1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Generic host process for win32 services has encountered a proble

Discussion in 'Malware and Virus Removal Archive' started by conde357, 2010/11/26.

Page 1 of 4
  1. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    [Inactive] Generic host process for win32 services has encountered a proble

    I need help. I did some googling and wound up at this site:

    I installed Malwarebytes and Avast and still can't shake this problem. Any help would be appreciated
     
    conde357,
    #1
  2. 2010/11/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard :)

    Please, read this post, then post the requested log(s).

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
    broni,
    #2


  3. to hide this advert.

  4. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    Thanks

    I will follow your instructions exactly as you say. Thanks for your help.
     
    Last edited: 2010/11/26
    conde357,
    #3
  5. 2010/11/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're welcome :)
     
    broni,
    #4
  6. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    If it helps I ran a scan and found this threat 'Win32:Bamital-AC' in three places:

    C:\\WINDOWS\explorer.exe
    C:\\WINDOWS\system32\winlogon.exe and
    C:\\WINDOWS\explorer.exe
     
    conde357,
    #5
  7. 2010/11/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yeah, Bamital is pretty nasty stuff...
    I still need all those logs from you.
     
    broni,
    #6
  8. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    Logs

    I hope I did this right...

    Malwarebytes (MBAM)

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5195

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    11/26/2010 8:31:28 PM
    mbam-log-2010-11-26 (20-31-28).txt

    Scan type: Quick scan
    Objects scanned: 165383
    Time elapsed: 17 minute(s), 27 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Documents and Settings\George\Start Menu\Programs\ThinkPoint.lnk (Rogue.ThinkPoint) -> Quarantined and deleted successfully.



    GMER

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2010-11-26 21:47:37
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort2 ST9250827AS rev.3.ADB
    Running: o0gb3o4t.exe; Driver: C:\DOCUME~1\George\LOCALS~1\Temp\fgeoakow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwClose [0x9D922CF0]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateKey [0x9D922BAC]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteKey [0x9D923160]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteValueKey [0x9D92308A]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDuplicateObject [0x9D922782]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenKey [0x9D922C86]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenProcess [0x9D9226C2]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenThread [0x9D922726]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwQueryValueKey [0x9D922DA6]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0x9D92322E]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRestoreKey [0x9D922D66]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwSetValueKey [0x9D922EE6]

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x9D92FBAE]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x9D92F9D2]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x9D92FB0C]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

    ---- Kernel code sections - GMER 1.0.15 ----

    PAGE ntkrnlpa.exe!ZwLoadDriver 80582EA6 7 Bytes JMP 9D92FB10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
    PAGE ntkrnlpa.exe!NtCreateSection 805A9E9E 7 Bytes JMP 9D92F9D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
    PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BAF9A 5 Bytes JMP 9D92B5D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
    PAGE ntkrnlpa.exe!ObInsertObject 805C18D0 5 Bytes JMP 9D92CFFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
    PAGE ntkrnlpa.exe!ZwCreateProcessEx 805CFA2E 7 Bytes JMP 9D92FBB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
    init C:\WINDOWS\system32\Drivers\OEM02Afx.sys entry point in "init" section [0x9E42A310]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
    .text C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
    .text C:\WINDOWS\System32\svchost.exe[1088] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007E000A
    .text C:\WINDOWS\System32\svchost.exe[1088] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 007F000A
    .text C:\WINDOWS\System32\svchost.exe[1088] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 007D000C
    .text C:\WINDOWS\System32\svchost.exe[1088] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 00AB000A
    .text C:\WINDOWS\System32\svchost.exe[1088] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00A0000A
    .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1652] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
    .text C:\WINDOWS\Explorer.EXE[1752] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00AA000A
    .text C:\WINDOWS\Explorer.EXE[1752] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BF000A
    .text C:\WINDOWS\Explorer.EXE[1752] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A9000C

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[408] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002F0010
    IAT C:\WINDOWS\system32\services.exe[740] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003A0002
    IAT C:\WINDOWS\system32\services.exe[740] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003A0000
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\USER32.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6113A3BF] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu] [61138F66] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenuEx] [61138FA4] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [GDI32.dll!GetStockObject] [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6113A3BF] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!AnimateWindow] [611390DD] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx] [61138FA4] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcA] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] [611390A5] C:\Program Files\Yahoo!\Messenger\yui.dll
    IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[2448] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [61138F66] C:\Program Files\Yahoo!\Messenger\yui.dll

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

    AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8ADE7292
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8ADE7292
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8ADE7292
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 8ADE7292
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 8ADE7292

    AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

    Device \Device\Ide\IdeDeviceP2T0L0-e -> \??\IDE#DiskST9250827AS_____________________________3.ADB___#5&2747c3d6&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
    Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
    Disk \Device\Harddisk0\DR0 sectors 488396912 (+255): rootkit-like behavior;

    ---- Files - GMER 1.0.15 ----

    File C:\Documents and Settings\NetworkService\Cookies\system@adnxs[1].txt 0 bytes
    File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHM70TMJ\be943daa9233f8e7a808e8263c447902[1].txt 1285 bytes
    File C:\WINDOWS\Temp\fla2C.tmp 0 bytes
    File C:\WINDOWS\Temp\fla2D.tmp 0 bytes

    ---- EOF - GMER 1.0.15 ----


    MBRCheck


    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000001c

    Kernel Drivers (total 132):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806E2000 \WINDOWS\system32\hal.dll
    0x8AD33000 \WINDOWS\system32\KDCOM.DLL
    0xBA4BC000 \WINDOWS\system32\BOOTVID.dll
    0xB9F79000 ACPI.sys
    0xBA5A8000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xB9F68000 pci.sys
    0xBA0A8000 isapnp.sys
    0xBA0B8000 ohci1394.sys
    0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xBA4C0000 compbatt.sys
    0xBA4C4000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xBA670000 pciide.sys
    0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xBA0D8000 MountMgr.sys
    0xB9F49000 ftdisk.sys
    0xBA5AA000 dmload.sys
    0xB9F23000 dmio.sys
    0xBA330000 PartMgr.sys
    0xBA0E8000 VolSnap.sys
    0xB9F0B000 atapi.sys
    0xBA0F8000 disk.sys
    0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xB9EEB000 fltMgr.sys
    0xB9ED9000 sr.sys
    0xBA118000 PxHelp20.sys
    0xB9EC2000 KSecDD.sys
    0xB9EAF000 WudfPf.sys
    0xB9E22000 Ntfs.sys
    0xB9DF5000 NDIS.sys
    0xB9DDA000 Mup.sys
    0xBA238000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xB8DFB000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
    0xB8DE7000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xBA420000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xB8DC4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBA428000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xB8D9E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xB8D5D000 \SystemRoot\system32\DRIVERS\yk51x86.sys
    0xBA248000 \SystemRoot\system32\DRIVERS\nic1394.sys
    0xB8D49000 \SystemRoot\system32\DRIVERS\sdbus.sys
    0xBA258000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xB8D1D000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
    0xBA268000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
    0xB8CA1000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
    0xBA4A0000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xBA4A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xBA278000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xBA288000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xBA298000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xB8C7E000 \SystemRoot\system32\DRIVERS\ks.sys
    0xBA4B0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    0xB9D92000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xB9B93000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
    0xBA73C000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xBA5EA000 \SystemRoot\System32\Drivers\RootMdm.sys
    0xBA340000 \SystemRoot\System32\Drivers\Modem.SYS
    0xBA2A8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xB9B8F000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xB8C67000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xBA2B8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xBA2C8000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xBA370000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xB8C56000 \SystemRoot\system32\DRIVERS\psched.sys
    0xB940E000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xBA378000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xBA380000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xBA388000 \SystemRoot\system32\DRIVERS\RimSerial.sys
    0xB8C25000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xB93FE000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xBA5EC000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xB8BCC000 \SystemRoot\system32\DRIVERS\update.sys
    0xB9B77000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xBA308000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xA158C000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xBA5C4000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0x9E452000 \SystemRoot\system32\drivers\IntcHdmi.sys
    0x9E430000 \SystemRoot\system32\drivers\portcls.sys
    0xA157C000 \SystemRoot\system32\drivers\drmk.sys
    0x9E40D000 \??\C:\WINDOWS\system32\Drivers\OEM02Afx.sys
    0x9E2EF000 \SystemRoot\system32\drivers\sthda.sys
    0xBA5CE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xA0853000 \SystemRoot\System32\Drivers\Null.SYS
    0xBA5D0000 \SystemRoot\System32\Drivers\Beep.SYS
    0xA1FA2000 \SystemRoot\System32\drivers\vga.sys
    0xBA5D2000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xBA5D4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xA1F9A000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xA0B5E000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xA0144000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0x9DBB4000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0x9DB5C000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0x9FBB9000 \SystemRoot\System32\Drivers\aswTdi.SYS
    0x9DB13000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0x9DAEB000 \SystemRoot\system32\DRIVERS\netbt.sys
    0x9FBA9000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0x9DAC9000 \SystemRoot\System32\drivers\afd.sys
    0x9FB99000 \SystemRoot\system32\DRIVERS\arp1394.sys
    0x9FB89000 \SystemRoot\system32\DRIVERS\netbios.sys
    0x9D9FE000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0x9D98F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0x9FB79000 \SystemRoot\System32\Drivers\Fips.SYS
    0xA0B56000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0x9D955000 \SystemRoot\system32\DRIVERS\OEM02Dev.sys
    0xBA5D6000 \SystemRoot\system32\DRIVERS\OEM02Vfx.sys
    0x9D91A000 \SystemRoot\System32\Drivers\aswSP.SYS
    0xA0B3E000 \SystemRoot\System32\Drivers\Aavmker4.SYS
    0x974D7000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0x96311000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xBA65C000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0x97114000 \SystemRoot\System32\drivers\Dxapi.sys
    0x97547000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xBA76C000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF024000 \SystemRoot\System32\igxpgd32.dll
    0xBF012000 \SystemRoot\System32\igxprd32.dll
    0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
    0xBF1D9000 \SystemRoot\System32\igxpdx32.DLL
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0x9BECF000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
    0xB8971000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0x962FA000 \SystemRoot\System32\Drivers\aswMon2.SYS
    0x9617D000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB8919000 \SystemRoot\system32\drivers\sysaudio.sys
    0x95E03000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0x95C94000 \SystemRoot\system32\DRIVERS\srv.sys
    0x95518000 \SystemRoot\System32\Drivers\HTTP.sys
    0xA3A3A000 \SystemRoot\System32\Drivers\aswRdr.SYS
    0x9531D000 \??\C:\DOCUME~1\George\LOCALS~1\Temp\fgeoakow.sys
    0x952F2000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 61):
    0 System Idle Process
    4 System
    616 C:\WINDOWS\system32\smss.exe
    664 csrss.exe
    688 C:\WINDOWS\system32\winlogon.exe
    740 C:\WINDOWS\system32\services.exe
    752 C:\WINDOWS\system32\lsass.exe
    912 C:\WINDOWS\system32\svchost.exe
    988 svchost.exe
    1088 C:\WINDOWS\system32\svchost.exe
    1128 C:\WINDOWS\system32\svchost.exe
    1192 svchost.exe
    1336 svchost.exe
    1512 C:\WINDOWS\system32\WLTRYSVC.EXE
    1548 C:\WINDOWS\system32\BCMWLTRY.EXE
    1652 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    1752 C:\WINDOWS\explorer.exe
    444 C:\Program Files\DellTPad\Apoint.exe
    460 C:\WINDOWS\system32\hkcmd.exe
    468 C:\WINDOWS\system32\igfxpers.exe
    480 C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
    488 C:\WINDOWS\OEM02Mon.exe
    496 C:\WINDOWS\system32\WLTRAY.EXE
    516 C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    524 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    556 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    660 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    656 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    816 C:\WINDOWS\system32\ctfmon.exe
    1036 C:\Program Files\DellTPad\ApMsgFwd.exe
    1148 C:\WINDOWS\system32\igfxsrvc.exe
    1292 C:\Documents and Settings\George\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    1384 C:\SABRE\Apps\OADP\OadpUtil.exe
    1364 C:\Program Files\DellTPad\hidfind.exe
    1444 C:\WINDOWS\sabserv.exe
    1524 C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
    1532 C:\Program Files\DellTPad\ApntEx.exe
    1612 C:\Program Files\V CAST Media Manager\MEMonitor.exe
    2152 svchost.exe
    2196 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    2208 C:\Program Files\Application Updater\ApplicationUpdater.exe
    2232 C:\Program Files\Bonjour\mDNSResponder.exe
    2256 C:\WINDOWS\system32\CfgSrvc.exe
    2392 C:\WINDOWS\system32\CfgSrvc.exe
    2472 C:\Program Files\Java\jre6\bin\jqs.exe
    2496 C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    2556 C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
    2704 C:\WINDOWS\sdman.exe
    2712 C:\WINDOWS\system32\java.exe
    2856 C:\WINDOWS\system32\stacsv.exe
    2984 C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
    3000 C:\WINDOWS\system32\svchost.exe
    3104 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    3144 C:\SABRE\Apps\OADP\Oadp.exe
    3272 C:\WINDOWS\system32\wuauclt.exe
    2600 alg.exe
    2448 C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
    2656 C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    3336 C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    396 C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    2628 C:\Documents and Settings\George\My Documents\Downloads\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`738a7e00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`02800000 (NTFS)

