Solved malware from oovoo

[Resolved] malware from oovoo

I recently downloaded oovoo video chat software and it seems to have brought a host of other unwanted things with it. I now cannot access IE (I'm on here thru firefox) and things are just not running right at all even when I can get on thru this way. I ran MBAM and removed 8 things, restarted, still no good. Avast found nothing. Will include logs from what I've run. Attempted to do GMER. It was running and I left the room. When I came back I had the blue screen of death with the message that the infected file was pxtdypow.sys. Thanks for any help you can give.


DDS (Ver_10-12-12.02) - NTFSx86
Run by Melanie at 20:55:59.33 on Wed 02/02/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.272 [GMT -6:00]

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FileHippo.com\UpdateChecker.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Melanie\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No File
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn5\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\BackWeb-8876480.exe
uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [FileHippo.com] "c:\program files\filehippo.com\UpdateChecker.exe" /background
mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Corel Photo Downloader] c:\program files\corel\corel snapfire plus\Corel Photo Downloader.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [USB2Check] RUNDLL32.EXE "c:\windows\system32\PCLECoInst.dll ",CheckUSBController
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe "
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
IE: Add to Google Photos Screensa&ver
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {FAB2BB9D-91E9-457E-9D42-75A7FCCBBC00} - hxxp://www.avataritag.com/app/Plugin/DFusionHomeWebPlugIn.Installer.exe
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\melanie\applic~1\mozilla\firefox\profiles\531rj6m2.default\
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\logitech\harmony remote driver\NprtHarmonyPlugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPDFusionWebFirefox.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\total immersion\dfusionhomewebplugin\NPDFusionWebFirefox.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-27 294608]
R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [2009-11-14 15784]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-27 17744]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-7-29 40384]
R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [2009-11-14 162344]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-10-4 17408]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]

=============== Created Last 30 ================

2011-02-03 02:45:27 -------- d-----w- c:\docume~1\melanie\applic~1\WinPatrol
2011-02-03 02:45:06 -------- d-----w- c:\program files\BillP Studios
2011-02-03 02:45:05 -------- d-----w- c:\docume~1\alluse~1\applic~1\InstallMate
2011-02-02 23:43:28 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe
2011-02-02 23:43:26 719832 ----a-w- c:\program files\mozilla firefox\mozcpp19.dll
2011-02-02 20:56:28 -------- d-----w- c:\docume~1\alluse~1\applic~1\NVIDIA Corporation
2011-02-02 20:55:11 252080 ----a-w- c:\windows\system32\nvdrsdb0.bin
2011-02-02 20:55:02 252080 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-02-02 20:55:02 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-02-02 20:54:32 941160 ----a-w- c:\windows\system32\nvdispco322090.dll
2011-02-02 20:54:32 837736 ----a-w- c:\windows\system32\nvgenco322040.dll
2011-02-02 20:54:32 61440 ----a-w- c:\windows\system32\OpenCL.dll
2011-02-02 20:54:32 4980736 ----a-w- c:\windows\system32\nvcuda.dll
2011-02-02 20:54:32 2916968 ----a-w- c:\windows\system32\nvcuvid.dll
2011-02-02 20:54:32 2292678 ----a-w- c:\windows\system32\nvdata.bin
2011-02-02 20:54:32 2251368 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-02-02 20:54:30 13004800 ----a-w- c:\windows\system32\nvcompiler.dll
2011-02-02 20:53:26 -------- d-----w- c:\program files\NVIDIA Corporation
2011-02-02 20:53:09 -------- d-----w- C:\NVIDIA
2011-02-01 08:19:49 5890896 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{af051f44-6678-47c8-89db-4cdc9299615f}\mpengine.dll
2011-01-30 21:53:27 -------- d-----w- c:\docume~1\melanie\applic~1\ooVoo Details
2011-01-08 01:56:54 81920 ----a-w- c:\windows\system32\nvwddi.dll
2011-01-08 01:56:50 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-01-08 01:56:48 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-01-08 01:56:48 156776 ----a-w- c:\windows\system32\nvsvc32.exe
2011-01-08 01:56:48 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-01-08 01:56:48 13880424 ----a-w- c:\windows\system32\nvcpl.dll
2011-01-08 01:56:48 111208 ----a-w- c:\windows\system32\nvmctray.dll

==================== Find3M ====================

2011-01-13 08:47:35 38848 ----a-w- c:\windows\avastSS.scr
2011-01-08 03:27:00 6397824 ----a-w- c:\windows\system32\nv4_disp.dll
2011-01-08 03:27:00 1958400 ----a-w- c:\windows\system32\nvapi.dll
2011-01-08 03:27:00 14671872 ----a-w- c:\windows\system32\nvoglnt.dll
2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52:35 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3160812AS rev.3.ADH -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x861AA7AF]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x861b09b0]; MOV EAX, [0x861b0a2c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x86177AB8]
3 CLASSPNP[0xF74A7FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000060[0x86143578]
5 ACPI[0xF735E620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8618AD98]
\Driver\atapi[0x861EBA80] -> IRP_MJ_CREATE -> 0x861AA7AF
kernel: MBR read successfully
_asm { MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62d; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3160812AS_____________________________3.ADH___#5&71de149&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x861AA5F5
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !

