Solved Alureon virus (?) major problems

[Resolved] Alureon virus (?) major problems

Hello,
I am having major problems with a suspect virus that will not go away and is slowly taking over my computer. microsoft sec. essentials detects it immidiately after any startup but can only quarrantine it not remove it and it after only about 5 minutes creates its own facade or overlay on my screen is the only way i can explain it (it tries to copy the normal os but the start button goes from green and oval to grey and square) I have mwbam installed and ms sec ess but to no avail. i have downloaded all of the 4 programs and ran the diagnostics that you have requested and here they are:

1.) Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6950

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

6/27/2011 12:47:08 PM
mbam-log-2011-06-27 (12-47-08).txt

Scan type: Quick scan
Objects scanned: 244376
Time elapsed: 27 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

2.)
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-25 20:53:30
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD1600AVJB-63J5A0 rev.01.03E01
Running: rxuy0xvn.exe; Driver: C:\DOCUME~1\James\LOCALS~1\Temp\awryapog.sys


---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[132] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CD000A
.text C:\WINDOWS\Explorer.EXE[132] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00CE000A
.text C:\WINDOWS\Explorer.EXE[132] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C7000C
.text C:\Program Files\Internet Explorer\iexplore.exe[584] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00E5000A
.text C:\Program Files\Internet Explorer\iexplore.exe[584] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E6000A
.text C:\Program Files\Internet Explorer\iexplore.exe[584] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B3000C
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!UnhookWindowsHookEx 7E41F21E 5 Bytes JMP 3E25467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!CallNextHookEx 7E41F85B 5 Bytes JMP 3E2DD0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!SetWindowsHookExW 7E42DDB5 5 Bytes JMP 3E2E9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 3E2EDB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[584] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E3E4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007D000A
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 007E000A
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 007C000C
.text C:\WINDOWS\System32\svchost.exe[1084] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00C3000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00E5000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E6000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B3000C
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2692] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B3000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E5000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B2000C
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!UnhookWindowsHookEx 7E41F21E 5 Bytes JMP 3E25467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!CallNextHookEx 7E41F85B 5 Bytes JMP 3E2DD0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!CreateWindowExW 7E41FC25 5 Bytes JMP 3E2EDB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!SetWindowsHookExW 7E42DDB5 5 Bytes JMP 3E2E9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 3E3E480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 3E3E4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 3E3E47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 3E3E4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 3E3E4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 3E3E4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 3E3E46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 3E2EDB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3512] ole32.dll!OleLoadFromStream 7752A257 5 Bytes JMP 3E3E4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\iexplore.exe[3512] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \Driver\prodrv06 \Device\ProDrv06 E1C98C30
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8A5E833B

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

3.)
aswMBR version 0.9.7.675 Copyright(c) 2011 AVAST Software
Run date: 2011-06-27 12:03:52
-----------------------------
12:03:52.343 OS Version: Windows 5.1.2600 Service Pack 2
12:03:52.343 Number of processors: 1 586 0x209
12:03:52.343 ComputerName: LIVINGROOM UserName: James
12:03:52.906 Initialize success
12:04:06.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
12:04:06.343 Disk 0 Vendor: WDC_WD1600AVJB-63J5A0 01.03E01 Size: 152627MB BusType: 3
12:04:06.343 Device \Driver\atapi -> DriverStartIo 8a5e833b
12:04:08.343 Disk 0 MBR read successfully
12:04:08.343 Disk 0 MBR scan
12:04:08.343 Disk 0 TDL4@MBR code has been found
12:04:08.343 Disk 0 Windows XP default MBR code found via API
12:04:08.343 Disk 0 MBR hidden
12:04:08.343 Disk 0 MBR [TDL4] **ROOTKIT**
12:04:08.343 Disk 0 trace - called modules:
12:04:08.343 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8a5e84f0]<<
12:04:08.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a5b8ab8]
12:04:08.359 3 CLASSPNP.SYS[f763805b] -> nt!IofCallDriver -> [0x8a5c3cd0]
12:04:08.359 \Driver\atapi[0x8a621c08] -> IRP_MJ_CREATE -> 0x8a5e84f0
12:04:08.359 Scan finished successfully
12:04:34.812 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\James\Desktop\MBR.dat "
12:04:34.812 The log file has been saved successfully to "C:\Documents and Settings\James\Desktop\aswMBR.txt "


4.)
.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by James at 12:16:50 on 2011-06-27
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1429 [GMT -7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>;*.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {2A32EFE1-1ACD-4CF7-9F72-3C2CC28880A1} - No File
BHO: {3CEFE32A-6805-4F77-BBEE-DC3C32C0F9A6} - No File
BHO: {41833C93-EE9E-472F-9DB9-8CB402659890} - No File
BHO: {4664BAA6-DB16-4836-B878-EBA3338F3734} - No File
BHO: {542adc8c-4f73-4c17-9394-c0fd51d0398e} - No File
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {5C9E9E35-9524-4DCF-94F0-3F03AB5F88F8} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - No File
BHO: {6FED410D-73D1-4FB7-A466-B22FA391FA5D} - No File
BHO: {73BDEA63-5750-4ABB-A7E8-F079B2E370A4} - No File
BHO: {74BCF4CF-EB01-463A-8F3B-065286F9C275} - No File
BHO: {75AEE836-9155-44E0-96E7-7BA042ED6E74} - No File
BHO: {87a930ec-bc4b-4388-a3e5-2e574308fd84} - No File
BHO: {8963fe7a-d87a-4ff6-822a-0f5b437cd5f9} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: {AFB67358-50B6-46A8-8BBE-0B42980B91D3} - No File
BHO: {B2814E74-88CB-4A28-949E-1A4F99F6BDF9} - No File
BHO: {C28132D3-A042-D2B2-159B-AA8F032629EC} - No File
BHO: {C74F5288-9E3A-40B3-9423-6D9019A2CCF0} - No File
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
BHO: {D3F2AFFE-FCA4-4334-800C-5608ABF05B02} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {ED60C118-39A8-408C-8603-DE1B9BECCFCB} - No File
BHO: {FB55771D-45B3-44A4-BDBF-5E27D7D4DDCF} - No File
BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [PID] c:\docume~1\james\locals~1\temp\lt0vpamv.exe
uRun: [AntiVirus_AntiSpyware_2011] "c:\documents and settings\james\application data\antivirus_antispyware_2011\AntiVirus AntiSpyware.exe" /STARTUP
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [PivotSoftware] "c:\program files\portrait displays\pivot software\wpctrl.exe "
mRun: [DT ACR] c:\program files\common files\portrait displays\shared\DT_startup.exe -ACR
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://media.keytrain.com/player/IE/awswaxd.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} - hxxp://www.worldwinner.com/games/v41/freecell/freecell.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165536969073
DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} - hxxp://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://games.pogo.com/online2/pogo/bejeweled2/popcaploader_v6.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {ED60C118-39A8-408C-8603-DE1B9BECCFCB} - No File
LSA: Authentication Packages = msv1_0 c:\windows\system32\ljJYSklK
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 165264]
R1 MpKsl06ffcffe;MpKsl06ffcffe;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c9460285-6bce-43e2-a058-2c55ac9abaa6}\MpKsl06ffcffe.sys [2011-6-27 28752]
R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2010-1-16 266240]
R2 PdiService;Portrait Displays SDK Service;c:\program files\common files\portrait displays\drivers\pdisrvc.exe [2011-2-16 109168]
S1 lofpusik;lofpusik;c:\windows\system32\drivers\lofpusik.sys [2011-6-27 41680]
S1 MpKsl28583a7a;MpKsl28583a7a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{37b381fb-89fa-43ac-a2a8-8ccac7e1086a}\mpksl28583a7a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{37b381fb-89fa-43ac-a2a8-8ccac7e1086a}\MpKsl28583a7a.sys [?]
S1 MpKsl3b684326;MpKsl3b684326;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ed4e103c-01eb-415c-b4b4-4535e44aa3bf}\mpksl3b684326.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ed4e103c-01eb-415c-b4b4-4535e44aa3bf}\MpKsl3b684326.sys [?]
S1 MpKsla5197085;MpKsla5197085;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{90d430c6-00ed-4cb4-af43-90824f222e38}\mpksla5197085.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{90d430c6-00ed-4cb4-af43-90824f222e38}\MpKsla5197085.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664]
S2 HitmanPro35CrusaderBoot;Hitman Pro 3.5 Crusader (Boot); "c:\documents and settings\james\local settings\temporary internet files\content.ie5\6jlcfosk\hitmanpro35[1].exe" /crusader:boot --> c:\documents and settings\james\local settings\temporary internet files\content.ie5\6jlcfosk\HitmanPro35[1].exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-16 135664]
.
=============== Created Last 30 ================
.
2011-06-27 19:07:45 41680 ----a-w- c:\windows\system32\drivers\lofpusik.sys
2011-06-27 18:55:53 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c9460285-6bce-43e2-a058-2c55ac9abaa6}\MpKsl06ffcffe.sys
2011-06-26 02:14:00 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-26 02:13:53 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-26 00:17:50 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-23 07:41:20 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c9460285-6bce-43e2-a058-2c55ac9abaa6}\mpengine.dll
.
==================== Find3M ====================
.
2011-06-26 00:17:32 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-25 02:14:10 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-28 08:10:57 0 ----a-w- c:\windows\Xpoxohewazuco.bin
2011-04-26 16:57:29 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD1600AVJB-63J5A0 rev.01.03E01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A5E84F0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a5ee7d0]; MOV EAX, [0x8a5ee84c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8A5B8AB8]
3 CLASSPNP[0xF763805B] -> nt!IofCallDriver[0x804E37D5] -> [0x8A5C3CD0]
\Driver\atapi[0x8A621C08] -> IRP_MJ_CREATE -> 0x8A5E84F0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A5E833B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 12:18:39.73 ===============

5.)
the 5th files says don't send unless requested and says to "zip" it up, but i don't know how to do that....