    PhysicalDrive0 Model Number: ST9250827AS, Rev: 3.ADB

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
    conde357,
    #7
  9. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    DDS (Ver_10-11-26.01) - NTFSx86
    Run by George at 21:55:38.26 on Fri 11/26/2010
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2381 [GMT -5:00]

    AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\DellTPad\Apoint.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
    C:\WINDOWS\OEM02Mon.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Alwil Software\Avast5\avastUI.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DellTPad\ApMsgFwd.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Documents and Settings\George\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    C:\SABRE\Apps\OADP\OadpUtil.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\WINDOWS\sabserv.exe
    C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Program Files\V CAST Media Manager\MEMonitor.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Application Updater\ApplicationUpdater.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CfgSrvc.exe
    C:\WINDOWS\system32\CfgSrvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
    C:\WINDOWS\SDMan.EXE
    C:\WINDOWS\system32\java.exe
    C:\WINDOWS\system32\STacSV.exe
    C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\SABRE\Apps\OADP\Oadp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\mshta.exe
    C:\Documents and Settings\George\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\George\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Page =
    uSearch Bar =
    uStart Page = hxxp://www.google.com
    mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    uURLSearchHooks: H - No File
    uURLSearchHooks: H - No File
    uURLSearchHooks: H - No File
    uURLSearchHooks: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll
    uURLSearchHooks: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - c:\program files\pagerage\tbPag2.dll
    mURLSearchHooks: H - No File
    BHO: Dealio Toolbar: {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c} - c:\program files\dealio toolbar\ie\4.0.2\dealioToolbarIE.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: {36c44342-bcbe-4d64-b946-284d925d1767} - No File
    BHO: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - c:\program files\pagerage\tbPag2.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers client for internet explorer\YontooIEClient.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: PageRage Toolbar: {9565115d-c7d6-46d3-bd63-b67b481a4368} - c:\program files\pagerage\tbPag2.dll
    TB: Dealio Toolbar: {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c} - c:\program files\dealio toolbar\ie\4.0.2\dealioToolbarIE.dll
    TB: Search Toolbar: {0c8413c1-fad1-446c-8584-be50576f863e} - c:\program files\search toolbar\tbcore3.dll
    TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
    uRun: [fsm]
    uRun: [Google Update] "c:\documents and settings\george\local settings\application data\google\update\GoogleUpdate.exe" /c
    mRun: [Apoint] c:\program files\delltpad\Apoint.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [DELL Webcam Manager] "c:\program files\dell\dell webcam manager\DellWMgr.exe" /s
    mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
    mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
    mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
    mRun: [SearchSettings] c:\program files\search settings\SearchSettings.exe
    mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
    mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
    mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
    mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "g:\my music\itunes\iTunesHelper.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
    mRunServices: [Sabre Task Tray Icon] c:\sabre\Sabstart.exe
    StartupFolder: c:\docume~1\george\startm~1\programs\startup\pmbmed~1.lnk - c:\program files\sony\sony picture utility\pmbcore\SPUVolumeWatcher.exe
    StartupFolder: c:\docume~1\george\startm~1\programs\startup\vcastm~1.lnk - c:\program files\v cast media manager\MEMonitor.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\oadput~1.lnk - c:\sabre\apps\oadp\OadpUtil.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sabrep~1.lnk - c:\sabre\Sabstart.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sabres~1.lnk - c:\windows\sabserv.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    IE: {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - c:\program files\yahoo!\search protection\ysp.dll
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
    DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
    DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ============= SERVICES / DRIVERS ===============

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-8 165584]
    R2 Application Updater;Application Updater;c:\program files\application updater\ApplicationUpdater.exe [2010-1-8 380928]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-8 17744]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-8 40384]
    R2 CfgSrvc;Config Service Helper;c:\windows\system32\CfgSrvc.exe [2010-2-8 55296]
    R2 HsspConfig;HSSP Configuration Module;c:\windows\system32\CfgSrvc.exe [2010-2-8 55296]
    R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800]
    R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-9-9 91456]
    R2 SabrePrint;Sabre Printing Module;c:\sabre\apps\oadp\Oadp.exe [2010-2-8 512000]
    R2 SDMan;Sabre Device Manager;c:\windows\sdman.exe [2010-2-8 106496]
    R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-8 40384]
    R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-11-8 40384]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-12-18 105984]
    S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2010-9-9 6016]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2010-9-9 19712]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2010-9-9 8320]
    S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2010-9-9 23424]
    S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2010-9-9 9472]

    =============== Created Last 30 ================

    2010-11-27 00:26:20 -------- d-----w- C:\Logs
    2010-11-23 23:33:47 -------- d-----w- c:\docume~1\george\locals~1\applic~1\ConduitEngine
    2010-11-23 23:33:45 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2010-11-23 23:33:45 -------- d-----w- c:\program files\ConduitEngine
    2010-11-23 02:16:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-23 02:16:55 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2010-11-22 01:28:18 -------- d-----w- C:\DCIM
    2010-11-09 01:33:28 38848 ----a-w- c:\windows\avastSS.scr
    2010-11-09 01:33:18 -------- d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
    2010-11-09 01:22:34 -------- d-----w- c:\docume~1\george\applic~1\Malwarebytes
    2010-11-09 01:22:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-09 01:22:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-09 01:22:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-09 01:22:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-11-09 01:15:09 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData
    2010-10-30 22:30:54 -------- d-----w- c:\docume~1\george\locals~1\applic~1\Temp

    ==================== Find3M ====================

    2010-09-15 07:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

    =================== ROOTKIT ====================

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: ST9250827AS rev.3.ADB -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-e

    device: opened successfully
    user: MBR read successfully

    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8ADE7446]<<
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8aded504]; MOV EAX, [0x8aded580]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 ntkrnlpa!IofCallDriver[0x804EF0BC] -> \Device\Harddisk0\DR0[0x8ADF6AB8]
    3 CLASSPNP[0xBA10905B] -> ntkrnlpa!IofCallDriver[0x804EF0BC] -> [0x8AE1C528]
    \Driver\atapi[0x8AE198C0] -> IRP_MJ_CREATE -> 0x8ADE7446
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x137; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
    detected disk devices:
    \Device\Ide\IdeDeviceP2T0L0-e -> \??\IDE#DiskST9250827AS_____________________________3.ADB___#5&2747c3d6&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x8ADE7292
    user != kernel MBR !!!
    sectors 488397166 (+255): user != kernel
    Warning: possible TDL4 rootkit infection !
    TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

