Inactive Unwanted IE browser re-directs

[Inactive] Unwanted IE browser re-directs

Hi All,

Rather than fumble around trying various things I thought I'd jump in and ask for some help. I have a Windows 7 (32) bit machine that was recently discovered to have some form of Malware.

The symptoms started around the time that this user clicked on a Skype message link from a user who was also infected with Malware. Since then the previously installed Symantec Antivirus client was damaged and IE would run in the background and occasionally pop-up websites and if you do a search with Google and click on search results you get re-directed to random web sites.

I tried with Chrome and it also did the same.

As requested here are my logs (I wasn't able to run aswMBR as it would show in task manager briefly and then disapear a few seconds later).

Malware Bytes log

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8184

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

18/11/2011 12:54:25 PM
mbam-log-2011-11-18 (12-54-25).txt

Scan type: Quick scan
Objects scanned: 247335
Time elapsed: 7 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Hi Broni,

I'm providing the additional logs requested...all but the aswMBR output.

GMER Log

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-18 14:09:54
Windows 6.1.7600
Running: sm2nlkcm.exe; Driver: C:\Users\JIMMIL~1\AppData\Local\Temp\pxldypow.sys


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@COD 9600
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@DibServiceVersion 131072
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@Name 0x41 0x70 0x70 0x6C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@PID 781
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@Store Link Key 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@VID 1452
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@VIDType 2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\CachedServices
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\CachedServices@00010000 0x36 0x01 0x54 0x09 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@AuthenticationRequirements 5
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@IoCapability 255
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@RemoteAuthenticationRequirements 255
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP MITM Protected 0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP Paired 0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP Supported 0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}@Instance 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@CounterInstanceId 0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@DeviceString
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@Enabled 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@PriLangServiceName 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Keys
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Keys\00190e060b43
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\BTHPORT\Keys\00190e060b43@c42c03ade670 0x99 0x32 0x88 0x7F ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\HidBth
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\HidBth\Devices
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670@ConnectionAuthenticated 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670@VirtuallyCabled 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@BackupContext 0x02 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@COD Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@ExtPropDescSemaphore 1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@Scans Before Out of Range 8
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SCO Max Channels 2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@Store Link Key COD Masks 0x00 0x00 0x1F 0x43 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SymbolicLinkName \??\USB#VID_0A5C&PID_2153#00190E060B43#{0850302a-b344-4fda-9be9-90576b8d46f0}
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SymbolicName \??\USB#VID_0A5C&PID_2153#00190E060B43#{a5dcbf10-6530-11d2-901f-00c04fb951ed}
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@COD 9600
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@DibServiceVersion 131072
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@Name 0x41 0x70 0x70 0x6C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@PID 781
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@Store Link Key 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@VID 1452
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670@VIDType 2
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\CachedServices (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\CachedServices@00010000 0x36 0x01 0x54 0x09 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@AuthenticationRequirements 5
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@IoCapability 255
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@RemoteAuthenticationRequirements 255
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP MITM Protected 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP Paired 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43@SSP Supported 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb} (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}@Instance 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@CounterInstanceId 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@DeviceString
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@Enabled 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Devices\c42c03ade670\ServicesFor00190e060b43\{00001124-0000-1000-8000-00805f9b34fb}\C00000000@PriLangServiceName 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Keys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Keys\00190e060b43 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\BTHPORT\Keys\00190e060b43@c42c03ade670 0x99 0x32 0x88 0x7F ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\HidBth (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\HidBth\Devices (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670@ConnectionAuthenticated 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\HidBth\Devices\00190e060b43c42c03ade670@VirtuallyCabled 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@BackupContext 0x02 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@COD Type 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@ExtPropDescSemaphore 1
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@Scans Before Out of Range 8
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SCO Max Channels 2
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@Store Link Key COD Masks 0x00 0x00 0x1F 0x43 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SymbolicLinkName \??\USB#VID_0A5C&PID_2153#00190E060B43#{0850302a-b344-4fda-9be9-90576b8d46f0}
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings\0001@SymbolicName \??\USB#VID_0A5C&PID_2153#00190E060B43#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

---- EOF - GMER 1.0.15 ----

 

And DDS/Attach logs :