============= FINISH: 20:58:00.06 ===============

 

attach

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/17/2006 6:59:02 PM
System Uptime: 2/2/2011 8:33:08 PM (0 hours ago)

Motherboard: Dell Inc | | 0CT103
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ | Socket M2 | 2204/1000mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 146 GiB total, 95.352 GiB free.
D: is CDROM ()
E: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 9.20
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Apple Application Support
avast! Free Antivirus
Coupon Printer for Windows
CyberLink BD Advisor 2.0
CyberLink DVD Suite
CyberLink InstantBurn
CyberLink LabelPrint
CyberLink MediaShow
CyberLink PhotoNow
CyberLink PowerBackup
CyberLink PowerDirector
CyberLink PowerDVD Copy
CyberLink PowerProducer
DiscAPI (Studio 10)
ESET Online Scanner v3
FileHippo.com Update Checker
FinePix Studio
FinePixViewer Resource
FinePixViewer Ver.5.5
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Product Assistant
HP Update
iTunes
Java Auto Updater
Logitech Harmony Remote Software
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.13)
MSXML 4.0 SP2 (KB973688)
NVIDIA Control Panel 266.58
NVIDIA Graphics Driver 266.58
NVIDIA Install Application
NVIDIA nView 135.50
NVIDIA nView Desktop Manager
Pinnacle Instant DVD Recorder
Pinnacle MediaServer
QuickTime
RAPID (Studio 10)
Secunia PSI
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SmartDraw 2007
Studio 10
Total Immersion D'Fusion @Home Web Plug-In
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB955759)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
WinPatrol
Yahoo! Messenger
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

2/2/2011 7:54:03 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
2/2/2011 7:32:33 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: nvatabus nvraid
2/2/2011 12:56:29 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
2/2/2011 12:53:29 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
2/2/2011 12:13:22 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/2/2011 1:01:00 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
2/1/2011 10:12:32 PM, error: Service Control Manager [7022] - The WebClient service hung on starting.

==== End Of File ===========================

 