    ============= FINISH: 21:56:06.12 ===============
     
    conde357,
    #8
  10. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-11-26.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/18/2008 1:57:19 PM
    System Uptime: 11/26/2010 9:19:50 PM (0 hours ago)

    Motherboard: Dell Inc. | | 0U990C
    Processor: Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz | Microprocessor | 1995/200mhz
    Processor: Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz | Microprocessor | 1995/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 223 GiB total, 202.065 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 4.984 GiB free.
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description: Modem Device on High Definition Audio Bus
    Device ID: HDAUDIO\FUNC_02&VEN_14F1&DEV_2C06&SUBSYS_14F1000F&REV_1000\4&21C1B09&0&0002
    Manufacturer:
    Name: Modem Device on High Definition Audio Bus
    PNP Device ID: HDAUDIO\FUNC_02&VEN_14F1&DEV_2C06&SUBSYS_14F1000F&REV_1000\4&21C1B09&0&0002
    Service:

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Dell Wireless 1395 WLAN Mini-Card
    Device ID: PCI\VEN_14E4&DEV_4315&SUBSYS_000B1028&REV_01\4&AB208E&0&00E1
    Manufacturer: Broadcom
    Name: Dell Wireless 1395 WLAN Mini-Card
    PNP Device ID: PCI\VEN_14E4&DEV_4315&SUBSYS_000B1028&REV_01\4&AB208E&0&00E1
    Service: BCM43XX

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4AF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4AF0
    Service:

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4BF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4BF0
    Service:

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4CF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_022F1028&REV_12\4&28D6DE3B&0&4CF0
    Service:

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: SM Bus Controller
    Device ID: PCI\VEN_8086&DEV_283E&SUBSYS_022F1028&REV_02\3&61AAA01&0&FB
    Manufacturer:
    Name: SM Bus Controller
    PNP Device ID: PCI\VEN_8086&DEV_283E&SUBSYS_022F1028&REV_02\3&61AAA01&0&FB
    Service:

    ==== System Restore Points ===================

    RP1: 9/23/2010 5:29:47 PM - System Checkpoint
    RP2: 9/28/2010 11:27:30 PM - Software Distribution Service 3.0
    RP3: 10/3/2010 6:40:14 PM - System Checkpoint
    RP4: 10/6/2010 5:47:23 PM - Avg8 Update
    RP5: 10/8/2010 7:43:28 PM - System Checkpoint
    RP6: 10/11/2010 6:17:44 PM - System Checkpoint
    RP7: 10/14/2010 11:05:49 PM - Software Distribution Service 3.0
    RP8: 10/19/2010 8:05:02 PM - System Checkpoint
    RP9: 10/26/2010 5:48:08 PM - Avg8 Update
    RP10: 10/26/2010 5:49:12 PM - Avg8 Update
    RP11: 10/29/2010 6:16:43 PM - System Checkpoint
    RP12: 10/31/2010 10:20:08 PM - System Checkpoint
    RP13: 11/2/2010 6:05:16 PM - Installed Microsoft Office Word Viewer 2003
    RP14: 11/3/2010 7:44:47 PM - Software Distribution Service 3.0
    RP15: 11/5/2010 7:20:54 PM - System Checkpoint
    RP16: 11/7/2010 2:00:59 PM - System Checkpoint
    RP17: 11/8/2010 6:35:28 PM - Restore Operation
    RP18: 11/8/2010 6:39:04 PM - Restore Operation
    RP19: 11/8/2010 6:42:55 PM - Removed Microsoft Office Word Viewer 2003
    RP20: 11/8/2010 6:46:48 PM - Restore Operation
    RP21: 11/8/2010 6:49:57 PM - Restore Operation
    RP22: 11/8/2010 6:53:19 PM - Restore Operation
    RP23: 11/8/2010 6:59:06 PM - Restore Operation
    RP24: 11/8/2010 7:02:44 PM - Restore Operation
    RP25: 11/8/2010 7:04:01 PM - Restore
    RP26: 11/8/2010 7:06:44 PM - Restore Operation
    RP27: 11/8/2010 7:11:21 PM - Restore Operation
    RP28: 11/8/2010 7:15:19 PM - Restore Operation
    RP29: 11/8/2010 8:33:18 PM - avast! Free Antivirus Setup
    RP30: 11/8/2010 11:40:32 PM - Removed AVG Free 8.5
    RP31: 11/8/2010 11:41:44 PM - Installed AVG Free 8.5
    RP32: 11/10/2010 7:59:20 PM - Software Distribution Service 3.0
    RP33: 11/13/2010 12:46:03 PM - System Checkpoint
    RP34: 11/14/2010 6:52:40 PM - System Checkpoint
    RP35: 11/22/2010 9:16:24 PM - Installed Java(TM) 6 Update 22
    RP36: 11/24/2010 7:48:07 PM - System Checkpoint
    RP37: 11/26/2010 5:52:25 PM - System Checkpoint

    ==== Installed Programs ======================


    1.29
    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.4.0
    Advanced Audio FX Engine
    Advanced Video FX Engine
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    avast! Free Antivirus
    BlackBerry Desktop Software 5.0
    Bonjour
    Canon IJ Network Scan Utility
    Canon IJ Network Tool
    Canon MP Navigator EX 3.0
    Canon MP560 series MP Drivers
    Canon MP560 series User Registration
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    CASIO USB Driver V1.2.2474.0623
    Critical Update for Windows Media Player 11 (KB959772)
    Dealio Toolbar v4.0.2
    Dell Touchpad
    Dell Webcam Center
    Dell Webcam Manager
    Dell Wireless WLAN Card
    Facebook Plug-In
    Garmin Communicator Plugin
    Garmin USB Drivers
    Google Chrome
    Google Talk (remove only)
    Google Talk Plugin
    GoToMeeting 4.5.0.457
    Help 1.0
    High Definition Audio Driver Package - KB835221
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB908673)
    Hotfix for Windows XP (KB914642)
    Hotfix for Windows XP (KB926239)
    Hotfix for Windows XP (KB937930)
    Hotfix for Windows XP (KB946629)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    Intel(R) Graphics Media Accelerator Driver
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 22
    Java(TM) 6 Update 3
    Laptop Integrated Webcam Driver (1.03.02.0719)
    LG Android Drivers
    LG USB Modem driver
    LimeWire 4.14.12
    linksadoor 1.29
    Linksys Updater
    Live! Cam Avatar v1.0
    Malwarebytes' Anti-Malware
    Marvell Miniport Driver
    Media Player Codec Pack 3.9.0
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    MotoConnect
    Motorola Driver Installation 4.6.0
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB973686)
    MySabre
    OGA Notifier 2.0.0048.0
    Ogg Codecs 0.81.15562
    Open Systems Client
    PageRage Toolbar
    PaltalkScene
    Pantech Handset Driver
    Primo
    QuickTime
    Runtime
    Sabre Device Manager
    Sabre Print Module
    Sabre VPN
    Safari
    SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
    Samsung_I500 1.0
    Search Settings v1.2.3
    Search Toolbar
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2289158)
    Security Update for 2007 Microsoft Office System (KB2344875)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2345035)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office Outlook 2007 (KB2288953)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
    Security Update for Microsoft Office Publisher 2007 (KB982124)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937894)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB958470)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971032)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    ShowInfo
    SigmaTel Audio
    Software Informer 1.0 BETA
    Sony Picture Utility
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Outlook 2007 Junk Email Filter (KB2443839)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896256)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB925720)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    V CAST Media Manager
    Verizon High Speed Internet
    Verizon Yahoo! Applications
    WebFldrs XP
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Installer 3.1 (KB893803)
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885855
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781
    Yahoo! Search Protection
    Yahoo! Software Update
    Yontoo Layers Client 1.10.01

    ==== Event Viewer Messages From Past Week ========

    11/26/2010 9:26:06 PM, error: atapi [9] - The device, \Device\Ide\IdePort2, did not respond within the timeout period.
    11/26/2010 9:17:47 PM, error: Service Control Manager [7034] - The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
    11/26/2010 5:24:52 PM, error: Modem [2] - Not enough resources were available for the driver.
    11/25/2010 10:29:50 AM, error: Service Control Manager [7022] - The Automatic Updates service hung on starting.
    11/19/2010 10:23:35 AM, error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The system cannot find the file specified.

    ==== End Of File ===========================
     
    conde357,
    #9
  11. 2010/11/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Oh boy, we have all kind of issues here...