DDS.txt

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by vasm at 16:19:59 on 2011-11-18
Microsoft Windows 7 Enterprise 6.1.7600.0.1252.61.1033.18.3037.1681 [GMT 11:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\rdpclip.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com.au/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
TCP: DhcpNameServer = 192.168.1.5
TCP: Interfaces\{005B49CA-3BC8-42D9-8451-C3E37FA7A4B3} : DhcpNameServer = 192.168.1.5
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: GoToAssist - c:\program files\citrix\gotoassist\759\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl24f2bbd8;MpKsl24f2bbd8;c:\programdata\microsoft\microsoft antimalware\definition updates\{5de19336-a06f-401c-8a60-8f9cd1658992}\MpKsl24f2bbd8.sys [2011-11-18 28752]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-3-15 127488]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-1-14 39272]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
.
=============== Created Last 30 ================
.
2011-11-18 05:11:55 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{5de19336-a06f-401c-8a60-8f9cd1658992}\MpKsl24f2bbd8.sys
2011-11-18 05:11:53 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{5de19336-a06f-401c-8a60-8f9cd1658992}\offreg.dll
2011-11-18 04:50:24 -------- d-----w- c:\windows\system32\SPReview
2011-11-18 04:38:02 -------- d-----w- c:\users\vasm.looknet\appdata\local\ElevatedDiagnostics
2011-11-18 03:16:18 6668624 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{5de19336-a06f-401c-8a60-8f9cd1658992}\mpengine.dll
2011-11-18 01:37:42 -------- d-s---w- C:\ComboFix
2011-11-15 05:05:37 -------- d-----w- c:\program files\ESET
2011-11-15 03:58:53 -------- d-----w- c:\users\vasm.looknet\appdata\local\temp
2011-11-15 03:55:15 -------- d-sh--w- C:\$RECYCLE.BIN
2011-11-15 02:54:44 6668624 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-11-15 01:59:11 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-11-14 23:27:13 -------- d-----w- c:\programdata\Malwarebytes
2011-11-14 23:27:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-13 23:16:45 2339840 ----a-w- c:\windows\system32\win32k.sys
2011-11-13 23:16:44 708608 ----a-w- c:\program files\common files\system\wab32.dll
2011-11-13 23:16:43 1285488 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-13 23:05:45 703824 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-11-13 23:05:44 703824 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{a7d926f4-163e-4714-be71-24489ce3ae6e}\gapaengine.dll
2011-11-13 23:04:38 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-11-13 22:57:45 -------- d-----w- c:\program files\Microsoft Security Client
2011-11-13 22:57:24 240008 ----a-w- c:\windows\system32\drivers\netio.sys
.
==================== Find3M ====================
.
2011-08-27 04:43:07 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-08-27 04:43:06 233472 ----a-w- c:\windows\system32\oleacc.dll
.
============= FINISH: 16:26:50.52 ===============


Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Enterprise
Boot Device: \Device\HarddiskVolume3
Install Date: 14/01/2011 2:44:42 PM
System Uptime: 18/11/2011 4:11:40 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0P301D
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz | Socket 775 | 2495/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 139 GiB total, 64.315 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 5.192 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl0e8d288d
Device ID: ROOT\LEGACY_MPKSL0E8D288D\0000
Manufacturer:
Name: MpKsl0e8d288d
PNP Device ID: ROOT\LEGACY_MPKSL0E8D288D\0000
Service: MpKsl0e8d288d
.
==== System Restore Points ===================
.
RP84: 18/11/2011 12:39:03 PM - ComboFix created restore point
RP85: 18/11/2011 3:48:18 PM - Installed Skypeâ„¢ 5.5
RP86: 18/11/2011 3:48:33 PM - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
.NET Utilities
32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.6
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bonjour
CutePDF Writer 2.8
D3DX10
Dell Resource CD
ESET Online Scanner v3
GoToAssist Corporate
GoToMyPC
HP LaserJet M1120 MFP Series
hppusgM1120
Intel(R) Graphics Media Accelerator Driver
iTunes
Junk Mail filter update
LaCie Backup Software v1.5.2378
looksoftware suite 9.0
Malwarebytes' Anti-Malware version 1.51.2.1300
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
MrvlUsgTracking
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
OGA Notifier 2.0.0048.0
Payroll Premier
QuickBooks 2009-10 Service Pack 1
QuickBooks Premier Edition 2009-10
QuickTime
Readiris Pro 11
Realtek 8169 8168 8101E 8102E Ethernet Driver
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Scan To
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office Groove 2007 (KB2552997)
Security Update for Microsoft Office InfoPath 2007 (KB2510061)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Sonic CinePlayer Decoder Pack
SupportSoft Assisted Service
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2596560)
Windows 7 Upgrade Advisor
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows XP Mode
.
==== Event Viewer Messages From Past Week ========
.
18/11/2011 4:26:46 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
18/11/2011 4:15:30 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Windows 7 Service Pack 1 (KB976932).
18/11/2011 4:14:09 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume .
18/11/2011 4:12:17 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
18/11/2011 4:11:58 PM, Error: NETLOGON [5776] - Failed to create/open file \system32\config\netlogon.ftl with the following error: Access is denied.
18/11/2011 4:09:36 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
18/11/2011 4:09:36 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
18/11/2011 3:09:34 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
18/11/2011 3:08:09 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 3:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
18/11/2011 3:07:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
18/11/2011 3:07:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
18/11/2011 3:07:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
18/11/2011 3:07:39 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
18/11/2011 3:07:39 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
18/11/2011 2:22:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments " " in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
18/11/2011 2:22:44 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vpcnfltr vpcvmm Wanarpv6 WfpLwf
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The Netlogon service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
18/11/2011 2:22:44 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
18/11/2011 12:16:46 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UmRdpService service.
15/11/2011 5:06:57 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {F706B4B5-72BC-49D5-967C-05194FA83446} and APPID {F706B4B5-72BC-49D5-967C-05194FA83446} to the user LOOKNET\Jim Milligan SID (S-1-5-21-2052111302-1078145449-682003330-1114) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
15/11/2011 4:51:46 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
15/11/2011 4:46:51 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
15/11/2011 4:45:22 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
15/11/2011 4:29:55 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
15/11/2011 4:29:55 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
15/11/2011 4:08:12 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
15/11/2011 4:06:20 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
15/11/2011 2:31:20 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
15/11/2011 1:52:59 PM, Error: Microsoft-Windows-GroupPolicy [1110] - The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest. Ensure the user domain name matches the name of a trusted domain that resides in the same forest as the computer account.
15/11/2011 1:46:58 PM, Error: Service Control Manager [7001] - The WinHTTP Web Proxy Auto-Discovery Service service depends on the DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:46:58 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: The filename, directory name, or volume label syntax is incorrect.
15/11/2011 1:46:58 PM, Error: Service Control Manager [7000] - The Ancillary Function Driver for Winsock service failed to start due to the following error: The filename, directory name, or volume label syntax is incorrect.
15/11/2011 1:46:14 PM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147014846
15/11/2011 1:45:45 PM, Error: Service Control Manager [7024] - The Background Intelligent Transfer Service service terminated with service-specific error %%-2147014846.
15/11/2011 1:45:45 PM, Error: Microsoft-Windows-Bits-Client [16392] - The BITS service failed to start. Error 0x80072742.
15/11/2011 1:44:51 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: The system cannot find the file specified.
15/11/2011 1:44:51 PM, Error: Service Control Manager [7000] - The Ancillary Function Driver for Winsock service failed to start due to the following error: The system cannot find the file specified.
15/11/2011 1:44:51 PM, Error: Microsoft-Windows-GroupPolicy [1129] - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