 

I ran the TDSSKiller as asked and rebooted (it did in fact find the rootkit virus and cured it) then when the comp rebooted it si apparantly gone. I ran it again (TDSSKILLER) and found NOTHING!!!!! here is the log.

2011/07/01 13:45:06.0796 1744 TDSS rootkit removing tool 2.5.8.0 Jun 28 2011 19:12:16
2011/07/01 13:45:07.0562 1744 ================================================================================
2011/07/01 13:45:07.0562 1744 SystemInfo:
2011/07/01 13:45:07.0562 1744
2011/07/01 13:45:07.0562 1744 OS Version: 5.1.2600 ServicePack: 2.0
2011/07/01 13:45:07.0562 1744 Product type: Workstation
2011/07/01 13:45:07.0562 1744 ComputerName: LIVINGROOM
2011/07/01 13:45:07.0578 1744 UserName: James
2011/07/01 13:45:07.0578 1744 Windows directory: C:\WINDOWS
2011/07/01 13:45:07.0578 1744 System windows directory: C:\WINDOWS
2011/07/01 13:45:07.0578 1744 Processor architecture: Intel x86
2011/07/01 13:45:07.0578 1744 Number of processors: 1
2011/07/01 13:45:07.0578 1744 Page size: 0x1000
2011/07/01 13:45:07.0578 1744 Boot type: Normal boot
2011/07/01 13:45:07.0578 1744 ================================================================================
2011/07/01 13:45:08.0875 1744 Initialize success
2011/07/01 13:45:11.0703 2164 ================================================================================
2011/07/01 13:45:11.0703 2164 Scan started
2011/07/01 13:45:11.0703 2164 Mode: Manual;
2011/07/01 13:45:11.0703 2164 ================================================================================
2011/07/01 13:45:12.0328 2164 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
2011/07/01 13:45:12.0390 2164 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/01 13:45:12.0437 2164 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/01 13:45:12.0500 2164 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
2011/07/01 13:45:12.0546 2164 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
2011/07/01 13:45:12.0609 2164 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2011/07/01 13:45:12.0656 2164 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys
2011/07/01 13:45:12.0718 2164 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2011/07/01 13:45:12.0765 2164 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\System32\DRIVERS\agp440.sys
2011/07/01 13:45:12.0828 2164 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
2011/07/01 13:45:12.0890 2164 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
2011/07/01 13:45:12.0921 2164 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
2011/07/01 13:45:12.0968 2164 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
2011/07/01 13:45:13.0031 2164 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
2011/07/01 13:45:13.0062 2164 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\System32\DRIVERS\alim1541.sys
2011/07/01 13:45:13.0109 2164 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\System32\DRIVERS\amdagp.sys
2011/07/01 13:45:13.0140 2164 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
2011/07/01 13:45:13.0203 2164 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
2011/07/01 13:45:13.0234 2164 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
2011/07/01 13:45:13.0265 2164 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
2011/07/01 13:45:13.0359 2164 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/01 13:45:13.0421 2164 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/01 13:45:13.0484 2164 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/01 13:45:13.0562 2164 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/01 13:45:13.0640 2164 BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINDOWS\system32\DRIVERS\BCMSM.sys
2011/07/01 13:45:13.0703 2164 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/01 13:45:13.0953 2164 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
2011/07/01 13:45:14.0000 2164 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/01 13:45:14.0062 2164 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/07/01 13:45:14.0109 2164 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
2011/07/01 13:45:14.0156 2164 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/01 13:45:14.0203 2164 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/01 13:45:14.0265 2164 cdrbsdrv (351735695e9ead93de6af85d8beb1ca8) C:\WINDOWS\system32\drivers\cdrbsdrv.sys
2011/07/01 13:45:14.0312 2164 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/01 13:45:14.0421 2164 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\System32\DRIVERS\cmdide.sys
2011/07/01 13:45:14.0468 2164 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
2011/07/01 13:45:14.0562 2164 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
2011/07/01 13:45:14.0609 2164 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
2011/07/01 13:45:14.0687 2164 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/01 13:45:14.0796 2164 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/01 13:45:14.0859 2164 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/01 13:45:14.0890 2164 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/01 13:45:14.0953 2164 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/01 13:45:15.0031 2164 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
2011/07/01 13:45:15.0093 2164 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/01 13:45:15.0156 2164 drvmcdb (7f056a52bcba3102d2d37a4a2646c807) C:\WINDOWS\system32\drivers\drvmcdb.sys
2011/07/01 13:45:15.0218 2164 drvnddm (d3c1e501ed42e77574b3095309dd4075) C:\WINDOWS\system32\drivers\drvnddm.sys
2011/07/01 13:45:15.0796 2164 E100B (98b46b331404a951cabad8b4877e1276) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2011/07/01 13:45:15.0859 2164 EL90XBC (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys
2011/07/01 13:45:15.0921 2164 enodpl (b4556f3d468c8dcb0b259d9d866cd4c4) C:\WINDOWS\system32\drivers\enodpl.sys
2011/07/01 13:45:16.0000 2164 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/01 13:45:16.0046 2164 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/07/01 13:45:16.0093 2164 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/01 13:45:16.0140 2164 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/07/01 13:45:16.0187 2164 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/01 13:45:16.0234 2164 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/01 13:45:16.0281 2164 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/01 13:45:16.0328 2164 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2011/07/01 13:45:16.0375 2164 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/01 13:45:16.0468 2164 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/01 13:45:16.0562 2164 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
2011/07/01 13:45:16.0640 2164 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/01 13:45:16.0718 2164 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/07/01 13:45:16.0750 2164 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\System32\DRIVERS\i2omp.sys
2011/07/01 13:45:16.0796 2164 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/07/01 13:45:16.0843 2164 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
2011/07/01 13:45:16.0890 2164 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
2011/07/01 13:45:16.0921 2164 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
2011/07/01 13:45:16.0968 2164 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
2011/07/01 13:45:17.0015 2164 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
2011/07/01 13:45:17.0078 2164 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
2011/07/01 13:45:17.0125 2164 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
2011/07/01 13:45:17.0171 2164 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
2011/07/01 13:45:17.0234 2164 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
2011/07/01 13:45:17.0281 2164 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
2011/07/01 13:45:17.0359 2164 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/07/01 13:45:17.0453 2164 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/01 13:45:17.0546 2164 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
2011/07/01 13:45:17.0593 2164 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\System32\DRIVERS\intelide.sys
2011/07/01 13:45:17.0640 2164 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/01 13:45:17.0671 2164 ip6fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/01 13:45:17.0734 2164 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/01 13:45:17.0765 2164 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/01 13:45:17.0828 2164 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/01 13:45:17.0875 2164 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/01 13:45:17.0921 2164 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/01 13:45:18.0000 2164 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/01 13:45:18.0062 2164 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/01 13:45:18.0109 2164 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/01 13:45:18.0171 2164 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/01 13:45:18.0312 2164 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/01 13:45:18.0359 2164 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/01 13:45:18.0421 2164 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2011/07/01 13:45:18.0468 2164 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/01 13:45:18.0531 2164 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/01 13:45:18.0562 2164 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/01 13:45:18.0609 2164 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2011/07/01 13:45:18.0765 2164 MpKsl53f7aeaf (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl53f7aeaf.sys
2011/07/01 13:45:18.0875 2164 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