mbr check

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 140):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E4000 \WINDOWS\system32\hal.dll
0x8617C000 \WINDOWS\system32\KDCOM.DLL
0xF789B000 \WINDOWS\system32\BOOTVID.dll
0xF7358000 ACPI.sys
0xF7987000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7347000 pci.sys
0xF7487000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7497000 MountMgr.sys
0xF7328000 ftdisk.sys
0xF74A7000 \WINDOWS\system32\drivers\CLASSPNP.SYS
0xF770F000 PartMgr.sys
0xF74B7000 VolSnap.sys
0xF72FA000 atapi.sys
0xF74C7000 disk.sys
0xF72C0000 fltmgr.sys
0xF72AE000 sr.sys
0xF7298000 DRVMCDB.SYS
0xF74D7000 PxHelp20.sys
0xF7281000 KSecDD.sys
0xF726E000 WudfPf.sys
0xF71E1000 Ntfs.sys
0xF71B4000 NDIS.sys
0xF719A000 Mup.sys
0xF7677000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xEB679000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xEB665000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xEC020000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xEB641000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xEC018000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6A3D000 \SystemRoot\system32\DRIVERS\imapi.sys
0xECEC3000 \SystemRoot\System32\Drivers\CLBStor.SYS
0xEC010000 \SystemRoot\System32\Drivers\ASAPIW2K.sys
0xF7A43000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
0xF6A1D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7667000 \SystemRoot\system32\DRIVERS\redbook.sys
0xEB61E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7837000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7657000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0xEB5F6000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7B98000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF06F1000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xECEBB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xEB5DF000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF06E1000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF06D1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77FF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xEB5CE000 \SystemRoot\system32\DRIVERS\psched.sys
0xF06C1000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7807000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7817000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF06B1000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF781F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xEFABF000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF79F3000 \SystemRoot\system32\DRIVERS\swenum.sys
0xEB570000 \SystemRoot\system32\DRIVERS\update.sys
0xECEAF000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xEB542000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xEB42F000 \SystemRoot\system32\drivers\sthda.sys
0xEB40B000 \SystemRoot\system32\drivers\portcls.sys
0xF0691000 \SystemRoot\system32\drivers\drmk.sys
0xEFBD7000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xEC1A1000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79FF000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xEC82B000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7A07000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A6B000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A09000 \SystemRoot\System32\Drivers\Beep.SYS
0xEFAA7000 \SystemRoot\System32\Drivers\DLARTL_N.SYS
0xEFA87000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xEE6F7000 \SystemRoot\System32\drivers\vga.sys
0xF7A0B000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A0D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xEE6EF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xEE6E7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xEC823000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEB213000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEB1BA000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEC181000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xEB194000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xEB16C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEE6DF000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xEC008000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xEB14A000 \SystemRoot\System32\drivers\afd.sys
0xEC171000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEB11F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEBFF4000 \??\C:\WINDOWS\system32\drivers\pclepci.sys
0xEB0AF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xEC141000 \SystemRoot\System32\Drivers\Fips.SYS
0xEB068000 \SystemRoot\System32\Drivers\aswSP.SYS
0xEE6CF000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF7587000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF77E7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF5BCC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7517000 \SystemRoot\system32\drivers\lvusbsta.sys
0xEE7FC000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF780F000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xF7847000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF75D7000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xEE7F8000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xEE7F0000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF7617000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xEE7EC000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xEE7E4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xEC33C000 \SystemRoot\system32\DRIVERS\LV302AV.SYS
0xF7607000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xEC899000 \SystemRoot\system32\DRIVERS\lvsvf2.sys
0xF79B1000 \SystemRoot\system32\DRIVERS\lv302af.sys
0xF7627000 \SystemRoot\system32\drivers\usbaudio.sys
0xEB050000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79B3000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEE7E0000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7867000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A7C000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF794F000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF6A2D000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
0xEC235000 \SystemRoot\System32\DLA\DLADResN.SYS
0xB7F58000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
0xF7973000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
0xF7A0F000 \SystemRoot\System32\DLA\DLAPoolM.SYS
0xB7F31000 \SystemRoot\System32\Drivers\CLBUDF.SYS
0xB7F20000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF7757000 \SystemRoot\System32\DLA\DLABOIOM.SYS
0xB7F08000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
0xB7EF2000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
0xB7E66000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB7DC3000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xB7B8E000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB7B0E000 \SystemRoot\system32\DRIVERS\srv.sys
0xB7581000 \SystemRoot\system32\drivers\wdmaud.sys
0xB7956000 \SystemRoot\system32\drivers\sysaudio.sys
0xB71DA000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 59):
0 System Idle Process
4 System
416 C:\WINDOWS\system32\smss.exe
624 csrss.exe
648 C:\WINDOWS\system32\winlogon.exe
696 C:\WINDOWS\system32\services.exe
708 C:\WINDOWS\system32\lsass.exe
904 C:\WINDOWS\system32\nvsvc32.exe
980 C:\WINDOWS\system32\svchost.exe
1060 svchost.exe
1160 C:\Program Files\Windows Defender\MsMpEng.exe
1200 C:\WINDOWS\system32\svchost.exe
1264 C:\WINDOWS\system32\svchost.exe
1444 svchost.exe
1488 svchost.exe
1584 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1956 C:\WINDOWS\system32\spoolsv.exe
164 svchost.exe
212 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
232 C:\Program Files\Bonjour\mDNSResponder.exe
464 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
780 C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
1008 C:\WINDOWS\system32\HPZipm12.exe
1072 C:\Program Files\CyberLink\Shared files\RichVideo.exe
1304 C:\WINDOWS\system32\svchost.exe
1548 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
2156 C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
2868 alg.exe
3928 C:\WINDOWS\explorer.exe
4072 wmiprvse.exe
564 C:\Program Files\Dell\Media Experience\DMXLauncher.exe
604 C:\WINDOWS\stsystra.exe
768 C:\WINDOWS\system32\DLA\DLACTRLW.EXE
1112 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
1120 C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
1128 C:\WINDOWS\system32\LVCOMSX.EXE
1296 C:\Program Files\Logitech\Video\LogiTray.exe
2284 C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
2300 C:\Program Files\HP\HP Software Update\hpwuschd2.exe
2320 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
2420 C:\Program Files\iTunes\iTunesHelper.exe
2472 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
2428 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2416 C:\WINDOWS\system32\rundll32.exe
2628 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
2660 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2772 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
2760 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
2768 C:\WINDOWS\system32\ctfmon.exe
2752 C:\Program Files\FileHippo.com\UpdateChecker.exe
2816 C:\Program Files\FinePixViewer\QuickDCF2.exe
2828 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
2512 C:\Program Files\Logitech\Video\FxSvr2.exe
1096 C:\Program Files\iPod\bin\iPodService.exe
956 C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
3952 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
2776 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
1852 C:\Program Files\Mozilla Firefox\firefox.exe
3480 C:\Documents and Settings\Melanie\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 3.ADH

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 57BDF501CE769EF2720C705B6C71C893DA31574E


Done!

 

mbam

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5662

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/2/2011 2:40:16 PM
mbam-log-2011-02-02 (14-40-16).txt

Scan type: Quick scan
Objects scanned: 152190
Time elapsed: 7 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{52794457-af6c-4c50-9def-f2e24f4c8889} (PUP.WhiteSmoke) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{52794457-AF6C-4C50-9DEF-F2E24F4C8889} (PUP.WhiteSmoke) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{52794457-AF6C-4C50-9DEF-F2E24F4C8889} (PUP.WhiteSmoke) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\documents and settings\localservice\application data\whitesmoketoolbar (PUP.WhiteSmoke) -> Quarantined and deleted successfully.