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
    broni,
    #10
  12. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    2010/11/26 23:39:34.0937 TDSS rootkit removing tool 2.4.9.0 Nov 26 2010 15:38:31
    2010/11/26 23:39:34.0937 ================================================================================
    2010/11/26 23:39:34.0937 SystemInfo:
    2010/11/26 23:39:34.0937
    2010/11/26 23:39:34.0937 OS Version: 5.1.2600 ServicePack: 2.0
    2010/11/26 23:39:34.0937 Product type: Workstation
    2010/11/26 23:39:34.0937 ComputerName: GEORGE-C59B45AB
    2010/11/26 23:39:34.0937 UserName: George
    2010/11/26 23:39:34.0937 Windows directory: C:\WINDOWS
    2010/11/26 23:39:34.0937 System windows directory: C:\WINDOWS
    2010/11/26 23:39:34.0937 Processor architecture: Intel x86
    2010/11/26 23:39:34.0937 Number of processors: 2
    2010/11/26 23:39:34.0937 Page size: 0x1000
    2010/11/26 23:39:34.0937 Boot type: Normal boot
    2010/11/26 23:39:34.0937 ================================================================================
    2010/11/26 23:39:35.0156 Initialize success
    2010/11/26 23:40:13.0531 ================================================================================
    2010/11/26 23:40:13.0531 Scan started
    2010/11/26 23:40:13.0531 Mode: Manual;
    2010/11/26 23:40:13.0531 ================================================================================
    2010/11/26 23:40:13.0968 Aavmker4 (8d488938e2f7048906f1fbd3af394887) C:\WINDOWS\system32\drivers\Aavmker4.sys
    2010/11/26 23:40:14.0140 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2010/11/26 23:40:14.0218 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2010/11/26 23:40:14.0375 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
    2010/11/26 23:40:14.0453 AFD (944ca435bfcfc82cc1ed9e3a7d731aa9) C:\WINDOWS\System32\drivers\afd.sys
    2010/11/26 23:40:14.0781 ApfiltrService (a80230bd04f0b8bf05185b369bb1cbb8) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
    2010/11/26 23:40:14.0875 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
    2010/11/26 23:40:15.0125 aswFsBlk (a0d86b8ac93ef95620420c7a24ac5344) C:\WINDOWS\system32\drivers\aswFsBlk.sys
    2010/11/26 23:40:15.0140 aswMon2 (7d880c76a285a41284d862e2d798ec0d) C:\WINDOWS\system32\drivers\aswMon2.sys
    2010/11/26 23:40:15.0171 aswRdr (69823954bbd461a73d69774928c9737e) C:\WINDOWS\system32\drivers\aswRdr.sys
    2010/11/26 23:40:15.0203 aswSP (7ecc2776638b04553f9a85bd684c3abf) C:\WINDOWS\system32\drivers\aswSP.sys
    2010/11/26 23:40:15.0234 aswTdi (095ed820a926aa8189180b305e1bcfc9) C:\WINDOWS\system32\drivers\aswTdi.sys
    2010/11/26 23:40:15.0281 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2010/11/26 23:40:15.0343 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2010/11/26 23:40:15.0375 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2010/11/26 23:40:15.0453 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2010/11/26 23:40:15.0578 BCM43XX (e9ea635b8432d68f0005b3f6cebab837) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
    2010/11/26 23:40:15.0703 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2010/11/26 23:40:15.0812 BTCFilterService (4813df77ede536a52e3737971f910baa) C:\WINDOWS\system32\DRIVERS\motfilt.sys
    2010/11/26 23:40:15.0890 BVRPMPR5 (248dfa5762dde38dfddbbd44149e9d7a) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
    2010/11/26 23:40:15.0968 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2010/11/26 23:40:16.0062 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    2010/11/26 23:40:16.0203 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2010/11/26 23:40:16.0281 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
    2010/11/26 23:40:16.0359 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2010/11/26 23:40:16.0484 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    2010/11/26 23:40:16.0609 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
    2010/11/26 23:40:16.0843 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
    2010/11/26 23:40:16.0984 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
    2010/11/26 23:40:17.0140 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
    2010/11/26 23:40:17.0203 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2010/11/26 23:40:17.0312 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
    2010/11/26 23:40:17.0406 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
    2010/11/26 23:40:17.0515 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
    2010/11/26 23:40:17.0578 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
    2010/11/26 23:40:17.0656 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
    2010/11/26 23:40:17.0687 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
    2010/11/26 23:40:17.0781 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
    2010/11/26 23:40:17.0828 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2010/11/26 23:40:17.0890 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2010/11/26 23:40:17.0968 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    2010/11/26 23:40:18.0046 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2010/11/26 23:40:18.0171 grmnusb (d956358054e99e6ffac69cd87e893a89) C:\WINDOWS\system32\drivers\grmnusb.sys
    2010/11/26 23:40:18.0250 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2010/11/26 23:40:18.0421 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
    2010/11/26 23:40:18.0546 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2010/11/26 23:40:18.0859 ialm (bffa387180121df1e4646c4ced3e16ca) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
    2010/11/26 23:40:19.0187 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2010/11/26 23:40:19.0375 IntcHdmiAddService (99d47d1cf700982b37cce16b068449f0) C:\WINDOWS\system32\drivers\IntcHdmi.sys
    2010/11/26 23:40:19.0515 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2010/11/26 23:40:19.0640 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2010/11/26 23:40:19.0718 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2010/11/26 23:40:19.0796 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2010/11/26 23:40:19.0921 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2010/11/26 23:40:20.0000 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2010/11/26 23:40:20.0062 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2010/11/26 23:40:20.0140 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2010/11/26 23:40:20.0250 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
    2010/11/26 23:40:20.0312 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
    2010/11/26 23:40:20.0515 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2010/11/26 23:40:20.0593 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
    2010/11/26 23:40:20.0656 motccgp (c741717b0a18813dd7d12085937cee72) C:\WINDOWS\system32\DRIVERS\motccgp.sys
    2010/11/26 23:40:20.0734 motccgpfl (b812da6605caf02641312f1f65c75419) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
    2010/11/26 23:40:20.0828 motmodem (54fee02961c70fd9d4d7e2f87afa23fa) C:\WINDOWS\system32\DRIVERS\motmodem.sys
    2010/11/26 23:40:20.0906 MotoSwitchService (fd8c2cef7ad8b23c6714103d621fac1f) C:\WINDOWS\system32\DRIVERS\motswch.sys
    2010/11/26 23:40:20.0984 Motousbnet (ddc489d40b49f443787e7ffa75373522) C:\WINDOWS\system32\DRIVERS\Motousbnet.sys
    2010/11/26 23:40:21.0078 motusbdevice (2136cca3d1bf7c0248e5366b1a6c24e3) C:\WINDOWS\system32\DRIVERS\motusbdevice.sys
    2010/11/26 23:40:21.0156 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2010/11/26 23:40:21.0265 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
    2010/11/26 23:40:21.0375 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2010/11/26 23:40:21.0484 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2010/11/26 23:40:21.0562 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
    2010/11/26 23:40:21.0671 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2010/11/26 23:40:21.0718 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2010/11/26 23:40:21.0765 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
    2010/11/26 23:40:21.0843 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2010/11/26 23:40:21.0906 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
    2010/11/26 23:40:22.0000 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
    2010/11/26 23:40:22.0078 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    2010/11/26 23:40:22.0156 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
    2010/11/26 23:40:22.0265 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    2010/11/26 23:40:22.0359 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2010/11/26 23:40:22.0437 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2010/11/26 23:40:22.0500 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2010/11/26 23:40:22.0562 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
    2010/11/26 23:40:22.0609 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2010/11/26 23:40:22.0640 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2010/11/26 23:40:22.0781 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
    2010/11/26 23:40:22.0843 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
    2010/11/26 23:40:22.0937 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
    2010/11/26 23:40:23.0031 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2010/11/26 23:40:23.0109 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2010/11/26 23:40:23.0171 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2010/11/26 23:40:23.0250 OEM02Afx (58f478fd0115012ceec75fb73628901c) C:\WINDOWS\system32\Drivers\OEM02Afx.sys
    2010/11/26 23:40:23.0296 OEM02Dev (9d20fa5d8875f6063aa5e1c44446f698) C:\WINDOWS\system32\DRIVERS\OEM02Dev.sys
    2010/11/26 23:40:23.0359 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\WINDOWS\system32\DRIVERS\OEM02Vfx.sys
    2010/11/26 23:40:23.0453 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
    2010/11/26 23:40:23.0546 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\drivers\Parport.sys
    2010/11/26 23:40:23.0625 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
    2010/11/26 23:40:23.0703 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2010/11/26 23:40:23.0781 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/11/26 23:40:23.0906 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2010/11/26 23:40:24.0000 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2010/11/26 23:40:24.0406 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2010/11/26 23:40:24.0437 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
    2010/11/26 23:40:24.0484 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2010/11/26 23:40:24.0578 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2010/11/26 23:40:24.0781 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2010/11/26 23:40:24.0812 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2010/11/26 23:40:24.0859 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2010/11/26 23:40:24.0890 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2010/11/26 23:40:24.0968 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2010/11/26 23:40:25.0000 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/11/26 23:40:25.0093 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2010/11/26 23:40:25.0171 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
    2010/11/26 23:40:25.0250 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2010/11/26 23:40:25.0296 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
    2010/11/26 23:40:25.0359 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
    2010/11/26 23:40:25.0453 sdbus (1f5fe79bef47bac7447271d50914ba20) C:\WINDOWS\system32\DRIVERS\sdbus.sys
    2010/11/26 23:40:25.0515 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2010/11/26 23:40:25.0578 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\drivers\Serial.sys
    2010/11/26 23:40:25.0625 sffdisk (577f8d2277a55d279c0f9b81457f710f) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
    2010/11/26 23:40:25.0640 sffp_sd (ef902a9a054089808261fb34004f7920) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
    2010/11/26 23:40:25.0671 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2010/11/26 23:40:25.0765 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    2010/11/26 23:40:25.0875 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
    2010/11/26 23:40:25.0953 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
    2010/11/26 23:40:26.0015 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
    2010/11/26 23:40:26.0171 STHDA (951801dfb54d86f611f0af47825476f9) C:\WINDOWS\system32\drivers\sthda.sys
    2010/11/26 23:40:26.0265 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    2010/11/26 23:40:26.0390 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2010/11/26 23:40:26.0484 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
    2010/11/26 23:40:26.0765 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
    2010/11/26 23:40:26.0875 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2010/11/26 23:40:26.0953 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2010/11/26 23:40:27.0031 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
    2010/11/26 23:40:27.0078 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2010/11/26 23:40:27.0265 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
    2010/11/26 23:40:27.0406 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
    2010/11/26 23:40:27.0531 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2010/11/26 23:40:27.0625 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2010/11/26 23:40:27.0703 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2010/11/26 23:40:27.0765 usbhub (ace960e54148821e8e48f5d191562c28) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2010/11/26 23:40:27.0828 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2010/11/26 23:40:27.0921 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2010/11/26 23:40:28.0000 usbvideo (8968ff3973a883c49e8b564200f565b9) C:\WINDOWS\system32\Drivers\usbvideo.sys
    2010/11/26 23:40:28.0062 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
    2010/11/26 23:40:28.0171 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
    2010/11/26 23:40:28.0281 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2010/11/26 23:40:28.0406 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2010/11/26 23:40:28.0531 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
    2010/11/26 23:40:28.0640 WmiAcpi (ae2c8544e747c20062db27456ea2d67a) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    2010/11/26 23:40:28.0734 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    2010/11/26 23:40:28.0812 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    2010/11/26 23:40:28.0875 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    2010/11/26 23:40:28.0937 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    2010/11/26 23:40:29.0046 yukonwxp (67331fd053f97a874a60374be6b59523) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
    2010/11/26 23:40:29.0125 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
    2010/11/26 23:40:29.0125 ================================================================================
    2010/11/26 23:40:29.0125 Scan finished
    2010/11/26 23:40:29.0125 ================================================================================
    2010/11/26 23:40:29.0156 Detected object count: 1
    2010/11/26 23:40:37.0187 \HardDisk0 - will be cured after reboot
    2010/11/26 23:40:37.0187 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
    2010/11/26 23:41:34.0046 Deinitialize success
     