2011/07/01 13:45:18.0921 2164 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/01 13:45:19.0015 2164 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/01 13:45:19.0078 2164 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/01 13:45:19.0140 2164 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/01 13:45:19.0187 2164 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/01 13:45:19.0234 2164 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/01 13:45:19.0296 2164 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/01 13:45:19.0343 2164 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/07/01 13:45:19.0390 2164 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/01 13:45:19.0437 2164 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/07/01 13:45:19.0484 2164 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/01 13:45:19.0546 2164 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/07/01 13:45:19.0593 2164 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/01 13:45:19.0625 2164 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/01 13:45:19.0656 2164 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/01 13:45:19.0703 2164 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/01 13:45:19.0750 2164 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/01 13:45:19.0796 2164 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/01 13:45:19.0906 2164 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/01 13:45:19.0984 2164 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/01 13:45:20.0046 2164 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/01 13:45:20.0140 2164 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/07/01 13:45:20.0265 2164 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/01 13:45:20.0296 2164 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/01 13:45:20.0343 2164 omci (53d5f1278d9edb21689bbbcecc09108d) C:\WINDOWS\system32\DRIVERS\omci.sys
2011/07/01 13:45:20.0421 2164 P3 (3e16eff2a6fed2d8d7f5a66dfe65d183) C:\WINDOWS\system32\DRIVERS\p3.sys
2011/07/01 13:45:20.0453 2164 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/01 13:45:20.0500 2164 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/01 13:45:20.0562 2164 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/01 13:45:20.0609 2164 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/01 13:45:20.0687 2164 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/01 13:45:20.0734 2164 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/01 13:45:20.0859 2164 PdiPorts (3b2f443b8e23d17d46f0e43e2fc42cfe) C:\WINDOWS\system32\Drivers\PdiPorts.sys
2011/07/01 13:45:21.0015 2164 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
2011/07/01 13:45:21.0062 2164 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
2011/07/01 13:45:21.0156 2164 Pivot (943f840611d33832308ec5310b616b57) C:\WINDOWS\system32\drivers\pivot.sys
2011/07/01 13:45:21.0203 2164 pivotmou (998c58295288eedfbfe95e7f6cc94df4) C:\WINDOWS\system32\drivers\pivotmou.sys
2011/07/01 13:45:21.0296 2164 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/01 13:45:21.0343 2164 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/07/01 13:45:21.0500 2164 prodrv06 (f2e3c8f1eb6ba0733e0a1f6373df7957) C:\WINDOWS\System32\drivers\prodrv06.sys
2011/07/01 13:45:21.0750 2164 prohlp02 (150307b52807d0c493c605ab913038ad) C:\WINDOWS\system32\drivers\prohlp02.sys
2011/07/01 13:45:22.0359 2164 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/01 13:45:22.0390 2164 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/01 13:45:22.0437 2164 PxHelp20 (7e1eacdecba39e0b2a35306426f0decc) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
2011/07/01 13:45:22.0531 2164 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
2011/07/01 13:45:22.0609 2164 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
2011/07/01 13:45:22.0640 2164 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\System32\DRIVERS\ql12160.sys
2011/07/01 13:45:22.0671 2164 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
2011/07/01 13:45:22.0718 2164 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
2011/07/01 13:45:22.0765 2164 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/01 13:45:22.0828 2164 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/01 13:45:22.0875 2164 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/01 13:45:22.0906 2164 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/01 13:45:22.0968 2164 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/01 13:45:23.0015 2164 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/01 13:45:23.0078 2164 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/01 13:45:23.0156 2164 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/01 13:45:23.0234 2164 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/01 13:45:23.0375 2164 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/01 13:45:23.0437 2164 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/01 13:45:23.0500 2164 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/01 13:45:23.0562 2164 sfdrv01 (fca5dd901ed19b56b7ffca6fe1627edc) C:\WINDOWS\system32\drivers\sfdrv01.sys
2011/07/01 13:45:23.0656 2164 sfhlp01 (462aee0ea0481ea8bd45cac876a4ccc4) C:\WINDOWS\system32\drivers\sfhlp01.sys
2011/07/01 13:45:23.0703 2164 sfhlp02 (3ad2b15ccc03febfbaf5ff057822aa75) C:\WINDOWS\system32\drivers\sfhlp02.sys
2011/07/01 13:45:23.0765 2164 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/01 13:45:23.0875 2164 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\System32\DRIVERS\sisagp.sys
2011/07/01 13:45:23.0937 2164 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/07/01 13:45:24.0015 2164 smwdm (5018a9db5eb62e3edb3110f82f556285) C:\WINDOWS\system32\drivers\smwdm.sys
2011/07/01 13:45:24.0125 2164 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
2011/07/01 13:45:24.0187 2164 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/01 13:45:24.0250 2164 SQTECH905C (6f6a0307c30b33e65aaf52c46cea2ecd) C:\WINDOWS\system32\Drivers\Capt905c.sys
2011/07/01 13:45:24.0328 2164 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/01 13:45:24.0375 2164 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/01 13:45:24.0421 2164 sscdbhk5 (328e8bb94ec58480f60458fb4b8437a7) C:\WINDOWS\system32\drivers\sscdbhk5.sys
2011/07/01 13:45:24.0484 2164 ssrtln (7ec8b427cee5c0cdac066320b93f1355) C:\WINDOWS\system32\drivers\ssrtln.sys
2011/07/01 13:45:24.0593 2164 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/07/01 13:45:24.0640 2164 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/01 13:45:24.0703 2164 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/01 13:45:24.0796 2164 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
2011/07/01 13:45:24.0828 2164 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
2011/07/01 13:45:24.0875 2164 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
2011/07/01 13:45:24.0906 2164 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
2011/07/01 13:45:24.0968 2164 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/01 13:45:25.0031 2164 tandpl (126d7b3b4c7b724491c604060e1f4e14) C:\WINDOWS\system32\drivers\tandpl.sys
2011/07/01 13:45:25.0109 2164 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/01 13:45:25.0171 2164 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/01 13:45:25.0218 2164 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/01 13:45:25.0250 2164 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/01 13:45:25.0312 2164 tfsnboio (c229bf90443be8d3bd2b65d7f3ac0f35) C:\WINDOWS\system32\dla\tfsnboio.sys
2011/07/01 13:45:25.0375 2164 tfsncofs (79ee9fcd7728e54ab8fbc30962f0416f) C:\WINDOWS\system32\dla\tfsncofs.sys
2011/07/01 13:45:25.0437 2164 tfsndrct (9efb37e7de17d783a059b653f7e8afad) C:\WINDOWS\system32\dla\tfsndrct.sys
2011/07/01 13:45:25.0500 2164 tfsndres (130254995ebedcb34d62e8d78ec9dbd0) C:\WINDOWS\system32\dla\tfsndres.sys
2011/07/01 13:45:25.0562 2164 tfsnifs (9b40e1e4aeed849812a2e43a388a7e77) C:\WINDOWS\system32\dla\tfsnifs.sys
2011/07/01 13:45:25.0656 2164 tfsnopio (818047ad850b312705aa17ca96b9427d) C:\WINDOWS\system32\dla\tfsnopio.sys
2011/07/01 13:45:25.0703 2164 tfsnpool (4603e813bcc6dd465cd8d2afd37fa90d) C:\WINDOWS\system32\dla\tfsnpool.sys
2011/07/01 13:45:25.0765 2164 tfsnudf (6fc2cd904a9a55acfdfc780a611a75ed) C:\WINDOWS\system32\dla\tfsnudf.sys
2011/07/01 13:45:25.0843 2164 tfsnudfa (d4afa4d00f8db3fd1c15b3fe49c3a96c) C:\WINDOWS\system32\dla\tfsnudfa.sys
2011/07/01 13:45:26.0000 2164 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\System32\DRIVERS\toside.sys
2011/07/01 13:45:26.0062 2164 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/01 13:45:26.0109 2164 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
2011/07/01 13:45:26.0187 2164 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/01 13:45:26.0265 2164 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/07/01 13:45:26.0343 2164 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/01 13:45:26.0406 2164 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/01 13:45:26.0453 2164 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/01 13:45:26.0531 2164 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/07/01 13:45:26.0562 2164 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/07/01 13:45:26.0625 2164 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/01 13:45:26.0671 2164 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/01 13:45:26.0718 2164 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/07/01 13:45:26.0796 2164 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\System32\DRIVERS\viaagp.sys
2011/07/01 13:45:26.0828 2164 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\System32\DRIVERS\viaide.sys
2011/07/01 13:45:26.0875 2164 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/01 13:45:27.0015 2164 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/01 13:45:27.0125 2164 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/01 13:45:27.0281 2164 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/07/01 13:45:27.0312 2164 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/07/01 13:45:27.0390 2164 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/07/01 13:45:27.0437 2164 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/07/01 13:45:27.0500 2164 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/07/01 13:45:27.0609 2164 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys
2011/07/01 13:45:27.0671 2164 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys
2011/07/01 13:45:27.0703 2164 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/01 13:45:27.0890 2164 Boot (0x1200) (6795f34f41247053f450a4a776dfcb67) \Device\Harddisk0\DR0\Partition0
2011/07/01 13:45:27.0906 2164 ================================================================================
2011/07/01 13:45:27.0906 2164 Scan finished
2011/07/01 13:45:27.0906 2164 ================================================================================
2011/07/01 13:45:27.0921 2116 Detected object count: 0
2011/07/01 13:45:27.0921 2116 Actual detected object count: 0