Files Infected:
c:\WINDOWS\Temp\1C7.tmp (PUP.BHO) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\whitesmoketoolbar\dtx.ini (PUP.WhiteSmoke) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\whitesmoketoolbar\exeArgs.xml (PUP.WhiteSmoke) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\whitesmoketoolbar\guid.dat (PUP.WhiteSmoke) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\whitesmoketoolbar\setupCfg.xml (PUP.WhiteSmoke) -> Quarantined and deleted successfully.

 

Tdss

First off, thank you for your help. Secondly, which computing practices do you suggest I change? I used to go to some sexually related sites and stopped doing that after the last two times I had to come here asking for help. All I do now is work on documents, do email, and go on facebook............until I downloaded this oovoo video chat thing and that's what got me in trouble. If you can see something else I did wrong, I would love to know so that I can stop doing it.





2011/02/03 07:10:59.0332 2756 TDSS rootkit removing tool 2.4.16.0 Feb 1 2011 10:34:03
2011/02/03 07:10:59.0566 2756 ================================================================================
2011/02/03 07:10:59.0566 2756 SystemInfo:
2011/02/03 07:10:59.0566 2756
2011/02/03 07:10:59.0566 2756 OS Version: 5.1.2600 ServicePack: 3.0
2011/02/03 07:10:59.0566 2756 Product type: Workstation
2011/02/03 07:10:59.0566 2756 ComputerName: M
2011/02/03 07:10:59.0566 2756 UserName: Melanie
2011/02/03 07:10:59.0566 2756 Windows directory: C:\WINDOWS
2011/02/03 07:10:59.0566 2756 System windows directory: C:\WINDOWS
2011/02/03 07:10:59.0566 2756 Processor architecture: Intel x86
2011/02/03 07:10:59.0566 2756 Number of processors: 2
2011/02/03 07:10:59.0566 2756 Page size: 0x1000
2011/02/03 07:10:59.0582 2756 Boot type: Normal boot
2011/02/03 07:10:59.0582 2756 ================================================================================
2011/02/03 07:11:00.0301 2756 Initialize success
2011/02/03 07:11:03.0207 2196 ================================================================================
2011/02/03 07:11:03.0207 2196 Scan started
2011/02/03 07:11:03.0207 2196 Mode: Manual;
2011/02/03 07:11:03.0207 2196 ================================================================================
2011/02/03 07:11:05.0222 2196 Aavmker4 (479c9835b91147be1a92cb76fad9c6de) C:\WINDOWS\system32\drivers\Aavmker4.sys
2011/02/03 07:11:05.0503 2196 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/02/03 07:11:05.0628 2196 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/02/03 07:11:06.0019 2196 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/02/03 07:11:06.0082 2196 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/02/03 07:11:06.0097 2196 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/02/03 07:11:06.0144 2196 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/02/03 07:11:06.0175 2196 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/02/03 07:11:06.0207 2196 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/02/03 07:11:06.0269 2196 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/02/03 07:11:06.0300 2196 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/02/03 07:11:06.0347 2196 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/02/03 07:11:06.0410 2196 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/02/03 07:11:06.0457 2196 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/02/03 07:11:06.0519 2196 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/02/03 07:11:06.0582 2196 AmdK8 (0a4d13b388c814560bd69c3a496ecfa8) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
2011/02/03 07:11:06.0628 2196 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/02/03 07:11:06.0675 2196 ASAPIW2K (875f9079cabee679d34b49e466b61701) C:\WINDOWS\system32\Drivers\ASAPIW2K.sys
2011/02/03 07:11:06.0707 2196 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/02/03 07:11:06.0738 2196 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/02/03 07:11:06.0769 2196 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/02/03 07:11:06.0863 2196 aswFsBlk (cba53c5e29ae0a0ce76f9a2be3a40d9e) C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/02/03 07:11:06.0878 2196 aswMon2 (a1c52b822b7b8a5c2162d38f579f97b7) C:\WINDOWS\system32\drivers\aswMon2.sys
2011/02/03 07:11:06.0910 2196 aswRdr (b6e8c5874377a42756c282fac2e20836) C:\WINDOWS\system32\drivers\aswRdr.sys
2011/02/03 07:11:06.0972 2196 aswSP (b93a553c9b0f14263c8f016a44c3258c) C:\WINDOWS\system32\drivers\aswSP.sys
2011/02/03 07:11:07.0035 2196 aswTdi (1408421505257846eb336feeef33352d) C:\WINDOWS\system32\drivers\aswTdi.sys
2011/02/03 07:11:07.0097 2196 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/02/03 07:11:07.0144 2196 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/02/03 07:11:07.0222 2196 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/02/03 07:11:07.0300 2196 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/02/03 07:11:07.0363 2196 bcm4sbxp (78e7b52da292fa90bad2f887bbf22159) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
2011/02/03 07:11:07.0441 2196 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/02/03 07:11:07.0503 2196 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/02/03 07:11:07.0535 2196 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/02/03 07:11:07.0581 2196 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/02/03 07:11:07.0613 2196 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/02/03 07:11:07.0706 2196 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/02/03 07:11:07.0738 2196 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/02/03 07:11:07.0800 2196 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/02/03 07:11:07.0863 2196 CLBStor (eae645ef188964355fc03167a05177f3) C:\WINDOWS\system32\drivers\CLBStor.sys
2011/02/03 07:11:07.0878 2196 CLBUDF (ff88c416df8457174f3a04b07457ea0d) C:\WINDOWS\system32\drivers\CLBUDF.sys
2011/02/03 07:11:07.0941 2196 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/02/03 07:11:07.0988 2196 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/02/03 07:11:08.0050 2196 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/02/03 07:11:08.0097 2196 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/02/03 07:11:08.0160 2196 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/02/03 07:11:08.0269 2196 DLABOIOM (e2d0de31442390c35e3163c87cb6a9eb) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
2011/02/03 07:11:08.0300 2196 DLACDBHM (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
2011/02/03 07:11:08.0331 2196 DLADResN (83545593e297f50a8e2524b4c071a153) C:\WINDOWS\system32\DLA\DLADResN.SYS
2011/02/03 07:11:08.0363 2196 DLAIFS_M (96e01d901cdc98c7817155cc057001bf) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
2011/02/03 07:11:08.0394 2196 DLAOPIOM (0a60a39cc5e767980a31ca5d7238dfa9) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
2011/02/03 07:11:08.0425 2196 DLAPoolM (9fe2b72558fc808357f427fd83314375) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