    conde357,
    #11
  13. 2010/11/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #12
  14. 2010/11/26
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    I could not get it to save to the desktop



    ComboFix 10-11-26.06 - George 11/27/2010 0:40.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2513 [GMT -5:00]
    Running from: c:\documents and settings\George\My Documents\Downloads\ComboFix.exe
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\Toolbar4
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\basis.xml
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bg.bmp
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bing_logo.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\celebrity.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_images.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_maps.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_news.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_videos.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_web.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\facebook.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\favicon.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\games.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\hotmail.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\icon.ico
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\images.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\include.xml
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\info.txt
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\lifestyle.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\maps.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\messenger.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\msn.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\news.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\SearchToolbarUninstall.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\twitter.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\version.txt
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\video.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\videos.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\weather.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\web.png
    c:\documents and settings\George\Application Data\completescan
    c:\documents and settings\George\Application Data\Dealio
    c:\documents and settings\George\Application Data\Dealio\res\widgets.xml
    c:\documents and settings\George\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
    c:\documents and settings\George\Application Data\install
    c:\documents and settings\George\Application Data\PriceGong
    c:\documents and settings\George\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\George\g2mdlhlpx.exe
    c:\documents and settings\George\Recent\Thumbs.db
    c:\program files\Dealio Toolbar
    c:\program files\Dealio Toolbar\FF\chrome.manifest
    c:\program files\Dealio Toolbar\FF\chrome\content\chevron.js
    c:\program files\Dealio Toolbar\FF\chrome\content\chevron.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\login.js
    c:\program files\Dealio Toolbar\FF\chrome\content\login.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\parser.js
    c:\program files\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js
    c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.js
    c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\widgichevron.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgicomm.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgihandling.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgilisteners.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\widgiui.js
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\amazon.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\apple.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\barnes.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\bestbuy.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\chevron.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\ebay.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\icon_settings.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\macys.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\newegg.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\overstock.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-button.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_amazon.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_dealio.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_ebay.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\searchbox.css
    c:\program files\Dealio Toolbar\FF\chrome\skin\separator.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\target.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\walmart.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css
    c:\program files\Dealio Toolbar\FF\components\config.ini
    c:\program files\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt
    c:\program files\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt
    c:\program files\Dealio Toolbar\FF\install.rdf
    c:\program files\Dealio Toolbar\IE\4.0.2\config.ini
    c:\program files\Dealio Toolbar\Res\amazon.gif
    c:\program files\Dealio Toolbar\Res\apple.gif
    c:\program files\Dealio Toolbar\Res\barnes.gif
    c:\program files\Dealio Toolbar\Res\bestbuy.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
    c:\program files\Dealio Toolbar\Res\ebay.gif
    c:\program files\Dealio Toolbar\Res\icon_settings.gif
    c:\program files\Dealio Toolbar\Res\macys.gif
    c:\program files\Dealio Toolbar\Res\newegg.gif
    c:\program files\Dealio Toolbar\Res\overstock.gif
    c:\program files\Dealio Toolbar\Res\search-button-hover.gif
    c:\program files\Dealio Toolbar\Res\search-button.gif
    c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
    c:\program files\Dealio Toolbar\Res\search-chevron.gif
    c:\program files\Dealio Toolbar\Res\search_amazon.gif
    c:\program files\Dealio Toolbar\Res\search_dealio.gif
    c:\program files\Dealio Toolbar\Res\search_ebay.gif
    c:\program files\Dealio Toolbar\Res\search_yahoo.gif
    c:\program files\Dealio Toolbar\Res\target.gif
    c:\program files\Dealio Toolbar\Res\walmart.gif
    c:\program files\Dealio Toolbar\Res\widgets.xml
    c:\program files\Search Settings
    c:\program files\Search Settings\FF\chrome.manifest
    c:\program files\Search Settings\FF\chrome\content\plugin.js
    c:\program files\Search Settings\FF\chrome\content\plugin.xul
    c:\program files\Search Settings\FF\chrome\content\protection.js
    c:\program files\Search Settings\FF\chrome\content\utils.js
    c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
    c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
    c:\program files\Search Settings\FF\components\IFBHOSearch.xpt
    c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
    c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt
    c:\program files\Search Settings\FF\components\SearchSettingsFF.dll
    c:\program files\Search Settings\FF\install.rdf
    c:\program files\Search Settings\SearchSettings.dll
    c:\program files\Search Settings\SearchSettings.exe
    c:\program files\Search Settings\SearchSettingsRes409.dll
    c:\program files\Search Toolbar
    c:\program files\Search Toolbar\basis.xml
    c:\program files\Search Toolbar\bg.bmp
    c:\program files\Search Toolbar\bing_logo.png
    c:\program files\Search Toolbar\celebrity.png
    c:\program files\Search Toolbar\drop_images.png
    c:\program files\Search Toolbar\drop_maps.png
    c:\program files\Search Toolbar\drop_news.png
    c:\program files\Search Toolbar\drop_videos.png
    c:\program files\Search Toolbar\drop_web.png
    c:\program files\Search Toolbar\facebook.png
    c:\program files\Search Toolbar\favicon.png
    c:\program files\Search Toolbar\games.png
    c:\program files\Search Toolbar\hotmail.png
    c:\program files\Search Toolbar\icon.ico
    c:\program files\Search Toolbar\images.png
    c:\program files\Search Toolbar\include.xml
    c:\program files\Search Toolbar\info.txt
    c:\program files\Search Toolbar\lifestyle.png
    c:\program files\Search Toolbar\maps.png
    c:\program files\Search Toolbar\messenger.png
    c:\program files\Search Toolbar\msn.png
    c:\program files\Search Toolbar\news.png
    c:\program files\Search Toolbar\SearchToolbar.dll
    c:\program files\Search Toolbar\SearchToolbarUninstall.exe
    c:\program files\Search Toolbar\tbcore3.dll
    c:\program files\Search Toolbar\tbhelper.dll
    c:\program files\Search Toolbar\twitter.png
    c:\program files\Search Toolbar\uninstall.exe
    c:\program files\Search Toolbar\update.exe
    c:\program files\Search Toolbar\version.txt
    c:\program files\Search Toolbar\video.png
    c:\program files\Search Toolbar\videos.png
    c:\program files\Search Toolbar\weather.png
    c:\program files\Search Toolbar\web.png
    c:\windows\sv.ini
    c:\windows\system32\drivers\etc\lmhosts
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    c:\windows\system32\winlogon.exe . . . is infected!!

    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-10-27 to 2010-11-27 )))))))))))))))))))))))))))))))
    .

    2010-11-27 05:14 . 2010-11-27 05:15 -------- dc-h--w- c:\windows\ie8
    2010-11-27 02:12 . 2010-11-27 02:12 -------- d-s---w- c:\documents and settings\NetworkService\UserData
    2010-11-27 00:26 . 2010-11-27 00:34 -------- d-----w- C:\Logs
    2010-11-23 23:33 . 2010-11-25 02:51 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 -------- d-----w- c:\program files\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-22 01:28 . 2010-11-22 01:28 -------- d-----w- C:\DCIM
    2010-11-16 23:47 . 2010-11-16 23:47 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-11-16 23:04 . 2010-11-16 23:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-11-15 00:39 . 2010-11-15 00:39 -------- d-----w- c:\documents and settings\Administrator
    2010-11-09 01:33 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-11-09 01:33 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-11-09 01:33 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-11-09 01:33 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-11-09 01:33 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-11-09 01:33 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-11-09 01:33 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-11-09 01:33 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
    2010-11-09 01:33 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\program files\Alwil Software
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\George\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-09 01:15 . 2010-11-09 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
    2010-11-06 16:37 . 2010-11-06 16:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2010-10-30 22:30 . 2010-11-25 02:57 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\Temp

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-15 07:29 . 2008-12-20 00:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-10 02:53 . 2010-09-10 02:53 53248 ----a-r- c:\documents and settings\George\Application Data\Microsoft\Installer\{08DEC21F-F7E5-46F9-81D1-3ED30BD3AEC9}\ARPPRODUCTICON.exe
    .