 

Just wanted to let you know that by now the virus would have already taken over and MS SEC ESS would want to try to delete virus but would be unsuccessful and just reboot. So far nothing is happening (which is VERY GOOD) I believe you have solved this annoying dilema for me, but will wait for your final say. An early HUGE Thank you though for this, and when I get into a little bit better place financially I will definitely support this site too.

James

 

Ok, here is the last log you have asked for:

ComboFix 11-07-01.01 - James 07/01/2011 19:07:49.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1535 [GMT -7:00]
Running from: c:\documents and settings\James\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\D'Anne\WINDOWS
c:\documents and settings\James\Application Data\Adobe\plugs
c:\documents and settings\James\Application Data\Adobe\shed
c:\documents and settings\James\err.log
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome.manifest
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome\content\_cfg.js
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome\content\overlay.xul
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\install.rdf
c:\documents and settings\James\WINDOWS
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome.manifest
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome\content\_cfg.js
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome\content\overlay.xul
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\install.rdf
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome.manifest
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome\content\_cfg.js
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome\content\overlay.xul
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\install.rdf
c:\documents and settings\Kelsey\WINDOWS
c:\program files\Common Files\dobe~1
c:\program files\mantec~1
c:\program files\smante~1
c:\program files\wnsxs~1
c:\temp\fse
c:\temp\fse\tmpZTF.log
c:\windows\admintxt.txt
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\ppatch~1
c:\windows\pppatc~1
c:\windows\sks~1
c:\windows\sks~2
c:\windows\system32\ahgpqybn.ini
c:\windows\system32\bkymbbgr.ini
c:\windows\SYSTEM32\CbdLoUvw.ini
c:\windows\system32\CbdLoUvw.ini2
c:\windows\SYSTEM32\cbeeg.ini2
c:\windows\system32\deaflrbd.ini
c:\windows\system32\dgwmgbdt.ini
c:\windows\system32\FikTAcdd.ini
c:\windows\SYSTEM32\FikTAcdd.ini2
c:\windows\system32\fjweqlfv.ini
c:\windows\system32\ftkblqoe.ini
c:\windows\system32\fwqwfulx.ini
c:\windows\system32\gchivraa.ini
c:\windows\system32\gxaiefus.ini
c:\windows\system32\hoxsvaei.ini
c:\windows\system32\hpbjrnjx.ini
c:\windows\system32\hRqsuBeg.ini
c:\windows\SYSTEM32\hRqsuBeg.ini2
c:\windows\system32\irulstxl.ini
c:\windows\system32\ivsmtwng.ini
c:\windows\system32\kgqkbmbe.ini
c:\windows\SYSTEM32\KlkSYJjl.ini
c:\windows\system32\KlkSYJjl.ini2
c:\windows\system32\lfhdrcnv.ini
c:\windows\system32\lopXwyay.ini
c:\windows\system32\lopXwyay.ini2
c:\windows\SYSTEM32\MonnTvut.ini
c:\windows\SYSTEM32\MonnTvut.ini2
c:\windows\system32\mqfoxtog.ini
c:\windows\system32\napetrih.ini
c:\windows\SYSTEM32\NTtAcccf.ini
c:\windows\SYSTEM32\NTtAcccf.ini2
c:\windows\system32\ojhyegox.ini
c:\windows\system32\phltsdut.ini
c:\windows\system32\pkcgsmcg.ini
c:\windows\system32\pmipwjgq.ini
c:\windows\system32\QAIjlnnn.ini
c:\windows\system32\QAIjlnnn.ini2
c:\windows\system32\qsqlhyoc.ini
c:\windows\system32\qtgmhohq.ini
c:\windows\system32\racle~1
c:\windows\system32\sheoatyd.ini
c:\windows\system32\srcxhdxf.ini
c:\windows\system32\syvqodsk.ini
c:\windows\SYSTEM32\TAcIPXyb.ini
c:\windows\SYSTEM32\TAcIPXyb.ini2
c:\windows\SYSTEM32\tsDegfii.ini
c:\windows\system32\tsDegfii.ini2
c:\windows\system32\uddmqiod.ini
c:\windows\system32\wdwaomlx.ini
c:\windows\system32\wiqdtiwd.ini
c:\windows\system32\wlxwudgg.ini
c:\windows\system32\wskbtcpi.ini
c:\windows\system32\xlcbiyys.ini
c:\windows\system32\xvlckduv.ini
c:\windows\system32\ydbtunoi.ini
c:\windows\system32\ystem~1
c:\windows\wnsxs~1
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.

 

I believe that is all of the logs you have asked for, I have not ran programs or installed any more since my last post. The computer is running great with no problems as of yet. Does it have a clean bill of health or do you need more info?

 

when i try to post the attach.txt it says i have 60 images and I have no idea what that means or how to fix it, so i will post in sections i guess.


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 1/21/2004 5:56:52 PM
System Uptime: 6/27/2011 11:55:25 AM (1 hours ago)
.
Motherboard: Dell Computer Corp. | | 0N2828
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz | Microprocessor | 2660/533mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 117.63 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1481: 3/24/2011 10:13:21 PM - Software Distribution Service 3.0
RP1482: 3/26/2011 8:51:13 PM - Software Distribution Service 3.0
RP1483: 3/27/2011 9:53:22 PM - System Checkpoint
RP1484: 3/27/2011 11:24:36 PM - Software Distribution Service 3.0
RP1485: 3/28/2011 11:27:10 PM - System Checkpoint
RP1486: 3/29/2011 8:38:39 AM - Software Distribution Service 3.0
RP1487: 3/30/2011 8:52:41 AM - System Checkpoint
RP1488: 3/30/2011 1:53:25 PM - Software Distribution Service 3.0
RP1489: 3/31/2011 3:38:46 PM - Software Distribution Service 3.0
RP1490: 4/1/2011 9:04:35 PM - System Checkpoint
RP1491: 4/2/2011 10:39:25 AM - Software Distribution Service 3.0
RP1492: 4/3/2011 1:31:37 PM - System Checkpoint
RP1493: 4/4/2011 10:09:06 AM - Software Distribution Service 3.0
RP1494: 4/5/2011 10:35:51 AM - System Checkpoint
RP1495: 4/5/2011 11:38:37 AM - Software Distribution Service 3.0
RP1496: 4/6/2011 12:02:18 PM - Software Distribution Service 3.0
RP1497: 4/7/2011 12:43:54 PM - Software Distribution Service 3.0
RP1498: 4/8/2011 1:29:18 PM - Software Distribution Service 3.0
RP1499: 4/9/2011 3:11:59 PM - System Checkpoint
RP1500: 4/9/2011 6:32:30 PM - Software Distribution Service 3.0
RP1501: 4/10/2011 3:14:43 AM - Software Distribution Service 3.0
RP1502: 4/11/2011 10:50:29 AM - Software Distribution Service 3.0
RP1503: 4/12/2011 7:08:20 PM - Software Distribution Service 3.0
RP1504: 4/13/2011 8:50:36 PM - System Checkpoint
RP1505: 4/14/2011 12:56:41 AM - Software Distribution Service 3.0
RP1506: 4/15/2011 11:28:04 AM - Software Distribution Service 3.0
RP1507: 4/16/2011 12:58:31 PM - System Checkpoint
RP1508: 4/16/2011 3:11:55 PM - Software Distribution Service 3.0
RP1509: 4/17/2011 5:52:32 PM - Software Distribution Service 3.0
RP1510: 4/18/2011 8:36:02 PM - System Checkpoint
RP1511: 4/19/2011 4:08:50 PM - Removed NetAssistant
RP1512: 4/21/2011 11:15:30 AM - System Checkpoint
RP1513: 4/22/2011 2:46:47 PM - System Checkpoint
RP1514: 4/23/2011 7:29:02 PM - System Checkpoint
RP1515: 4/24/2011 9:16:32 PM - System Checkpoint
RP1516: 4/25/2011 9:18:15 PM - System Checkpoint
RP1517: 4/26/2011 10:54:16 PM - System Checkpoint
RP1518: 4/28/2011 11:09:57 AM - System Checkpoint
RP1519: 4/29/2011 4:32:50 PM - System Checkpoint
RP1520: 5/1/2011 1:23:11 PM - System Checkpoint
RP1521: 5/2/2011 2:02:50 PM - System Checkpoint
RP1522: 5/3/2011 3:43:36 PM - System Checkpoint
RP1523: 5/4/2011 8:51:36 PM - System Checkpoint
RP1524: 5/6/2011 10:07:15 AM - System Checkpoint
RP1525: 5/19/2011 10:04:43 AM - Removed RuneScape Launcher 1.0.4
RP1526: 6/25/2011 5:17:22 PM - Installed Java(TM) 6 Update 26
.

 

==== Installed Programs ======================
.
Acer eDisplay Management
Adobe Flash Player 10 ActiveX
Adobe Reader 8.3.0
Adobe Shockwave Player 11.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArtistScope Plugin IE
Banctec Service Agreement
BCM V.92 56K Modem
Bonjour
Canon Camera Access Library
Canon DIGITAL CAMERA Solution Disk Software Guide
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon iP2600 series
Canon iP2600 series User Registration
Canon MovieEdit Task for ZoomBrowser EX
Canon My Printer
Canon Personal Printing Guide
Canon PowerShot A495 and PowerShot A490 Camera User Guide
Canon PowerShot SX120 IS Camera User Guide
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC 8
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Movie Uploader for YouTube
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities Solution Menu
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Coupon Printer for Windows
Dell Networking Guide
Dell Support
DIGReqEx
DS21Patch
Google Earth Plug-in
Google Toolbar for Internet Explorer
Google Update Helper
Help and Support Customization
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet
Internet Explorer Default Page
iTunes
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java Auto Updater
Java(TM) 6 Update 26
Malwarebytes' Anti-Malware version 1.51.0.1200
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Game Studios Common Redistributables Pack 1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft XML Parser
Modem Helper
MSN
MSN Encarta Plus Support Files
MSN Music Assistant
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6 Service Pack 2 (KB973686)
MyDSC2
OLYMPUS Master
Pivot Software
PIXMA Extended Survey Program
QuickTime
Qwest QuickCare
RealOne Player
SDK
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Segoe UI
Shockwave
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Viewpoint Media Player
VoiceOver Kit
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888240
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WordPerfect Office 11
XML Paper Specification Shared Components Pack 1.0
.

 

==== Event Viewer Messages From Past Week ========
.
6/27/2011 9:37:14 AM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:DOS/Alureon.A&threatid=2147636949 Name: TrojanOS/Alureon.A ID: 2147636949 Severity: Severe Category: Trojan Path: rootkit:_AlureonMbr Detection Origin: Unknown Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: To finish removing malware and other potentially unwanted software, restart the computer. To see how to finish removing malware and other potentially unwanted software, see the support article on the Microsoft Security website. Error Code: 0x80070032 Error description: The request is not supported. Signature Version: AV: 1.107.249.0, AS: 1.107.249.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
6/27/2011 8:34:59 AM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:DOS/Alureon.A&threatid=2147636949 Name: TrojanOS/Alureon.A ID: 2147636949 Severity: Severe Category: Trojan Path: rootkit:_AlureonMbr Detection Origin: Unknown Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: To finish removing malware and other potentially unwanted software, restart the computer. To see how to finish removing malware and other potentially unwanted software, see the support article on the Microsoft Security website. Error Code: 0x80070032 Error description: The request is not supported. Signature Version: AV: 1.107.249.0, AS: 1.107.249.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
6/27/2011 12:15:51 AM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:DOS/Alureon.A&threatid=2147636949 Name: TrojanOS/Alureon.A ID: 2147636949 Severity: Severe Category: Trojan Path: rootkit:_AlureonMbr Detection Origin: Unknown Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: To finish removing malware and other potentially unwanted software, restart the computer. To see how to finish removing malware and other potentially unwanted software, see the support article on the Microsoft Security website. Error Code: 0x80070032 Error description: The request is not supported. Signature Version: AV: 1.107.249.0, AS: 1.107.249.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
6/27/2011 12:07:44 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:DOS/Alureon.A&threatid=2147636949 Name: TrojanOS/Alureon.A ID: 2147636949 Severity: Severe Category: Trojan Path: file:_C:\Documents and Settings\James\Desktop\MBR.dat;rootkit:_AlureonMbr Detection Origin: Local machine Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: C:\Documents and Settings\James\Desktop\aswMBR.exe Action: Remove Action Status: To finish removing malware and other potentially unwanted software, restart the computer. To see how to finish removing malware and other potentially unwanted software, see the support article on the Microsoft Security website. Error Code: 0x80070032 Error description: The request is not supported. Signature Version: AV: 1.107.249.0, AS: 1.107.249.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
6/27/2011 11:56:25 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.107.249.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7000.0 Error code: 0x80070424 Error description: The specified service does not exist as an installed service.