2011/02/03 07:11:08.0441 2196 DLARTL_N (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
2011/02/03 07:11:08.0488 2196 DLAUDFAM (f08e1dafac457893399e03430a6a1397) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
2011/02/03 07:11:08.0550 2196 DLAUDF_M (e7d105ed1e694449d444a9933df8e060) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
2011/02/03 07:11:08.0613 2196 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/02/03 07:11:08.0722 2196 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/02/03 07:11:08.0738 2196 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/02/03 07:11:08.0785 2196 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/02/03 07:11:08.0800 2196 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/02/03 07:11:08.0831 2196 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/02/03 07:11:08.0878 2196 DRVMCDB (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
2011/02/03 07:11:08.0894 2196 DRVNDDM (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
2011/02/03 07:11:08.0972 2196 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2011/02/03 07:11:09.0050 2196 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/02/03 07:11:09.0097 2196 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/02/03 07:11:09.0128 2196 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/02/03 07:11:09.0144 2196 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/02/03 07:11:09.0206 2196 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/02/03 07:11:09.0285 2196 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/02/03 07:11:09.0331 2196 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/02/03 07:11:09.0378 2196 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2011/02/03 07:11:09.0425 2196 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/02/03 07:11:09.0503 2196 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/02/03 07:11:09.0581 2196 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/02/03 07:11:09.0613 2196 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/02/03 07:11:09.0660 2196 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/02/03 07:11:09.0706 2196 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/02/03 07:11:09.0769 2196 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/02/03 07:11:09.0800 2196 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/02/03 07:11:09.0863 2196 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/02/03 07:11:09.0894 2196 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/02/03 07:11:09.0925 2196 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/02/03 07:11:09.0988 2196 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/02/03 07:11:10.0050 2196 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/02/03 07:11:10.0066 2196 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/02/03 07:11:10.0097 2196 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/02/03 07:11:10.0128 2196 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/02/03 07:11:10.0144 2196 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/02/03 07:11:10.0206 2196 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/02/03 07:11:10.0269 2196 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/02/03 07:11:10.0331 2196 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/02/03 07:11:10.0378 2196 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/02/03 07:11:10.0425 2196 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/02/03 07:11:10.0488 2196 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/02/03 07:11:10.0534 2196 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/02/03 07:11:10.0628 2196 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/02/03 07:11:10.0691 2196 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/02/03 07:11:10.0800 2196 LVUSBSta (c5efbd05a5195402121711a6ebbb271f) C:\WINDOWS\system32\drivers\lvusbsta.sys
2011/02/03 07:11:10.0847 2196 MarvinBus (269c14d512b74cc28d2812ff7d1eb066) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
2011/02/03 07:11:10.0894 2196 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/02/03 07:11:10.0972 2196 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/02/03 07:11:11.0019 2196 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/02/03 07:11:11.0097 2196 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/02/03 07:11:11.0144 2196 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/02/03 07:11:11.0175 2196 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/02/03 07:11:11.0206 2196 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/02/03 07:11:11.0253 2196 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/02/03 07:11:11.0284 2196 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/02/03 07:11:11.0331 2196 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/02/03 07:11:11.0378 2196 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/02/03 07:11:11.0409 2196 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/02/03 07:11:11.0472 2196 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/02/03 07:11:11.0550 2196 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/02/03 07:11:11.0628 2196 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/02/03 07:11:11.0691 2196 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/02/03 07:11:11.0753 2196 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/02/03 07:11:11.0800 2196 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/02/03 07:11:11.0863 2196 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/02/03 07:11:11.0925 2196 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/02/03 07:11:11.0972 2196 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/02/03 07:11:12.0034 2196 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/02/03 07:11:12.0097 2196 Netaapl (29c45722e20572b6440b57e3359e73ee) C:\WINDOWS\system32\DRIVERS\netaapl.sys
2011/02/03 07:11:12.0128 2196 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/02/03 07:11:12.0191 2196 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/02/03 07:11:12.0238 2196 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/02/03 07:11:12.0253 2196 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/02/03 07:11:12.0300 2196 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/02/03 07:11:12.0784 2196 nv (18c9b152da7bea76b2f9e4b6412e0aaf) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/02/03 07:11:13.0269 2196 nvatabus (75562456aa672bb5fe56d3c64c6d1c7d) C:\WINDOWS\system32\drivers\nvatabus.sys
2011/02/03 07:11:13.0316 2196 nvraid (1d4781a5957300dc81b91161b45704bb) C:\WINDOWS\system32\drivers\nvraid.sys
2011/02/03 07:11:13.0378 2196 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/02/03 07:11:13.0394 2196 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/02/03 07:11:13.0456 2196 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/02/03 07:11:13.0503 2196 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/02/03 07:11:13.0550 2196 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/02/03 07:11:13.0566 2196 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/02/03 07:11:13.0644 2196 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/02/03 07:11:13.0691 2196 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys
2011/02/03 07:11:13.0737 2196 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/02/03 07:11:13.0987 2196 pepifilter (2a3efd6c3f116675d149da5e36a010a4) C:\WINDOWS\system32\DRIVERS\lv302af.sys
2011/02/03 07:11:14.0050 2196 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/02/03 07:11:14.0112 2196 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/02/03 07:11:14.0237 2196 PID_08A0 (cebefeae6156f4fee41f56be89ea9c96) C:\WINDOWS\system32\DRIVERS\LV302AV.SYS
2011/02/03 07:11:14.0347 2196 PinnacleMarvinUsb (e70022ca483b9d2e2062fea2d7b88440) C:\WINDOWS\system32\DRIVERS\MarvinUsb.sys
2011/02/03 07:11:14.0409 2196 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/02/03 07:11:14.0456 2196 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/02/03 07:11:14.0503 2196 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/02/03 07:11:14.0566 2196 PSI (1df21f001f3a94eba4a2950c70cc358f) C:\WINDOWS\system32\DRIVERS\psi_mf.sys
2011/02/03 07:11:14.0644 2196 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/02/03 07:11:14.0800 2196 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/02/03 07:11:14.0862 2196 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/02/03 07:11:14.0878 2196 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/02/03 07:11:14.0909 2196 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/02/03 07:11:14.0956 2196 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/02/03 07:11:15.0019 2196 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/02/03 07:11:15.0050 2196 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/02/03 07:11:15.0112 2196 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/02/03 07:11:15.0159 2196 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/02/03 07:11:15.0206 2196 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/02/03 07:11:15.0253 2196 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/02/03 07:11:15.0284 2196 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/02/03 07:11:15.0331 2196 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/02/03 07:11:15.0362 2196 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/02/03 07:11:15.0425 2196 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/02/03 07:11:15.0534 2196 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/02/03 07:11:15.0550 2196 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/02/03 07:11:15.0581 2196 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/02/03 07:11:15.0628 2196 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/02/03 07:11:15.0800 2196 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/02/03 07:11:15.0878 2196 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/02/03 07:11:15.0956 2196 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/02/03 07:11:16.0003 2196 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/02/03 07:11:16.0050 2196 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/02/03 07:11:16.0112 2196 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/02/03 07:11:16.0222 2196 STHDA (8990440e4b2a7ca5a56a1833b03741fd) C:\WINDOWS\system32\drivers\sthda.sys
2011/02/03 07:11:16.0300 2196 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/02/03 07:11:16.0362 2196 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/02/03 07:11:16.0409 2196 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/02/03 07:11:16.0472 2196 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/02/03 07:11:16.0519 2196 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/02/03 07:11:16.0565 2196 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/02/03 07:11:16.0612 2196 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/02/03 07:11:16.0675 2196 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/02/03 07:11:16.0769 2196 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/02/03 07:11:16.0831 2196 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/02/03 07:11:16.0894 2196 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/02/03 07:11:16.0940 2196 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/02/03 07:11:17.0019 2196 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/02/03 07:11:17.0065 2196 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/02/03 07:11:17.0081 2196 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/02/03 07:11:17.0144 2196 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/02/03 07:11:17.0222 2196 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/02/03 07:11:17.0284 2196 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/02/03 07:11:17.0331 2196 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/02/03 07:11:17.0378 2196 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/02/03 07:11:17.0425 2196 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/02/03 07:11:17.0456 2196 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/02/03 07:11:17.0487 2196 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/02/03 07:11:17.0550 2196 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/02/03 07:11:17.0565 2196 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/02/03 07:11:17.0597 2196 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/02/03 07:11:17.0659 2196 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/02/03 07:11:17.0706 2196 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/02/03 07:11:17.0753 2196 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/02/03 07:11:17.0800 2196 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/02/03 07:11:17.0862 2196 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/02/03 07:11:17.0987 2196 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2011/02/03 07:11:18.0097 2196 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/02/03 07:11:18.0206 2196 WpdUsb (c60dc16d4e406810fad54b98dc92d5ec) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/02/03 07:11:18.0253 2196 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/02/03 07:11:18.0315 2196 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/02/03 07:11:18.0362 2196 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/02/03 07:11:18.0425 2196 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/03 07:11:18.0440 2196 ================================================================================
2011/02/03 07:11:18.0440 2196 Scan finished
2011/02/03 07:11:18.0440 2196 ================================================================================
2011/02/03 07:11:18.0440 2872 Detected object count: 1
2011/02/03 07:11:28.0940 2872 \HardDisk0 - will be cured after reboot
2011/02/03 07:11:28.0940 2872 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/03 07:11:59.0266 0244 Deinitialize success

