.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 1168384 c:\windows\ie8\urlmon.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 3607040 c:\windows\ie8\mshtml.dll
+ 2011-05-23 16:15 . 2011-02-17 19:00 6075904 c:\windows\ie8\ieframe.dll
+ 2011-05-23 16:15 . 2009-06-29 08:33 2452872 c:\windows\ie8\ieapfltr.dat
+ 2007-08-13 07:54 . 2011-02-22 23:06 11080704 c:\windows\system32\ieframe.dll
+ 2009-03-28 07:06 . 2011-02-22 23:06 11080704 c:\windows\system32\dllcache\ieframe.dll
+ 2010-06-11 07:52 . 2010-06-11 07:52 45542912 c:\windows\Installer\172210.msp
+ 2011-02-23 23:38 . 2011-02-23 23:38 10984448 c:\windows\Installer\17220b.msp
+ 2011-05-25 12:02 . 2009-03-07 18:39 11063808 c:\windows\ie8updates\KB2497640-IE8\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"einee "= "c:\program files\pnuikpamkrfh\jvtaoq.exe" [2006-06-14 1775267]
"phein "= "c:\program files\pnuikpamkrfh\jvtaoq.exe" [2006-06-14 1775267]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]
"einee "= "c:\program files\pnuikpamkrfh\jvtaoq.exe" [2006-06-14 1775267]
"phein "= "c:\program files\pnuikpamkrfh\jvtaoq.exe" [2006-06-14 1775267]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications "= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe "=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe "=
"c:\\Documents and Settings\\Michael and Arlene\\Application Data\\Dropbox\\bin\\Dropbox.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP "= 5985:TCP:*isabled:Windows Remote Management
.
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [16/06/2007 5:31 PM 5632]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/08/2009 10:50 PM 162640]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/07/2010 9:37 PM 136360]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/08/2009 10:50 PM 19024]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3/11/2006 7:19 PM 13592]
S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys --> c:\windows\system32\Drivers\fsbts.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 11:04 AM 135664]
S3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys --> c:\windows\system32\DRIVERS\avfsfilter.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 11:04 AM 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [7/12/2010 8:46 PM 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [7/12/2010 8:47 PM 8320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [26/01/2007 3:31 AM 42000]
S3 SDVC05;USB SDVC05;c:\windows\system32\drivers\SDVC05.sys [18/08/2007 10:20 PM 18088]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/08/2004 10:00 PM 14336]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 09:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ninemsn.com/
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
FF - ProfilePath - c:\documents and settings\Michael and Arlene\Application Data\Mozilla\Firefox\Profiles\ekrq2nw8.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 60283
FF - prefs.js: network.proxy.type - 4
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-26 00:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\system32\mseHneernm.dll 131072 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-436374069-842925246-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-436374069-842925246-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(732)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2480)
c:\windows\system32\WININET.dll
c:\windows\system32\mseHneernm.dll
c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WINSTA.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
.
Completion time: 2011-05-26 00:27:31
ComboFix-quarantined-files.txt 2011-05-25 14:27
ComboFix2.txt 2011-01-03 05:38
.
Pre-Run: 6,826,971,136 bytes free
Post-Run: 7,097,061,376 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
- - End Of File - - 9D5AA56B94D4B113F1387F51CC8097D5

 

Ummm I can't see Anvil Avast anywhere.

Nowhere in programs, in add/remove, in uruninstaller or regedit.

How do I get rid of it?

Arlene :c)

 

registry thingy all gone.

this script removes the keylogger I have on right? it's been on for 4ish years with no issues - cept for my hubby! lol

 