 

6/25/2011 2:51:34 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
6/25/2011 11:58:31 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:DOS/Alureon.A&threatid=2147636949 Name: TrojanOS/Alureon.A ID: 2147636949 Severity: Severe Category: Trojan Path: rootkit:_AlureonMbr Detection Origin: Unknown Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: To finish removing malware and other potentially unwanted software, restart the computer. To see how to finish removing malware and other potentially unwanted software, see the support article on the Microsoft Security website. Error Code: 0x80070032 Error description: The request is not supported. Signature Version: AV: 1.107.249.0, AS: 1.107.249.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
6/24/2011 4:25:03 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.107.249.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7000.0 Error code: 0x80070424 Error description: The specified service does not exist as an installed service.
.
==== End Of File ===========================

 

And Finally:

ComboFix 11-07-01.02 - James 07/02/2011 11:40:27.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1559 [GMT -7:00]
Running from: c:\documents and settings\James\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2011-06-02 to 2011-07-02 )))))))))))))))))))))))))))))))
.
.
2011-07-02 16:49 . 2011-07-02 16:49 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{51A758B9-7A12-45DD-944E-CBEDC1E17EBC}\MpKsl79b14fef.sys
2011-07-02 02:56 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{51A758B9-7A12-45DD-944E-CBEDC1E17EBC}\mpengine.dll
2011-06-26 02:14 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-26 02:13 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-26 00:17 . 2011-06-26 00:17 73728 ----a-w- c:\windows\system32\javacpl.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-26 00:17 . 2011-01-14 23:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-07 15:55 . 2010-04-28 15:25 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-25 02:14 . 2010-04-27 14:52 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-27 10:09 . 2011-04-26 11:13 0 ----a-w- c:\documents and settings\Kari\Local Settings\Application Data\Xpoxohewazuco.bin
2011-04-26 16:57 . 2010-04-27 14:19 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-02_02.19.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-02 16:49 . 2011-07-02 16:49 16384 c:\windows\Temp\Perflib_Perfdata_148.dat
+ 2010-06-05 09:32 . 2011-07-02 08:35 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
- 2010-06-05 09:32 . 2011-02-15 05:20 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2009-05-25 05:25 . 2011-07-02 04:08 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
- 2009-05-25 05:25 . 2011-07-01 03:24 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
+ 2010-05-28 23:22 . 2011-07-02 04:08 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
- 2010-05-28 23:22 . 2011-07-01 03:24 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
+ 2010-02-21 23:55 . 2011-07-02 04:08 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
- 2010-02-21 23:55 . 2011-07-01 03:24 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
+ 2009-05-25 05:25 . 2011-07-02 04:08 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2009-05-25 05:25 . 2011-07-01 03:24 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2010-05-28 23:22 . 2011-07-01 03:24 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
+ 2010-05-28 23:22 . 2011-07-02 04:08 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
- 2010-05-28 23:22 . 2011-07-01 03:24 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
+ 2010-05-28 23:22 . 2011-07-02 04:08 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
+ 2011-07-02 08:34 . 2011-07-02 08:34 20333056 c:\windows\Installer\6e71c7.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"PivotSoftware "= "c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR "= "c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2009-08-25 81920]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-05-27 21:52 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-09-14 01:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-10-26 01:10 652624 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 23:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2004-01-15 00:40 151597 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
.
R1 MpKsl79b14fef;MpKsl79b14fef;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{51A758B9-7A12-45DD-944E-CBEDC1E17EBC}\MpKsl79b14fef.sys [7/2/2011 9:49 AM 28752]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2/16/2011 2:22 AM 109168]
S1 MpKsl28583a7a;MpKsl28583a7a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{37B381FB-89FA-43AC-A2A8-8CCAC7E1086A}\MpKsl28583a7a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{37B381FB-89FA-43AC-A2A8-8CCAC7E1086A}\MpKsl28583a7a.sys [?]
S1 MpKsl3b684326;MpKsl3b684326;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ED4E103C-01EB-415C-B4B4-4535E44AA3BF}\MpKsl3b684326.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ED4E103C-01EB-415C-B4B4-4535E44AA3BF}\MpKsl3b684326.sys [?]
S1 MpKsl53f7aeaf;MpKsl53f7aeaf;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl53f7aeaf.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl53f7aeaf.sys [?]
S1 MpKsla5197085;MpKsla5197085;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{90D430C6-00ED-4CB4-AF43-90824F222E38}\MpKsla5197085.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{90D430C6-00ED-4CB4-AF43-90824F222E38}\MpKsla5197085.sys [?]
S1 MpKsle86772d0;MpKsle86772d0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C9460285-6BCE-43E2-A058-2C55AC9ABAA6}\MpKsle86772d0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C9460285-6BCE-43E2-A058-2C55AC9ABAA6}\MpKsle86772d0.sys [?]
S2 CSHelper;CopySafe Helper Service;c:\windows\SYSTEM32\CSHelper.exe [1/16/2010 3:59 PM 266240]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/16/2010 5:37 PM 135664]
S2 HitmanPro35CrusaderBoot;Hitman Pro 3.5 Crusader (Boot); "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35[1].exe" /crusader:boot --> c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35[1].exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/16/2010 5:37 PM 135664]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL79B14FEF
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 19:50]
.
2011-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc202b92d88e10.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 00:37]
.
2011-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 00:37]
.
2011-07-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 20:26]
.
2011-07-02 c:\windows\Tasks\User_Feed_Synchronization-{99C7E015-A9F4-4734-9BD9-487DD37545E8}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>;*.local
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-02 11:48
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HitmanPro35CrusaderBoot]
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
[1].exe\" /crusader:boot "
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
[1].exe\" /crusader:boot "
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HitmanPro35CrusaderBoot]
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\RemoteAccess\Profile\x *]
"EnableAutodisconnect "=dword:00000001
"EnableExitDisconnect "=dword:00000001
"DisconnectIdleTime "=dword:00000014
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\SecuRom\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"???????????????????????? "=hex:ac,69,36,31,c5,6b,88,7a,77,f5,4c,42,1e,3e,f2,0e,
06,94,30,e9,e9,c3,ab,94,94,ab,06,06,f4,70,94,60,00,00,00,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_046d&Pid_c018\6&3b2e9ec3&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2660)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-07-02 11:51:05
ComboFix-quarantined-files.txt 2011-07-02 18:51
ComboFix2.txt 2011-07-02 02:32
.
Pre-Run: 127,853,703,168 bytes free
Post-Run: 127,952,986,112 bytes free
.
- - End Of File - - 33963702DBF4D161C5832E5230D558C4

 