 

I ran combofix but it won't let me post the log because it says I have 10 images and the administrator says I can only have 8. I tried posting only half and it still wouldn't take that much.

?

 

download link, i hope

http://www.filedropper.com/log_1

 

combofix

ComboFix 11-01-31.02 - Melanie 02/05/2011 12:41:57.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.958.627 [GMT -6:00]
Running from: c:\documents and settings\Melanie\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Melanie\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Melanie\LOCALS~1\Temp\IadHide4.dll
c:\documents and settings\Melanie\Application Data\ooVoo Details
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110130_1553_00.ovolog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110130_1553_00.qoslog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_0729_00.ovolog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_0729_00.qoslog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_0756_00.ovolog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_0756_00.qoslog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_2210_00.ovolog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110201_2210_00.qoslog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110202_0730_00.ovolog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Logs\20110202_0730_00.qoslog
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\{0002C346-61D8-0000-8538-87B546F1A870}.bin
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\ChatHistory.db
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\ExtendedRoster.db
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\MFC.Hist
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\Roster.db
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\UD.Hist
c:\documents and settings\Melanie\Application Data\ooVoo Details\Users\melanie138\VCall.Hist
c:\documents and settings\Melanie\Local Settings\Temp\IadHide4.dll

.
((((((((((((((((((((((((( Files Created from 2011-01-05 to 2011-02-05 )))))))))))))))))))))))))))))))
.