    ------- Sigcheck -------

    [-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\spoolsv.exe
    [7] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
    [7] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe
    [7] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

    [-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe
    [-] 2004-08-04 . 5188C01343FF942F3982F2C6440F3C17 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

    [-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe
    [-] 2007-06-13 . 82852070785B5BE6E99D414FF4CFE920 . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe
    [7] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
    [7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

    [-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\ip6fw.sys
    [7] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
    [-] 2004-08-04 12:00 . D41D8CD98F00B204E9800998ECF8427E . 0 . . [------] . . c:\windows\system32\drivers\ip6fw.sys

    c:\windows\System32\spoolsv.exe ... is missing !!
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\PageRage\tbPag2.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
    2010-04-20 18:09 194912 ------w- c:\program files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{9565115D-C7D6-46D3-BD63-B67B481A4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
    "Google Update "= "c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-30 136176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
    "DELL Webcam Manager "= "c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
    "OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2007-05-10 36864]
    "Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2007-10-10 2183168]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
    "CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
    "IJNetworkScanUtility "= "c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
    "QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "avast5 "= "c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

    c:\documents and settings\George\Start Menu\Programs\Startup\
    PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-1-4 333088]
    V CAST Media Monitor.lnk - c:\program files\V CAST Media Manager\MEMonitor.exe [2010-9-9 2991464]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    OADP Utility.lnk - c:\sabre\Apps\OADP\OadpUtil.exe [2010-2-8 528452]
    Sabre Printing Start.lnk - c:\sabre\Sabstart.exe [2010-2-8 20992]
    Sabre Server.lnk - c:\windows\sabserv.exe [2010-2-8 135168]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Downloads\\_extracted\\Portable_SopCast.rar.extracted\\Portable SopCast.exe "=
    "c:\\Documents and Settings\\George\\Application Data\\Thinstall\\SopCast 3.0.3\\4000008d00003i\\SopAdver.exe "=
    "c:\\SABRE\\Apps\\OADP\\OadpUtil.exe "=
    "c:\\WINDOWS\\sabserv.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe "=
    "c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaws.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Paltalk Messenger\\paltalk.exe "=
    "c:\\Documents and Settings\\George\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/8/2010 8:33 PM 165584]
    R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [1/8/2010 12:51 AM 380928]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/8/2010 8:33 PM 17744]
    R2 CfgSrvc;Config Service Helper;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 HsspConfig;HSSP Configuration Module;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800]
    R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [9/9/2010 9:08 PM 91456]
    R2 SabrePrint;Sabre Printing Module;c:\sabre\Apps\OADP\Oadp.exe [2/8/2010 8:31 PM 512000]
    R2 SDMan;Sabre Device Manager;c:\windows\sdman.exe [2/8/2010 8:30 PM 106496]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/18/2008 2:27 PM 105984]
    S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [9/9/2010 9:08 PM 6016]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [9/9/2010 9:08 PM 19712]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [9/9/2010 9:08 PM 8320]
    S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [9/9/2010 9:08 PM 23424]
    S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [9/9/2010 9:08 PM 9472]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-09-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2010-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003Core.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003UA.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
    .
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-{36c44342-bcbe-4d64-b946-284d925d1767} - (no file)
    URLSearchHooks-9565115d-c7d6-46d3-bd63-b67b481a4368} - (no file)
    URLSearchHooks-E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
    BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
    BHO-{36c44342-bcbe-4d64-b946-284d925d1767} - (no file)
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
    Toolbar-{0C8413C1-FAD1-446C-8584-BE50576F863E} - c:\program files\Search Toolbar\tbcore3.dll
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{0C8413C1-FAD1-446C-8584-BE50576F863E} - c:\program files\Search Toolbar\tbcore3.dll
    HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
    HKCU-Run-fsm - (no file)
    HKLM-Run-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
    HKLM-Run-iTunesHelper - g:\my music\iTunes\iTunesHelper.exe
    AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-27 00:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker4 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(688)
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(2392)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\WLTRYSVC.EXE
    c:\windows\System32\bcmwltry.exe
    c:\program files\Alwil Software\Avast5\AvastSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\igfxsrvc.exe
    c:\windows\system32\java.exe
    c:\windows\system32\STacSV.exe
    c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    c:\program files\DellTPad\ApMsgFwd.exe
    c:\program files\DellTPad\HidFind.exe
    c:\program files\DellTPad\Apntex.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\documents and settings\George\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    c:\program files\Motorola\MotoConnectService\MotoConnect.exe
    c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-27 00:52:35 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-27 05:52

    Pre-Run: 216,573,546,496 bytes free
    Post-Run: 217,991,204,864 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug= "do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - 8D08516EE3636CB350510F3DC0720927
     
    conde357,
    #13
  15. 2010/11/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, move combofix.exe file to your desktop.

    Do you have Windows XP CD?


    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    FCopy::
c:\windows\system32\dllcache\spoolsv.exe | c:\windows\System32\spoolsv.exe
c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe | c:\windows\system32\winlogon.exe
c:\windows\system32\dllcache\ip6fw.sys | c:\windows\system32\drivers\ip6fw.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
 "AntiVirusOverride "=-

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
    broni,
    #14
  16. 2010/11/27
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    I don't have the CD. I posted the combofix text file and the text file after the boot which I posted below



    Combofix log


    Combofix.txt


    ComboFix 10-11-26.06 - George 11/27/2010 0:40.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2513 [GMT -5:00]
    Running from: c:\documents and settings\George\My Documents\Downloads\ComboFix.exe
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\Toolbar4
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\basis.xml
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bg.bmp
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\bing_logo.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\celebrity.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_images.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_maps.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_news.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_videos.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\drop_web.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\facebook.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\favicon.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\games.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\hotmail.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\icon.ico
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\images.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\include.xml
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\info.txt
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\lifestyle.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\maps.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\messenger.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\msn.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\news.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\SearchToolbarUninstall.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\twitter.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\uninstall.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\update.exe
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\version.txt
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\video.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\videos.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\weather.png
    c:\documents and settings\All Users\Application Data\Toolbar4\{0C8413C1-FAD1-446C-8584-BE50576F863E}\web.png
    c:\documents and settings\George\Application Data\completescan
    c:\documents and settings\George\Application Data\Dealio
    c:\documents and settings\George\Application Data\Dealio\res\widgets.xml
    c:\documents and settings\George\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
    c:\documents and settings\George\Application Data\install
    c:\documents and settings\George\Application Data\PriceGong
    c:\documents and settings\George\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\George\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\George\g2mdlhlpx.exe
    c:\documents and settings\George\Recent\Thumbs.db
    c:\program files\Dealio Toolbar
    c:\program files\Dealio Toolbar\FF\chrome.manifest
    c:\program files\Dealio Toolbar\FF\chrome\content\chevron.js
    c:\program files\Dealio Toolbar\FF\chrome\content\chevron.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\login.js
    c:\program files\Dealio Toolbar\FF\chrome\content\login.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\parser.js
    c:\program files\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js
    c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.js
    c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\widgichevron.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgicomm.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgihandling.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgilisteners.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js
    c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul
    c:\program files\Dealio Toolbar\FF\chrome\content\widgiui.js
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties
    c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\amazon.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\apple.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\barnes.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\bestbuy.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\chevron.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\ebay.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\icon_settings.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\macys.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\newegg.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\overstock.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-button.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_amazon.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_dealio.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_ebay.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\searchbox.css
    c:\program files\Dealio Toolbar\FF\chrome\skin\separator.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\target.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\walmart.gif
    c:\program files\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css
    c:\program files\Dealio Toolbar\FF\components\config.ini
    c:\program files\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt
    c:\program files\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt
    c:\program files\Dealio Toolbar\FF\install.rdf
    c:\program files\Dealio Toolbar\IE\4.0.2\config.ini
    c:\program files\Dealio Toolbar\Res\amazon.gif
    c:\program files\Dealio Toolbar\Res\apple.gif
    c:\program files\Dealio Toolbar\Res\barnes.gif
    c:\program files\Dealio Toolbar\Res\bestbuy.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
    c:\program files\Dealio Toolbar\Res\ebay.gif
    c:\program files\Dealio Toolbar\Res\icon_settings.gif
    c:\program files\Dealio Toolbar\Res\macys.gif
    c:\program files\Dealio Toolbar\Res\newegg.gif
    c:\program files\Dealio Toolbar\Res\overstock.gif
    c:\program files\Dealio Toolbar\Res\search-button-hover.gif
    c:\program files\Dealio Toolbar\Res\search-button.gif
    c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
    c:\program files\Dealio Toolbar\Res\search-chevron.gif
    c:\program files\Dealio Toolbar\Res\search_amazon.gif
    c:\program files\Dealio Toolbar\Res\search_dealio.gif
    c:\program files\Dealio Toolbar\Res\search_ebay.gif
    c:\program files\Dealio Toolbar\Res\search_yahoo.gif
    c:\program files\Dealio Toolbar\Res\target.gif
    c:\program files\Dealio Toolbar\Res\walmart.gif
    c:\program files\Dealio Toolbar\Res\widgets.xml
    c:\program files\Search Settings
    c:\program files\Search Settings\FF\chrome.manifest
    c:\program files\Search Settings\FF\chrome\content\plugin.js
    c:\program files\Search Settings\FF\chrome\content\plugin.xul
    c:\program files\Search Settings\FF\chrome\content\protection.js
    c:\program files\Search Settings\FF\chrome\content\utils.js
    c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
    c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
    c:\program files\Search Settings\FF\components\IFBHOSearch.xpt
    c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
    c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt
    c:\program files\Search Settings\FF\components\SearchSettingsFF.dll
    c:\program files\Search Settings\FF\install.rdf
    c:\program files\Search Settings\SearchSettings.dll
    c:\program files\Search Settings\SearchSettings.exe
    c:\program files\Search Settings\SearchSettingsRes409.dll
    c:\program files\Search Toolbar
    c:\program files\Search Toolbar\basis.xml
    c:\program files\Search Toolbar\bg.bmp
    c:\program files\Search Toolbar\bing_logo.png
    c:\program files\Search Toolbar\celebrity.png
    c:\program files\Search Toolbar\drop_images.png
    c:\program files\Search Toolbar\drop_maps.png
    c:\program files\Search Toolbar\drop_news.png
    c:\program files\Search Toolbar\drop_videos.png
    c:\program files\Search Toolbar\drop_web.png
    c:\program files\Search Toolbar\facebook.png
    c:\program files\Search Toolbar\favicon.png
    c:\program files\Search Toolbar\games.png
    c:\program files\Search Toolbar\hotmail.png
    c:\program files\Search Toolbar\icon.ico
    c:\program files\Search Toolbar\images.png
    c:\program files\Search Toolbar\include.xml
    c:\program files\Search Toolbar\info.txt
    c:\program files\Search Toolbar\lifestyle.png
    c:\program files\Search Toolbar\maps.png
    c:\program files\Search Toolbar\messenger.png
    c:\program files\Search Toolbar\msn.png
    c:\program files\Search Toolbar\news.png
    c:\program files\Search Toolbar\SearchToolbar.dll
    c:\program files\Search Toolbar\SearchToolbarUninstall.exe
    c:\program files\Search Toolbar\tbcore3.dll
    c:\program files\Search Toolbar\tbhelper.dll
    c:\program files\Search Toolbar\twitter.png
    c:\program files\Search Toolbar\uninstall.exe
    c:\program files\Search Toolbar\update.exe
    c:\program files\Search Toolbar\version.txt
    c:\program files\Search Toolbar\video.png
    c:\program files\Search Toolbar\videos.png
    c:\program files\Search Toolbar\weather.png
    c:\program files\Search Toolbar\web.png
    c:\windows\sv.ini
    c:\windows\system32\drivers\etc\lmhosts
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    c:\windows\system32\winlogon.exe . . . is infected!!