Comp is running great!! not a problem since i ran the TDSSKiller and Combofix

ComboFix 11-07-01.01 - James 07/01/2011 19:07:49.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1535 [GMT -7:00]
Running from: c:\documents and settings\James\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\D'Anne\WINDOWS
c:\documents and settings\James\Application Data\Adobe\plugs
c:\documents and settings\James\Application Data\Adobe\shed
c:\documents and settings\James\err.log
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome.manifest
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome\content\_cfg.js
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\chrome\content\overlay.xul
c:\documents and settings\James\Local Settings\Application Data\{16C1894B-E821-460E-9B01-ACE95F30BFFE}\install.rdf
c:\documents and settings\James\WINDOWS
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome.manifest
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome\content\_cfg.js
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\chrome\content\overlay.xul
c:\documents and settings\Kari\Local Settings\Application Data\{418FAB35-B606-4BB6-8540-3243C15D0633}\install.rdf
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome.manifest
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome\content\_cfg.js
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\chrome\content\overlay.xul
c:\documents and settings\Kelsey\Local Settings\Application Data\{613C5EB8-BAD8-456E-A489-1145D13F6720}\install.rdf
c:\documents and settings\Kelsey\WINDOWS
c:\program files\Common Files\dobe~1
c:\program files\mantec~1
c:\program files\smante~1
c:\program files\wnsxs~1
c:\temp\fse
c:\temp\fse\tmpZTF.log
c:\windows\admintxt.txt
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\ppatch~1
c:\windows\pppatc~1
c:\windows\sks~1
c:\windows\sks~2
c:\windows\system32\ahgpqybn.ini
c:\windows\system32\bkymbbgr.ini
c:\windows\SYSTEM32\CbdLoUvw.ini
c:\windows\system32\CbdLoUvw.ini2
c:\windows\SYSTEM32\cbeeg.ini2
c:\windows\system32\deaflrbd.ini
c:\windows\system32\dgwmgbdt.ini
c:\windows\system32\FikTAcdd.ini
c:\windows\SYSTEM32\FikTAcdd.ini2
c:\windows\system32\fjweqlfv.ini
c:\windows\system32\ftkblqoe.ini
c:\windows\system32\fwqwfulx.ini
c:\windows\system32\gchivraa.ini
c:\windows\system32\gxaiefus.ini
c:\windows\system32\hoxsvaei.ini
c:\windows\system32\hpbjrnjx.ini
c:\windows\system32\hRqsuBeg.ini
c:\windows\SYSTEM32\hRqsuBeg.ini2
c:\windows\system32\irulstxl.ini
c:\windows\system32\ivsmtwng.ini
c:\windows\system32\kgqkbmbe.ini
c:\windows\SYSTEM32\KlkSYJjl.ini
c:\windows\system32\KlkSYJjl.ini2
c:\windows\system32\lfhdrcnv.ini
c:\windows\system32\lopXwyay.ini
c:\windows\system32\lopXwyay.ini2
c:\windows\SYSTEM32\MonnTvut.ini
c:\windows\SYSTEM32\MonnTvut.ini2
c:\windows\system32\mqfoxtog.ini
c:\windows\system32\napetrih.ini
c:\windows\SYSTEM32\NTtAcccf.ini
c:\windows\SYSTEM32\NTtAcccf.ini2
c:\windows\system32\ojhyegox.ini
c:\windows\system32\phltsdut.ini
c:\windows\system32\pkcgsmcg.ini
c:\windows\system32\pmipwjgq.ini
c:\windows\system32\QAIjlnnn.ini
c:\windows\system32\QAIjlnnn.ini2
c:\windows\system32\qsqlhyoc.ini
c:\windows\system32\qtgmhohq.ini
c:\windows\system32\racle~1
c:\windows\system32\sheoatyd.ini
c:\windows\system32\srcxhdxf.ini
c:\windows\system32\syvqodsk.ini
c:\windows\SYSTEM32\TAcIPXyb.ini
c:\windows\SYSTEM32\TAcIPXyb.ini2
c:\windows\SYSTEM32\tsDegfii.ini
c:\windows\system32\tsDegfii.ini2
c:\windows\system32\uddmqiod.ini
c:\windows\system32\wdwaomlx.ini
c:\windows\system32\wiqdtiwd.ini
c:\windows\system32\wlxwudgg.ini
c:\windows\system32\wskbtcpi.ini
c:\windows\system32\xlcbiyys.ini
c:\windows\system32\xvlckduv.ini
c:\windows\system32\ydbtunoi.ini
c:\windows\system32\ystem~1
c:\windows\wnsxs~1
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_FOPN
.
.
((((((((((((((((((((((((( Files Created from 2011-06-02 to 2011-07-02 )))))))))))))))))))))))))))))))
.
.
2011-07-02 02:18 . 2011-07-02 02:18 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl7cfc6d52.sys
2011-06-29 20:23 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\mpengine.dll
2011-06-26 02:14 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-26 02:13 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-26 00:17 . 2011-06-26 00:17 73728 ----a-w- c:\windows\system32\javacpl.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-26 00:17 . 2011-01-14 23:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-07 15:55 . 2010-04-28 15:25 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-25 02:14 . 2010-04-27 14:52 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-04-27 10:09 . 2011-04-26 11:13 0 ----a-w- c:\documents and settings\Kari\Local Settings\Application Data\Xpoxohewazuco.bin
2011-04-26 16:57 . 2010-04-27 14:19 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"PivotSoftware "= "c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR "= "c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2009-08-25 81920]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\24380071
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-05-27 21:52 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-09-14 01:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-10-26 01:10 652624 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 23:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2004-01-15 00:40 151597 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
.
R1 MpKsl7cfc6d52;MpKsl7cfc6d52;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl7cfc6d52.sys [7/1/2011 7:18 PM 28752]
R2 CSHelper;CopySafe Helper Service;c:\windows\SYSTEM32\CSHelper.exe [1/16/2010 3:59 PM 266240]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2/16/2011 2:22 AM 109168]
S1 MpKsl28583a7a;MpKsl28583a7a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{37B381FB-89FA-43AC-A2A8-8CCAC7E1086A}\MpKsl28583a7a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{37B381FB-89FA-43AC-A2A8-8CCAC7E1086A}\MpKsl28583a7a.sys [?]
S1 MpKsl3b684326;MpKsl3b684326;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ED4E103C-01EB-415C-B4B4-4535E44AA3BF}\MpKsl3b684326.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ED4E103C-01EB-415C-B4B4-4535E44AA3BF}\MpKsl3b684326.sys [?]
S1 MpKsl53f7aeaf;MpKsl53f7aeaf;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl53f7aeaf.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EB78CEF2-AD35-4266-8DF5-3D6B97B60C9B}\MpKsl53f7aeaf.sys [?]
S1 MpKsla5197085;MpKsla5197085;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{90D430C6-00ED-4CB4-AF43-90824F222E38}\MpKsla5197085.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{90D430C6-00ED-4CB4-AF43-90824F222E38}\MpKsla5197085.sys [?]
S1 MpKsle86772d0;MpKsle86772d0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C9460285-6BCE-43E2-A058-2C55AC9ABAA6}\MpKsle86772d0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C9460285-6BCE-43E2-A058-2C55AC9ABAA6}\MpKsle86772d0.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/16/2010 5:37 PM 135664]
S2 HitmanPro35CrusaderBoot;Hitman Pro 3.5 Crusader (Boot); "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35[1].exe" /crusader:boot --> c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35[1].exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/16/2010 5:37 PM 135664]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL7CFC6D52
*NewlyCreated* - WUAUSERV
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 19:50]
.
2011-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc202b92d88e10.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 00:37]
.
2011-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-17 00:37]
.
2011-07-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 20:26]
.
2011-07-02 c:\windows\Tasks\User_Feed_Synchronization-{99C7E015-A9F4-4734-9BD9-487DD37545E8}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>;*.local
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{2A32EFE1-1ACD-4CF7-9F72-3C2CC28880A1} - (no file)
BHO-{3CEFE32A-6805-4F77-BBEE-DC3C32C0F9A6} - (no file)
BHO-{41833C93-EE9E-472F-9DB9-8CB402659890} - (no file)
BHO-{4664BAA6-DB16-4836-B878-EBA3338F3734} - (no file)
BHO-{542adc8c-4f73-4c17-9394-c0fd51d0398e} - (no file)
BHO-{5C9E9E35-9524-4DCF-94F0-3F03AB5F88F8} - (no file)
BHO-{6FED410D-73D1-4FB7-A466-B22FA391FA5D} - (no file)
BHO-{73BDEA63-5750-4ABB-A7E8-F079B2E370A4} - (no file)
BHO-{74BCF4CF-EB01-463A-8F3B-065286F9C275} - (no file)
BHO-{75AEE836-9155-44E0-96E7-7BA042ED6E74} - (no file)
BHO-{87a930ec-bc4b-4388-a3e5-2e574308fd84} - (no file)
BHO-{8963fe7a-d87a-4ff6-822a-0f5b437cd5f9} - (no file)
BHO-{AFB67358-50B6-46A8-8BBE-0B42980B91D3} - (no file)
BHO-{B2814E74-88CB-4A28-949E-1A4F99F6BDF9} - (no file)
BHO-{C28132D3-A042-D2B2-159B-AA8F032629EC} - (no file)
BHO-{C74F5288-9E3A-40B3-9423-6D9019A2CCF0} - (no file)
BHO-{D3F2AFFE-FCA4-4334-800C-5608ABF05B02} - (no file)
BHO-{FB55771D-45B3-44A4-BDBF-5E27D7D4DDCF} - (no file)
Toolbar-SITEguard - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
HKCU-Run-AntiVirus_AntiSpyware_2011 - c:\documents and settings\James\Application Data\AntiVirus_AntiSpyware_2011\AntiVirus AntiSpyware.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-Yahoo! Pager - c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-01 19:19
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HitmanPro35CrusaderBoot]
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
[1].exe\" /crusader:boot "
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
[1].exe\" /crusader:boot "
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HitmanPro35CrusaderBoot]
"ImagePath "= "\ "c:\documents and settings\James\Local Settings\Temporary Internet Files\Content.IE5\6JLCFOSK\HitmanPro35
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\RemoteAccess\Profile\x *]
"EnableAutodisconnect "=dword:00000001
"EnableExitDisconnect "=dword:00000001
"DisconnectIdleTime "=dword:00000014
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\SecuRom\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"???????????????????????? "=hex:ac,69,36,31,c5,6b,88,7a,77,f5,4c,42,1e,3e,f2,0e,
06,94,30,e9,e9,c3,ab,94,94,ab,06,06,f4,70,94,60,00,00,00,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\HID\Vid_046d&Pid_c018\6&3b2e9ec3&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1572)
c:\windows\system32\WININET.dll
c:\program files\Portrait Displays\Pivot Software\winphook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\UAService7.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Portrait Displays\Pivot Software\floater.exe
c:\program files\Acer Display\eDisplay Management\DTHtml.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe
.
**************************************************************************
.
Completion time: 2011-07-01 19:32:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-02 02:32
.
Pre-Run: 126,205,915,136 bytes free
Post-Run: 127,978,274,816 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - BF096263CED5F6BD079D9912D29ED418

 

i won't be letting my step son be using this computer any time soon as every time he does I get some kind of malicious program or virus stuck in here.