2011-02-04 08:05 . 2011-01-13 09:41 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{1C07F55D-AC7B-4A00-A46C-75E665B855F0}\mpengine.dll
2011-02-03 02:45 . 2011-02-03 02:45 -------- d-----w- c:\documents and settings\Melanie\Application Data\WinPatrol
2011-02-03 02:45 . 2011-02-03 02:45 -------- d-----w- c:\program files\BillP Studios
2011-02-03 02:45 . 2011-02-03 02:45 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2011-02-02 23:43 . 2011-02-02 23:43 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-02-02 23:43 . 2011-02-02 23:43 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-02-02 20:53 . 2011-02-02 20:53 -------- d-----w- C:\NVIDIA
2011-02-01 20:55 . 2011-02-01 20:55 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2011-02-01 20:55 . 2011-02-01 20:55 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Yahoo
2011-02-01 20:54 . 2011-02-01 20:54 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2011-02-01 16:25 . 2011-02-01 16:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-02-01 16:12 . 2011-02-01 16:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-02-01 16:12 . 2011-02-01 16:12 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer
2011-01-16 21:22 . 2011-01-16 21:22 -------- d-----w- c:\documents and settings\Melanie\Application Data\Logitech
2011-01-16 21:22 . 2011-01-16 21:22 -------- d-----w- c:\program files\Microsoft Silverlight
2011-01-08 01:56 . 2011-01-08 01:56 81920 ----a-w- c:\windows\system32\nvwddi.dll
2011-01-08 01:56 . 2011-01-08 01:56 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-01-08 01:56 . 2011-01-08 01:56 277608 ----a-w- c:\windows\system32\nvmccs.dll
2011-01-08 01:56 . 2011-01-08 01:56 156776 ----a-w- c:\windows\system32\nvsvc32.exe
2011-01-08 01:56 . 2011-01-08 01:56 145000 ----a-w- c:\windows\system32\nvcolor.exe
2011-01-08 01:56 . 2011-01-08 01:56 13880424 ----a-w- c:\windows\system32\nvcpl.dll
2011-01-08 01:56 . 2011-01-08 01:56 111208 ----a-w- c:\windows\system32\nvmctray.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 09:41 . 2006-12-18 01:17 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-01-13 08:47 . 2010-07-29 15:55 38848 ----a-w- c:\windows\avastSS.scr
2011-01-13 08:47 . 2009-08-27 23:49 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2009-08-27 23:49 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2009-08-27 23:50 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:40 . 2009-08-27 23:49 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-01-13 08:39 . 2009-08-27 23:49 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-01-13 08:37 . 2009-08-27 23:50 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2009-08-27 23:50 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-01-13 08:37 . 2009-08-27 23:50 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-01-08 03:27 . 2006-11-29 03:07 14671872 ----a-w- c:\windows\system32\nvoglnt.dll
2011-01-08 03:27 . 2006-11-29 03:07 1958400 ----a-w- c:\windows\system32\nvapi.dll
2011-01-08 03:27 . 2004-08-10 18:59 9888672 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-01-08 03:27 . 2004-08-10 18:59 6397824 ----a-w- c:\windows\system32\nv4_disp.dll
2010-12-21 00:09 . 2009-08-29 15:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2009-08-29 15:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-18 18:12 . 2004-08-10 19:02 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-10 18:51 249856 ----a-w- c:\windows\system32\odbc32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM "= "c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2006-12-24 20480]
"LogitechSoftwareUpdate "= "c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 68856]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"FileHippo.com "= "c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DMXLauncher "= "c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"SigmatelSysTrayApp "= "stsystra.exe" [2006-08-15 282624]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Corel Photo Downloader "= "c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"LVCOMSX "= "c:\windows\system32\LVCOMSX.EXE" [2005-05-27 221184]
"LogitechVideoRepair "= "c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray "= "c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"USB2Check "= "c:\windows\system32\PCLECoInst.dll" [2004-09-21 73728]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-21 83240]
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"PinnacleDriverCheck "= "c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]
"avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2011-01-08 111208]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2011-01-08 13880424]
"nwiz "= "c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
"WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-11-17 329096]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-1-27 303104]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-12-23 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe "=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe "=
"c:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8/27/2009 5:49 PM 294608]
R1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\drivers\CLBStor.sys [11/14/2009 8:52 PM 15784]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/27/2009 5:50 PM 17744]
R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;c:\windows\system32\drivers\CLBUDF.sys [11/14/2009 8:52 PM 162344]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [10/4/2009 8:51 AM 17408]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [7/7/2010 8:05 AM 14904]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2011-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2011-02-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2011-02-05 c:\windows\Tasks\User_Feed_Synchronization-{D849E1C1-B3CC-4887-B7C7-344812599166}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Add to Google Photos Screensa&ver
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {FAB2BB9D-91E9-457E-9D42-75A7FCCBBC00} - hxxp://www.avataritag.com/app/Plugin/DFusionHomeWebPlugIn.Installer.exe
FF - ProfilePath - c:\documents and settings\Melanie\Application Data\Mozilla\Firefox\Profiles\531rj6m2.default\
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-05 12:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2992)
c:\windows\system32\WININET.dll
c:\docume~1\Melanie\LOCALS~1\Temp\IadHide4.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\windows\system32\HPZipm12.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
c:\windows\stsystra.exe
c:\windows\system32\RUNDLL32.EXE
c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2011-02-05 12:57:49 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-05 18:57
ComboFix2.txt 2011-02-04 01:26

Pre-Run: 102,781,718,528 bytes free
Post-Run: 102,774,923,264 bytes free

- - End Of File - - 2A1B03660E9C9E2621139641765EBB69

 

I thought I did this and was waiting for you reply. Sorry. I'll do it now.

 

I've done the scan and have been trying to post it for 10 min. Keeps sayiing the server connection goes down or IE suddenly lost connection, etc.

 

Well it's letting these little messages post with no problem, but will not post the logs for me. And now I can't go on thru Mozilla at all, as I was trying that instead of IE.

 

log

<a href=http://www.filedropper.com/log><img src=http://www.filedropper.com/download_button.png width=127 height=145 border=0/></a><br /> <div style=font-size:9px;font-family:Arial, Helvetica, sans-serif;width:127px;font-color:#44a854;> <a href=http://www.filedropper.com >file upload</a></div>

 

extras

<a href=http://www.filedropper.com/extras_1><img src=http://www.filedropper.com/download_button.png width=127 height=145 border=0/></a><br /><div style=font-size:9px;font-family:Arial, Helvetica, sans-serif;width:127px;font-color:#44a854;> <a href=http://www.filedropper.com >file backup online</a></div>



IE keeps locking up.