    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-10-27 to 2010-11-27 )))))))))))))))))))))))))))))))
    .

    2010-11-27 05:14 . 2010-11-27 05:15 -------- dc-h--w- c:\windows\ie8
    2010-11-27 02:12 . 2010-11-27 02:12 -------- d-s---w- c:\documents and settings\NetworkService\UserData
    2010-11-27 00:26 . 2010-11-27 00:34 -------- d-----w- C:\Logs
    2010-11-23 23:33 . 2010-11-25 02:51 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 -------- d-----w- c:\program files\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-22 01:28 . 2010-11-22 01:28 -------- d-----w- C:\DCIM
    2010-11-16 23:47 . 2010-11-16 23:47 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-11-16 23:04 . 2010-11-16 23:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-11-15 00:39 . 2010-11-15 00:39 -------- d-----w- c:\documents and settings\Administrator
    2010-11-09 01:33 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-11-09 01:33 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-11-09 01:33 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-11-09 01:33 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-11-09 01:33 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-11-09 01:33 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-11-09 01:33 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-11-09 01:33 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
    2010-11-09 01:33 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\program files\Alwil Software
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\George\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-09 01:15 . 2010-11-09 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
    2010-11-06 16:37 . 2010-11-06 16:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2010-10-30 22:30 . 2010-11-25 02:57 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\Temp

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-15 07:29 . 2008-12-20 00:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-10 02:53 . 2010-09-10 02:53 53248 ----a-r- c:\documents and settings\George\Application Data\Microsoft\Installer\{08DEC21F-F7E5-46F9-81D1-3ED30BD3AEC9}\ARPPRODUCTICON.exe
    .

    ------- Sigcheck -------

    [-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\spoolsv.exe
    [7] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
    [7] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe
    [7] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

    [-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe
    [-] 2004-08-04 . 5188C01343FF942F3982F2C6440F3C17 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

    [-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe
    [-] 2007-06-13 . 82852070785B5BE6E99D414FF4CFE920 . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe
    [7] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
    [7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

    [-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\ip6fw.sys
    [7] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
    [-] 2004-08-04 12:00 . D41D8CD98F00B204E9800998ECF8427E . 0 . . [------] . . c:\windows\system32\drivers\ip6fw.sys

    c:\windows\System32\spoolsv.exe ... is missing !!
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\PageRage\tbPag2.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
    2010-04-20 18:09 194912 ------w- c:\program files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{9565115D-C7D6-46D3-BD63-B67B481A4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
    "Google Update "= "c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-30 136176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
    "DELL Webcam Manager "= "c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
    "OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2007-05-10 36864]
    "Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2007-10-10 2183168]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
    "CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
    "IJNetworkScanUtility "= "c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
    "QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "avast5 "= "c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

    c:\documents and settings\George\Start Menu\Programs\Startup\
    PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-1-4 333088]
    V CAST Media Monitor.lnk - c:\program files\V CAST Media Manager\MEMonitor.exe [2010-9-9 2991464]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    OADP Utility.lnk - c:\sabre\Apps\OADP\OadpUtil.exe [2010-2-8 528452]
    Sabre Printing Start.lnk - c:\sabre\Sabstart.exe [2010-2-8 20992]
    Sabre Server.lnk - c:\windows\sabserv.exe [2010-2-8 135168]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Downloads\\_extracted\\Portable_SopCast.rar.extracted\\Portable SopCast.exe "=
    "c:\\Documents and Settings\\George\\Application Data\\Thinstall\\SopCast 3.0.3\\4000008d00003i\\SopAdver.exe "=
    "c:\\SABRE\\Apps\\OADP\\OadpUtil.exe "=
    "c:\\WINDOWS\\sabserv.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe "=
    "c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaws.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Paltalk Messenger\\paltalk.exe "=
    "c:\\Documents and Settings\\George\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/8/2010 8:33 PM 165584]
    R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [1/8/2010 12:51 AM 380928]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/8/2010 8:33 PM 17744]
    R2 CfgSrvc;Config Service Helper;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 HsspConfig;HSSP Configuration Module;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800]
    R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [9/9/2010 9:08 PM 91456]
    R2 SabrePrint;Sabre Printing Module;c:\sabre\Apps\OADP\Oadp.exe [2/8/2010 8:31 PM 512000]
    R2 SDMan;Sabre Device Manager;c:\windows\sdman.exe [2/8/2010 8:30 PM 106496]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/18/2008 2:27 PM 105984]
    S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [9/9/2010 9:08 PM 6016]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [9/9/2010 9:08 PM 19712]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [9/9/2010 9:08 PM 8320]
    S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [9/9/2010 9:08 PM 23424]
    S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [9/9/2010 9:08 PM 9472]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-09-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2010-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003Core.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003UA.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
    .
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-{36c44342-bcbe-4d64-b946-284d925d1767} - (no file)
    URLSearchHooks-9565115d-c7d6-46d3-bd63-b67b481a4368} - (no file)
    URLSearchHooks-E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
    BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
    BHO-{36c44342-bcbe-4d64-b946-284d925d1767} - (no file)
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
    Toolbar-{0C8413C1-FAD1-446C-8584-BE50576F863E} - c:\program files\Search Toolbar\tbcore3.dll
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{0C8413C1-FAD1-446C-8584-BE50576F863E} - c:\program files\Search Toolbar\tbcore3.dll
    HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
    HKCU-Run-fsm - (no file)
    HKLM-Run-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
    HKLM-Run-iTunesHelper - g:\my music\iTunes\iTunesHelper.exe
    AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-27 00:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker4 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(688)
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(2392)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\WLTRYSVC.EXE
    c:\windows\System32\bcmwltry.exe
    c:\program files\Alwil Software\Avast5\AvastSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\igfxsrvc.exe
    c:\windows\system32\java.exe
    c:\windows\system32\STacSV.exe
    c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    c:\program files\DellTPad\ApMsgFwd.exe
    c:\program files\DellTPad\HidFind.exe
    c:\program files\DellTPad\Apntex.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\documents and settings\George\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    c:\program files\Motorola\MotoConnectService\MotoConnect.exe
    c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-27 00:52:35 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-27 05:52

    Pre-Run: 216,573,546,496 bytes free
    Post-Run: 217,991,204,864 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug= "do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - 8D08516EE3636CB350510F3DC0720927


    Log.txt - Notepad


    ComboFix 10-11-26.06 - George 11/27/2010 1:18.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2530 [GMT -5:00]
    Running from: c:\documents and settings\George\My Documents\Downloads\ComboFix.exe
    Command switches used :: c:\documents and settings\George\Desktop\CFScript.txt
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\winlogon.exe . . . is infected!!

    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

    .
    --------------- FCopy ---------------

    c:\windows\system32\dllcache\spoolsv.exe --> c:\windows\System32\spoolsv.exe
    c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe --> c:\windows\system32\winlogon.exe
    c:\windows\system32\dllcache\ip6fw.sys --> c:\windows\system32\drivers\ip6fw.sys
    .
    ((((((((((((((((((((((((( Files Created from 2010-10-27 to 2010-11-27 )))))))))))))))))))))))))))))))
    .