 

OTL logfile created on: 7/3/2011 10:15:12 AM - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Documents and Settings\James\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.73% Memory free
4.83 Gb Paging File | 4.48 Gb Available in Paging File | 92.82% Paging File free
Paging file location(s): C:\pagefile.sys 3048 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.02 Gb Total Space | 119.17 Gb Free Space | 79.97% Space Free | Partition Type: NTFS

Computer Name: LIVINGROOM | User Name: James | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/03 10:12:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\Desktop\OTL.exe
PRC - [2010/11/30 14:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 13:26:42 | 000,226,984 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
PRC - [2010/11/11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/01/16 15:59:17 | 000,266,240 | ---- | M] () -- C:\WINDOWS\SYSTEM32\CSHelper.exe
PRC - [2009/09/08 18:25:52 | 000,096,334 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2009/08/24 17:17:12 | 000,327,168 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files\Acer Display\eDisplay Management\dthtml.exe
PRC - [2009/08/24 17:14:58 | 000,069,632 | ---- | M] () -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
PRC - [2009/08/24 17:14:48 | 000,114,688 | ---- | M] (Portrait Displays Inc.) -- C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
PRC - [2009/07/15 14:43:48 | 000,203,376 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdiSDKHelper.exe
PRC - [2009/07/15 14:43:46 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/13 08:49:00 | 000,101,528 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2007/02/09 13:17:30 | 000,694,008 | ---- | M] () -- C:\Program Files\Portrait Displays\Pivot Software\Floater.exe
PRC - [2007/02/09 13:17:26 | 000,694,008 | ---- | M] () -- C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe
PRC - [2005/07/22 16:27:50 | 000,122,880 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\SYSTEM32\UAService7.exe


========== Modules (SafeList) ==========

MOD - [2011/07/03 10:12:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\Desktop\OTL.exe
MOD - [2007/02/09 13:16:08 | 000,245,760 | ---- | M] () -- C:\Program Files\Portrait Displays\Pivot Software\Winphook.dll
MOD - [2006/08/25 08:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (HitmanPro35CrusaderBoot) Hitman Pro 3.5 Crusader (Boot)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (gusvc)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2010/11/11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/01/16 15:59:17 | 000,266,240 | ---- | M] () [Auto | Running] -- C:\WINDOWS\SYSTEM32\CSHelper.exe -- (CSHelper)
SRV - [2009/09/08 18:25:52 | 000,096,334 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2009/08/24 17:14:58 | 000,069,632 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC)
SRV - [2009/07/15 14:43:46 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2007/04/13 08:49:00 | 000,101,528 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2005/07/22 16:27:50 | 000,122,880 | ---- | M] (Sony DADC Austria AG.) [Auto | Running] -- C:\WINDOWS\SYSTEM32\UAService7.exe -- (UserAccess7) SecuROM User Access Service (V7)
SRV - [2003/03/03 12:33:40 | 000,143,360 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)


========== Driver Services (SafeList) ==========

DRV - [2011/07/03 10:08:59 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{53767C80-62B8-4BC4-BD5D-80C1E93CC904}\MpKslf404085d.sys -- (MpKslf404085d)
DRV - [2009/07/15 14:43:32 | 000,017,136 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PdiPorts.sys -- (PdiPorts)
DRV - [2007/04/11 10:23:32 | 000,035,328 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\Capt905c.sys -- (SQTECH905C)
DRV - [2007/02/09 13:17:18 | 000,017,465 | ---- | M] (Portrait Displays, Inc.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pivot.sys -- (Pivot)
DRV - [2007/02/09 13:17:16 | 000,011,323 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pivotmou.sys -- (pivotmou)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\afc.sys -- (Afc)
DRV - [2004/12/09 08:25:49 | 000,047,104 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2004/10/28 03:47:59 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/08/03 22:29:49 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/03 22:29:47 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/03 22:29:45 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/03 22:29:43 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/03 22:29:42 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/03 22:29:41 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/03 22:29:37 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/03 22:29:37 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/03 22:29:37 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/03 22:29:36 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2004/05/13 06:00:04 | 000,111,808 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004/05/13 04:19:36 | 000,079,488 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\prodrv06.sys -- (prodrv06)
DRV - [2004/03/08 12:55:50 | 000,013,567 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)
DRV - [2003/12/01 08:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)
DRV - [2003/04/19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\tandpl.sys -- (tandpl)
DRV - [2003/03/02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\enodpl.sys -- (enodpl)
DRV - [2002/11/08 12:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2001/08/17 11:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Search
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\w, = http://www.Google.com/


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.bing.com [binary data]
IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Search
IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

FF - HKLM\software\mozilla\Firefox\extensions\\{EEC1131E-06BE-4D9A-9C4E-797C18825414}: C:\Documents and Settings\D'Anne\Local Settings\Application Data\{EEC1131E-06BE-4D9A-9C4E-797C18825414} [2011/04/19 08:10:09 | 000,000,000 | ---D | M]

[2011/03/03 16:49:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James\Application Data\Mozilla\Extensions