ComboFix 11-05-25.03 - Michael and Arlene 26/05/2011 22:42:10.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.703.350 [GMT 10:00]
Running from: c:\documents and settings\Michael and Arlene\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Michael and Arlene\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\windows\system32\mseHneernm.dll "
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\pnuikpamkrfh
c:\program files\pnuikpamkrfh\jvtaoq.exe
c:\program files\pnuikpamkrfh\Log\Text\beytxt.dat
c:\program files\pnuikpamkrfh\Log\Visual\05262011.dat
c:\program files\pnuikpamkrfh\unins000.dat
c:\program files\pnuikpamkrfh\unins000.exe
c:\windows\system32\mseHneernm.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-04-26 to 2011-05-26 )))))))))))))))))))))))))))))))
.
.
2011-05-25 11:55 . 2011-05-09 20:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{7547A8B3-5ACA-4749-B458-FB6A528A26FE}\mpengine.dll
2011-05-24 13:34 . 2011-05-24 13:34 -------- d-sh--w- c:\documents and settings\Michael and Arlene\PrivacIE
2011-05-24 12:44 . 2011-05-24 12:44 -------- d-sh--w- c:\documents and settings\Michael and Arlene\IECompatCache
2011-05-24 07:21 . 2011-05-24 07:21 -------- d-sh--w- c:\documents and settings\Michael and Arlene\IETldCache
2011-05-23 16:14 . 2011-05-23 16:20 -------- dc-h--w- c:\windows\ie8
2011-05-22 08:14 . 2011-05-26 12:59 -------- d-----w- c:\windows\system32\CatRoot2
2011-05-21 15:31 . 2011-05-21 15:31 -------- d-----w- c:\documents and settings\Michael and Arlene\Local Settings\Application Data\PackageAware
2011-05-20 18:57 . 2011-05-23 12:31 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-05-20 16:53 . 2011-05-20 16:53 388096 ----a-r- c:\documents and settings\Michael and Arlene\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-20 16:53 . 2011-05-20 16:53 -------- d-----w- c:\program files\Trend Micro
2011-05-20 16:26 . 2011-05-25 14:34 -------- d-----w- c:\documents and settings\Michael and Arlene\Local Settings\Application Data\Google
2011-05-20 15:28 . 2011-05-20 15:28 8192 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-05-20 15:28 . 2011-05-20 15:28 140864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-05-20 15:27 . 2011-05-20 15:27 94208 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2011-05-20 15:27 . 2011-05-20 15:27 -------- d-----w- c:\program files\Common Files\xing shared
2011-05-20 15:25 . 2011-05-20 15:25 569397 ----a-w- c:\program files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll
2011-05-20 15:07 . 2011-05-20 15:07 -------- d-----w- c:\program files\AnvSoft
2011-05-20 15:07 . 2011-05-21 15:29 -------- d-----w- c:\program files\Any Video Converter Professional
2011-05-20 13:21 . 2011-05-20 16:07 -------- dc----w- C:\OutputFolder
2011-05-20 13:21 . 2011-05-20 13:21 -------- d-----w- c:\program files\Digiarty
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2011-05-20 12:59 . 2011-05-20 12:59 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2011-05-16 12:52 . 2011-05-16 12:52 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-16 12:52 . 2011-05-16 12:52 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-16 12:52 . 2011-05-16 12:52 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-16 12:52 . 2011-05-16 12:52 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-16 12:52 . 2011-05-16 12:52 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-16 12:51 . 2011-05-16 12:52 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-16 12:51 . 2011-05-16 12:51 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-16 12:51 . 2011-05-16 12:51 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-15 04:35 . 2011-05-15 04:35 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-09 20:46 . 2007-06-16 15:42 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-04-06 06:20 . 2011-04-06 06:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 06:20 . 2011-04-06 06:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-19 01:54 . 2010-07-05 11:37 137656 -c--a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-07 05:33 . 2007-06-16 07:12 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys
2009-01-16 06:09 . 2009-01-16 06:08 3989706 -c--a-w- c:\program files\Common Files\keysetup.exe
2011-05-16 12:51 . 2011-05-16 12:51 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ----a-w- c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-16 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe "=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe "=
"c:\\Documents and Settings\\Michael and Arlene\\Application Data\\Dropbox\\bin\\Dropbox.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP "= 5985:TCP:*isabled:Windows Remote Management
.
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [16/06/2007 5:31 PM 5632]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/08/2009 10:50 PM 162640]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/07/2010 9:37 PM 136360]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/08/2009 10:50 PM 19024]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3/11/2006 7:19 PM 13592]
S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys --> c:\windows\system32\Drivers\fsbts.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 11:04 AM 135664]
S3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys --> c:\windows\system32\DRIVERS\avfsfilter.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 11:04 AM 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [7/12/2010 8:46 PM 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [7/12/2010 8:47 PM 8320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [26/01/2007 3:31 AM 42000]
S3 SDVC05;USB SDVC05;c:\windows\system32\drivers\SDVC05.sys [18/08/2007 10:20 PM 18088]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/08/2004 10:00 PM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 09:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ninemsn.com/
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
FF - ProfilePath - c:\documents and settings\Michael and Arlene\Application Data\Mozilla\Firefox\Profiles\ekrq2nw8.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 60283
FF - prefs.js: network.proxy.type - 4
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-26 23:00
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-436374069-842925246-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-436374069-842925246-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(732)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2488)
c:\windows\system32\WININET.dll
c:\documents and settings\Michael and Arlene\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\WINSTA.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\Ati2evxx.exe
.
**************************************************************************
.
Completion time: 2011-05-26 23:10:30 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-26 13:10
ComboFix2.txt 2011-05-25 14:27
ComboFix3.txt 2011-01-03 05:38
.
Pre-Run: 7,245,594,624 bytes free
Post-Run: 7,269,138,432 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
Current=4 Default=4 Failed=2 LastKnownGood=3 Sets=1,2,3,4
- - End Of File - - 9CE7701E5428CEEF36527F2B4823EA8A

 

yup ... but I can reinstall it when (if ever) I need it again :c)