    2010-11-27 06:18 . 2005-06-10 23:53 57856 -c--a-w- c:\windows\system32\dllcache\spoolsv.exe
    2010-11-27 05:14 . 2010-11-27 05:15 -------- dc-h--w- c:\windows\ie8
    2010-11-27 02:12 . 2010-11-27 02:12 -------- d-s---w- c:\documents and settings\NetworkService\UserData
    2010-11-27 00:26 . 2010-11-27 00:34 -------- d-----w- C:\Logs
    2010-11-23 23:33 . 2010-11-25 02:51 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 -------- d-----w- c:\program files\ConduitEngine
    2010-11-23 23:33 . 2010-11-23 23:33 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2010-11-23 02:16 . 2010-09-15 09:50 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-11-22 01:28 . 2010-11-22 01:28 -------- d-----w- C:\DCIM
    2010-11-16 23:47 . 2010-11-16 23:47 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-11-16 23:04 . 2010-11-16 23:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-11-15 00:39 . 2010-11-15 00:39 -------- d-----w- c:\documents and settings\Administrator
    2010-11-09 01:33 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-11-09 01:33 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-11-09 01:33 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-11-09 01:33 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-11-09 01:33 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-11-09 01:33 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-11-09 01:33 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-11-09 01:33 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
    2010-11-09 01:33 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\program files\Alwil Software
    2010-11-09 01:33 . 2010-11-09 01:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\George\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-09 01:22 . 2010-11-09 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-09 01:22 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-09 01:15 . 2010-11-09 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
    2010-11-06 16:37 . 2010-11-06 16:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2010-10-30 22:30 . 2010-11-25 02:57 -------- d-----w- c:\documents and settings\George\Local Settings\Application Data\Temp

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-15 07:29 . 2008-12-20 00:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-10 02:53 . 2010-09-10 02:53 53248 ----a-r- c:\documents and settings\George\Application Data\Microsoft\Installer\{08DEC21F-F7E5-46F9-81D1-3ED30BD3AEC9}\ARPPRODUCTICON.exe
    .

    ------- Sigcheck -------

    [-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe
    [-] 2008-04-14 . BEE0253B590760906B8CC284D8B39AFA . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

    [-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe
    [-] 2007-06-13 . 82852070785B5BE6E99D414FF4CFE920 . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe
    [7] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
    [7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
    .
    ((((((((((((((((((((((((((((( SnapShot@2010-11-27_05.48.42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-11-27 06:24 . 2010-11-27 06:24 16384 c:\windows\Temp\Perflib_Perfdata_878.dat
    + 2010-11-27 06:23 . 2010-11-27 06:23 16384 c:\windows\Temp\Perflib_Perfdata_75c.dat
    + 2004-08-04 12:00 . 2010-11-27 05:53 68558 c:\windows\system32\perfc009.dat
    - 2004-08-04 12:00 . 2010-11-27 05:22 68558 c:\windows\system32\perfc009.dat
    + 2004-08-04 12:00 . 2010-11-27 05:53 435828 c:\windows\system32\perfh009.dat
    - 2004-08-04 12:00 . 2010-11-27 05:22 435828 c:\windows\system32\perfh009.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9565115d-c7d6-46d3-bd63-b67b481a4368}]
    2010-10-18 10:26 3908192 ----a-w- c:\program files\PageRage\tbPag2.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
    2010-04-20 18:09 194912 ------w- c:\program files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{9565115d-c7d6-46d3-bd63-b67b481a4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{9565115D-C7D6-46D3-BD63-B67B481A4368} "= "c:\program files\PageRage\tbPag2.dll" [2010-10-18 3908192]

    [HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
    "Google Update "= "c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-30 136176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
    "DELL Webcam Manager "= "c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
    "OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2007-05-10 36864]
    "Broadcom Wireless Manager UI "= "c:\windows\system32\WLTRAY.exe" [2007-10-10 2183168]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
    "CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
    "IJNetworkScanUtility "= "c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
    "QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "avast5 "= "c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

    c:\documents and settings\George\Start Menu\Programs\Startup\
    PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-1-4 333088]
    V CAST Media Monitor.lnk - c:\program files\V CAST Media Manager\MEMonitor.exe [2010-9-9 2991464]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    OADP Utility.lnk - c:\sabre\Apps\OADP\OadpUtil.exe [2010-2-8 528452]
    Sabre Printing Start.lnk - c:\sabre\Sabstart.exe [2010-2-8 20992]
    Sabre Server.lnk - c:\windows\sabserv.exe [2010-2-8 135168]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Downloads\\_extracted\\Portable_SopCast.rar.extracted\\Portable SopCast.exe "=
    "c:\\Documents and Settings\\George\\Application Data\\Thinstall\\SopCast 3.0.3\\4000008d00003i\\SopAdver.exe "=
    "c:\\SABRE\\Apps\\OADP\\OadpUtil.exe "=
    "c:\\WINDOWS\\sabserv.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe "=
    "c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\javaws.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Paltalk Messenger\\paltalk.exe "=
    "c:\\Documents and Settings\\George\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/8/2010 8:33 PM 165584]
    R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [1/8/2010 12:51 AM 380928]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/8/2010 8:33 PM 17744]
    R2 CfgSrvc;Config Service Helper;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 HsspConfig;HSSP Configuration Module;c:\windows\system32\CfgSrvc.exe [2/8/2010 8:30 PM 55296]
    R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [1/15/2008 10:28 AM 204800]
    R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [9/9/2010 9:08 PM 91456]
    R2 SabrePrint;Sabre Printing Module;c:\sabre\Apps\OADP\Oadp.exe [2/8/2010 8:31 PM 512000]
    R2 SDMan;Sabre Device Manager;c:\windows\sdman.exe [2/8/2010 8:30 PM 106496]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [12/18/2008 2:27 PM 105984]
    S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [9/9/2010 9:08 PM 6016]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [9/9/2010 9:08 PM 19712]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [9/9/2010 9:08 PM 8320]
    S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [9/9/2010 9:08 PM 23424]
    S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [9/9/2010 9:08 PM 9472]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-09-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2010-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003Core.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1292428093-413027322-839522115-1003UA.job
    - c:\documents and settings\George\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 22:30]

    2010-11-27 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-27 01:24
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker4 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(688)
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(1356)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\WLTRYSVC.EXE
    c:\windows\System32\bcmwltry.exe
    c:\program files\Alwil Software\Avast5\AvastSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\igfxsrvc.exe
    c:\program files\DellTPad\ApMsgFwd.exe
    c:\program files\DellTPad\HidFind.exe
    c:\program files\DellTPad\Apntex.exe
    c:\windows\system32\java.exe
    c:\windows\system32\STacSV.exe
    c:\documents and settings\George\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\program files\Motorola\MotoConnectService\MotoConnect.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-27 01:27:06 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-27 06:27

    Pre-Run: 218,020,978,688 bytes free
    Post-Run: 217,981,042,688 bytes free

    - - End Of File - - 83B54C437592D2E4ACE4A61E4DECF906
     
    Last edited: 2010/11/27
    conde357,
    #15
  17. 2010/11/27
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    I ran a scan using avast and found this threat 'Win32:Bamital-AQ' in three places:

    C:\\WINDOWS\explorer.exe
    C:\\WINDOWS\system32\winlogon.exe and
    C:\\WINDOWS\explorer.exe

    thanks!
     
    conde357,
    #16
  18. 2010/11/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yeah, we'll have to replace those two infected files, explorer.exe and winlogon.exe through recovery console. The infection won't allow us to do it in any conventional way.

    Download both files (zipped) from HERE.
    Unzip them and place both unzipped files in C:\ root directory.

    Now, I'll need to see, they're located in correct place, so...

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :filefind
explorer.exe 
winlogon.exe
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    Do NOT do anything else, like running any scans.
     
    broni,
    #17
  19. 2010/11/27
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    SystemLook 04.09.10 by jpshortstuff
    Log created at 12:04 on 27/11/2010 by George
    Administrator - Elevation successful

    ========== filefind ==========

    Searching for "explorer.exe "
    C:\explorer\explorer.exe --a---- 1033728 bytes [10:42 14/04/2008] [16:59 27/11/2010] 12896823FB95BFB3DC9B46BCAEDC9923
    C:\WINDOWS\explorer.exe --a---- 1033216 bytes [12:00 04/08/2004] [11:26 13/06/2007] (Unable to calculate MD5)
    C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe --a---- 1033216 bytes [11:26 13/06/2007] [11:26 13/06/2007] 7712DF0CDDE3A5AC89843E61CD5B3658
    C:\WINDOWS\$NtUninstallKB938828$\explorer.exe -----c- 1032192 bytes [04:25 25/12/2008] [12:00 04/08/2004] A0732187050030AE399B241436565E64
    C:\WINDOWS\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe --a---- 1033728 bytes [00:12 14/04/2008] [00:12 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923

    Searching for "winlogon.exe "
    C:\WINDOWS\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\winlogon.exe ------- 507904 bytes [00:12 14/04/2008] [00:12 14/04/2008] ED0EF0A136DEC83DF69F04118870003E
    C:\WINDOWS\system32\winlogon.exe --a---- 507904 bytes [12:00 04/08/2004] [00:12 14/04/2008] (Unable to calculate MD5)
    C:\winlogon\winlogon.exe --a---- 507904 bytes [06:36 21/03/2008] [17:02 27/11/2010] B8135E9ED99A0858DF535CE0A0271558

    -= EOF =-
     
    conde357,
    #18
  20. 2010/11/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I didn't want you to create new folders for those files, but we can do it, using your current locations.

    Restart computer
    When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
    You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.

    (If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.)

    You must enter which Windows installation to log onto. Type 1 and press enter.

    It will then prompt you for the Administrator's password. If there is no password, simply press Enter.

    You should get a black screen with a C:\>Windows prompt.

    [​IMG]


    Type the bolded text below, pressing Enter after each line:

    copy C:\winlogon\winlogon.exe C:\WINDOWS\system32\winlogon.exe (<---- watch for "spaces ")

    (If it asks you if you are sure then say "Y ".)

    copy C:\explorer\explorer.exe C:\WINDOWS\explorer.exe

    Disregard any Windows warnings.

    Reboot computer.

    Post new SystemLook log.
     
    broni,
    #19
  21. 2010/11/27
    conde357

    conde357 Inactive Thread Starter

    Joined:
    2010/11/26
    Messages:
    39
    Likes Received:
    0
    I reboot but it asks for a password and I don't know what it is, when I click enter it asks again and after 3 tries it asks to re-start. Now when I try to boot up it just hangs..I using another computer to write this. Thx
     
    conde357,
    #20
Page 1 of 4

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...