O1 HOSTS File: ([2011/07/01 19:18:51 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - No CLSID value found.
O3 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [DT ACR] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\..Trusted Domains: ([]msn in My Computer)
O15 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKU\S-1-5-21-3467059179-3465910588-4126901205-1007\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://media.keytrain.com/player/IE/awswaxd.cab (Macromedia Authorware Web Player Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab (FunGamesLoader Object)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} http://www.worldwinner.com/games/v41/freecell/freecell.cab (FreeCell Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165536969073 (MUWebControl Class)
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab (Verizon Wireless Media Upload)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} http://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab (WorldWinner ActiveX Launcher Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll (Yahoo! MailTo)
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} http://www.worldwinner.com/games/v41/hangman/hangman.cab (Hangman Control)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://games.pogo.com/online2/pogo/bejeweled2/popcaploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 () - http://www.runescape.com/lang/en/aff/runescape/img/bg2.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\James\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\James\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 07:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\WINDOWS\System32\Pvmjpg21.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.VP31 - vp31vfw.dll File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/03 10:12:46 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\James\Desktop\OTL.exe
[2011/07/01 19:02:04 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/07/01 18:57:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/07/01 18:57:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/07/01 18:57:39 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/07/01 18:57:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/07/01 18:57:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/07/01 18:56:51 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/01 18:50:39 | 004,130,437 | R--- | C] (Swearware) -- C:\Documents and Settings\James\Desktop\ComboFix.exe
[2011/07/01 13:38:54 | 001,448,752 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\James\Desktop\tdsskiller.exe
[2011/06/27 12:02:03 | 000,607,017 | R--- | C] (Swearware) -- C:\Documents and Settings\James\Desktop\dds.scr
[2011/06/27 12:01:33 | 001,904,128 | ---- | C] (AVAST Software) -- C:\Documents and Settings\James\Desktop\aswMBR.exe
[2011/06/25 19:14:00 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/25 19:14:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/25 19:13:53 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/25 17:17:50 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/06/25 17:17:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/06/25 17:17:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/06/25 17:17:50 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/06/17 19:29:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2003/12/09 13:16:52 | 000,442,368 | ---- | C] ( ) -- C:\WINDOWS\System32\comintfs.dll
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/03 10:15:00 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{99C7E015-A9F4-4734-9BD9-487DD37545E8}.job
[2011/07/03 10:14:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/03 10:14:00 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/07/03 10:12:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\Desktop\OTL.exe
[2011/07/03 10:08:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/07/03 10:08:46 | 2145,439,744 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/03 00:19:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cc202b92d88e10.job
[2011/07/02 18:47:25 | 000,000,129 | ---- | M] () -- C:\Documents and Settings\James\jagex_runescape_preferences2.dat
[2011/07/02 18:47:25 | 000,000,046 | ---- | M] () -- C:\Documents and Settings\James\jagex_runescape_preferences.dat
[2011/07/02 15:59:48 | 000,001,286 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Runescape.url
[2011/07/02 11:38:45 | 004,130,437 | R--- | M] (Swearware) -- C:\Documents and Settings\James\Desktop\ComboFix.exe
[2011/07/01 19:18:51 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/07/01 19:02:08 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2011/07/01 13:38:54 | 001,448,752 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\James\Desktop\tdsskiller.exe
[2011/06/27 12:02:05 | 000,607,017 | R--- | M] (Swearware) -- C:\Documents and Settings\James\Desktop\dds.scr
[2011/06/27 12:01:33 | 001,904,128 | ---- | M] (AVAST Software) -- C:\Documents and Settings\James\Desktop\aswMBR.exe
[2011/06/25 23:45:56 | 000,256,000 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2011/06/25 20:27:11 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\James\Desktop\rxuy0xvn.exe
[2011/06/25 19:14:00 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/25 17:17:33 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/06/25 17:17:33 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/06/25 17:17:33 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/06/25 17:17:32 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011/06/25 17:17:32 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/06/19 21:30:10 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/06/18 00:31:39 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/01 19:02:08 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/07/01 19:02:05 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/07/01 18:57:39 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/07/01 18:57:39 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/07/01 18:57:39 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/07/01 18:57:39 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/07/01 18:57:39 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/06/25 20:27:00 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\James\Desktop\rxuy0xvn.exe
[2011/06/25 19:14:00 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/18 00:31:39 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 8.lnk
[2011/06/18 00:31:39 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[2011/04/19 11:38:51 | 000,011,916 | -HS- | C] () -- C:\Documents and Settings\James\Local Settings\Application Data\k8g76qfqbt723d00fnb0dy5g4u67
[2011/04/19 11:38:51 | 000,011,916 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\k8g76qfqbt723d00fnb0dy5g4u67
[2011/04/18 19:20:36 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/18 14:49:33 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20897588r
[2011/04/18 14:49:32 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~20897588
[2011/04/18 14:49:23 | 000,000,400 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\20897588
[2011/04/18 14:42:55 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Ckuwokelodasode.dat
[2011/04/18 14:42:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Xpoxohewazuco.bin
[2011/04/11 20:47:02 | 000,000,177 | ---- | C] () -- C:\WINDOWS\AWSHKWV.INI
[2011/02/28 13:53:33 | 000,493,184 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/02/16 02:23:47 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2010/04/27 07:19:32 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/03/15 20:22:43 | 000,047,740 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/01/16 15:59:17 | 000,266,240 | ---- | C] () -- C:\WINDOWS\System32\CSHelper.exe
[2009/12/03 18:29:26 | 000,000,020 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2009/12/03 18:29:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcreg.dat
[2008/06/23 22:40:33 | 000,000,000 | ---- | C] () -- C:\Program Files\uninstall.dat
[2008/03/13 17:46:43 | 000,691,545 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2008/03/13 17:46:43 | 000,002,545 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2008/03/12 01:34:02 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/03/06 15:44:41 | 000,000,773 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008/03/06 13:49:46 | 000,000,073 | ---- | C] () -- C:\WINDOWS\PUZZLES.INI
[2007/04/12 17:07:49 | 000,000,036 | ---- | C] () -- C:\WINDOWS\Tiny_Run.ini
[2006/09/16 13:51:11 | 000,000,256 | ---- | C] () -- C:\WINDOWS\PROVW.INI
[2006/09/16 13:51:10 | 000,000,687 | ---- | C] () -- C:\WINDOWS\KPSTUDIO.INI
[2006/07/24 15:40:53 | 000,000,162 | ---- | C] () -- C:\WINDOWS\mrpotato.ini
[2006/05/02 13:39:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Textart.INI
[2006/02/18 15:52:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2005/11/25 18:17:22 | 000,000,043 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2005/10/30 02:16:07 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\ZLIB.DLL
[2005/05/08 11:27:41 | 000,000,023 | ---- | C] () -- C:\WINDOWS\SpaceTaxi.INI
[2005/01/15 11:15:07 | 000,000,498 | ---- | C] () -- C:\WINDOWS\EReg077.dat
[2005/01/09 20:23:41 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\James\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/12/13 20:37:18 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2004/12/04 23:43:35 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\James\Local Settings\Application Data\fusioncache.dat
[2004/11/26 10:22:40 | 000,000,383 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2004/11/21 01:23:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2004/11/04 17:00:03 | 000,001,273 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2004/10/27 20:07:45 | 000,000,810 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2004/10/24 16:12:30 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/02/04 13:19:23 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\James\Application Data\PFP110JPR.{PB
[2004/02/04 13:19:23 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\James\Application Data\PFP110JCM.{PB
[2004/01/28 18:23:52 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\instlsp.exe
[2004/01/24 02:30:25 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2004/01/24 01:23:02 | 000,000,174 | ---- | C] () -- C:\WINDOWS\System32\mcini.ini
[2004/01/23 18:51:48 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\enodpl.sys
[2004/01/23 18:51:48 | 000,004,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\tandpl.sys
[2004/01/21 18:59:10 | 000,000,599 | ---- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2004/01/14 17:50:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/14 17:46:39 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2004/01/14 17:41:37 | 000,000,258 | ---- | C] () -- C:\WINDOWS\System32\BDEMERGE.INI
[2004/01/14 17:38:12 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2004/01/14 17:33:17 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/14 17:17:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2004/01/14 17:16:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/14 17:16:00 | 000,442,466 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2004/01/14 17:16:00 | 000,071,732 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2004/01/14 17:15:45 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/01/14 17:00:38 | 000,000,550 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/08/13 21:54:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/02/05 10:11:12 | 000,000,126 | ---- | C] () -- C:\WINDOWS\System32\DLBAPLC.INI
[2002/09/03 08:05:08 | 000,200,144 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 07:59:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 07:56:30 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 07:31:46 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 07:31:44 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 04:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 04:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 04:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 04:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2002/08/29 04:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 04:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/08/29 04:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[1979/12/31 23:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2002/09/03 07:59:58 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/04/27 07:09:23 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/07/01 19:02:08 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2002/09/03 07:38:46 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
[2008/06/19 23:41:19 | 000,035,809 | ---- | M] () -- C:\caavsetupLog.txt
[2008/12/22 17:28:05 | 000,190,718 | ---- | M] () -- C:\caisslog.txt
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/07/02 11:51:06 | 000,012,873 | ---- | M] () -- C:\ComboFix.txt
[2002/09/03 07:59:58 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2004/01/14 17:06:32 | 000,005,508 | R--- | M] () -- C:\DELL.SDR
[2009/11/29 11:02:28 | 000,000,045 | ---- | M] () -- C:\error.log
[2011/07/03 10:08:46 | 2145,439,744 | -HS- | M] () -- C:\hiberfil.sys
[2002/09/03 07:59:58 | 000,000,000 | ---- | M] () -- C:\IO.SYS
[2004/01/14 17:39:49 | 000,000,855 | ---- | M] () -- C:\IPH.PH
[2002/09/03 07:59:58 | 000,000,000 | ---- | M] () -- C:\MSDOS.SYS
[2004/10/24 16:33:26 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/10/24 16:33:26 | 000,250,032 | RHS- | M] () -- C:\NTLDR
[2011/07/03 10:08:45 | 3196,059,648 | -HS- | M] () -- C:\pagefile.sys
[2011/02/16 02:23:05 | 000,000,173 | ---- | M] () -- C:\pdisdk.log
[2011/02/16 02:23:49 | 000,000,184 | ---- | M] () -- C:\pivot.log
[2007/07/08 01:42:51 | 000,000,268 | ---- | M] () -- C:\sqmdata00.sqm
[2007/07/08 01:42:51 | 000,000,244 | ---- | M] () -- C:\sqmnoopt00.sqm
[2004/01/14 17:41:59 | 000,000,087 | ---- | M] () -- C:\SystemInfo.ini
[2010/08/03 20:35:18 | 000,000,146 | ---- | M] () -- C:\systemscandata.txt
[2011/07/01 13:41:09 | 000,058,634 | ---- | M] () -- C:\TDSSKiller.2.5.8.0_01.07.2011_13.40.29_log.txt
[2011/07/01 13:51:01 | 000,057,906 | ---- | M] () -- C:\TDSSKiller.2.5.8.0_01.07.2011_13.45.06_log.txt
[2011/01/27 16:08:32 | 000,000,150 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2002/09/03 07:59:02 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/10/21 22:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPD97.DLL
[2007/10/21 22:00:00 | 000,069,632 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP97.DLL
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/06/23 22:40:33 | 000,000,000 | ---- | M] () -- C:\Program Files\uninstall.dat

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2002/09/03 07:47:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
[2002/09/03 07:47:18 | 000,602,112 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
[2002/09/03 07:47:18 | 000,380,928 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2004/10/24 16:41:11 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/10/24 17:04:00 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\James\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/01/21 18:58:54 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/06/27 12:01:33 | 001,904,128 | ---- | M] (AVAST Software) -- C:\Documents and Settings\James\Desktop\aswMBR.exe
[2011/07/02 11:38:45 | 004,130,437 | R--- | M] (Swearware) -- C:\Documents and Settings\James\Desktop\ComboFix.exe
[2011/07/03 10:12:53 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\Desktop\OTL.exe
[2011/06/25 20:27:11 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\James\Desktop\rxuy0xvn.exe
[2011/07/01 13:38:54 | 001,448,752 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\James\Desktop\tdsskiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2002/08/29 04:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\ADDINS\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2004/10/24 17:04:00 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\James\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/06/25 21:47:37 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\James\Cookies\desktop.ini
[2011/07/03 10:15:03 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\James\Cookies\INDEX.DAT

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 23:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2004/08/04 00:56:41 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2002/08/20 11:32:18 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\LOGOWIN.GIF
[2002/08/20 11:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\LVBACK.GIF
[2002/08/20 11:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\MAILTMPL.TXT
[2008/05/02 07:22:02 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2004/08/04 00:56:13 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2004/10/13 09:24:37 | 001,694,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 14:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\MSMSGSIN.EXE
[2002/08/29 04:00:00 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\NEWALERT.WAV
[2002/08/29 04:00:00 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\NEWEMAIL.WAV
[2002/08/29 04:00:00 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\ONLINE.WAV
[2002/08/20 11:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\TYPE.WAV
[2004/07/17 11:41:04 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1996/08/27 02:12:00 | 000,004,176 | R--- | M] (Apple Computer, Inc.) -- C:\WINDOWS\system\QTNOTIFY.EXE

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Files - Unicode (All) ==========
[2008/06/10 23:07:22 | 000,000,000 | ---D | M](C:\Documents and Settings\James\Application Data\??sembly) -- C:\Documents and Settings\James\Application Data\аѕsembly
[2008/06/10 23:07:22 | 000,000,000 | ---D | M](C:\Documents and Settings\James\Application Data\??sembly) -- C:\Documents and Settings\James\Application Data\аѕsembly
[2008/05/02 12:38:15 | 000,000,000 | ---D | M](C:\Documents and Settings\James\Application Data\?racle) -- C:\Documents and Settings\James\Application Data\Οracle
[2008/05/02 12:38:15 | 000,000,000 | ---D | M](C:\Documents and Settings\James\Application Data\?racle) -- C:\Documents and Settings\James\Application Data\Οracle
(C:\Documents and Settings\James\Application Data\?racle) -- C:\Documents and Settings\James\Application Data\Οracle
(C:\Documents and Settings\James\Application Data\??sembly) -- C:\Documents and Settings\James\Application Data\аѕsembly

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\James\My Documents\Install_Facebook_Plug-In_1.0.3[1]:SummaryInformation
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F085C8A1

< End of report >