15/11/2011 1:43:49 PM, Error: Service Control Manager [7023] - The IPsec Policy Agent service terminated with the following error: A socket operation encountered a dead network.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7023] - The Windows Time service terminated with the following error: An attempt was made to logon, but the network logon service was not started.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Workstation service depends on the SMB 2.0 MiniRedirector service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Server SMB 2.xxx Driver service depends on the srvnet service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Server SMB 1.xxx Driver service depends on the Server SMB 2.xxx Driver service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Server service depends on the Server SMB 1.xxx Driver service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Remote Desktop Configuration service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7000] - The srvnet service failed to start due to the following error: The device does not recognize the command.
15/11/2011 1:43:47 PM, Error: Service Control Manager [7000] - The SMB MiniRedirector Wrapper and Engine service failed to start due to the following error: The device does not recognize the command.
15/11/2011 1:43:47 PM, Error: Microsoft-Windows-Time-Service [46] - The time service encountered an error and was forced to shut down. The error was: 0x80070700: An attempt was made to logon, but the network logon service was not started.
15/11/2011 1:43:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD
15/11/2011 1:43:45 PM, Error: Service Control Manager [7001] - The UPnP Device Host service depends on the HTTP service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:45 PM, Error: Service Control Manager [7001] - The SSDP Discovery service depends on the HTTP service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:44 PM, Error: Service Control Manager [7024] - The Bonjour Service service terminated with service-specific error %%-1.
15/11/2011 1:43:44 PM, Error: Service Control Manager [7023] - The IKE and AuthIP IPsec Keying Modules service terminated with the following error: Load failed
15/11/2011 1:43:44 PM, Error: Service Control Manager [7001] - The Function Discovery Resource Publication service depends on the HTTP service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:41 PM, Error: Service Control Manager [7001] - The Print Spooler service depends on the HTTP service which failed to start because of the following error: The device does not recognize the command.
15/11/2011 1:43:41 PM, Error: Service Control Manager [7000] - The HTTP service failed to start due to the following error: The device does not recognize the command.
14/11/2011 9:58:45 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
14/11/2011 9:58:45 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
14/11/2011 9:44:40 AM, Error: Service Control Manager [7023] - The Windows Time service terminated with the following error: Access is denied.
14/11/2011 9:44:40 AM, Error: Microsoft-Windows-Time-Service [46] - The time service encountered an error and was forced to shut down. The error was: 0x80070005: Access is denied.
14/11/2011 9:35:24 AM, Error: Microsoft-Windows-TerminalServices-RemoteConnectionManager [1067] - The terminal server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: Access is denied. .
14/11/2011 9:35:17 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
14/11/2011 9:35:15 AM, Error: NETLOGON [3210] - This computer could not authenticate with \\server3.looknet.looksoftware.com, a Windows domain controller for domain LOOKNET, and therefore this computer might deny logon requests. This inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized. If this message appears again, contact your system administrator.
14/11/2011 8:00:47 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
14/11/2011 7:57:30 AM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
14/11/2011 3:58:14 PM, Error: SRTSP [5] -
14/11/2011 3:58:14 PM, Error: Service Control Manager [7000] - The SRTSPL service failed to start due to the following error: A device attached to the system is not functioning.
14/11/2011 3:58:14 PM, Error: Service Control Manager [7000] - The SRTSP service failed to start due to the following error: A device attached to the system is not functioning.
14/11/2011 12:37:51 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
14/11/2011 12:37:34 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SRTSP
14/11/2011 10:50:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 (KB2641690).
14/11/2011 10:50:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 (KB2620704).
14/11/2011 10:50:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 (KB2617657).
14/11/2011 10:50:12 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 (KB2588516).
14/11/2011 10:42:11 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
11/11/2011 10:15:30 PM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
11/11/2011 10:15:30 PM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
.
==== End Of File ===========================


Thanks

Vas

 

Hi Broni,

When I run aswMBR it briefly appears in the task list and then dissapears i.e. doesn't run. Tried to run it in safe mode but still no luck. I have also forced it to run as administrator.

Any suggestions?

Thanks

Vas

 

Hi again,

Looks like there is a rootkit installed :

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Enterprise Edition (build 7600), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000002`83000000

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...


And here is the combofix output :

ComboFix 11-11-20.02 - Jim Milligan 21/11/2011 12:27:07.2.2 - x86
Microsoft Windows 7 Enterprise 6.1.7600.0.1252.61.1033.18.3037.1618 [GMT 11:00]
Running from: c:\temp\Antivirus files\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\gotomon.log . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2011-10-21 to 2011-11-21 )))))))))))))))))))))))))))))))
.
.
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\vasm\AppData\Local\temp
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\vasm.LOOKNET\AppData\Local\temp
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\Charles Munforte\AppData\Local\temp
2011-11-21 02:04 . 2011-11-21 02:04 -------- d-----w- c:\users\Brendan Kay\AppData\Local\temp
2011-11-20 15:13 . 2011-11-20 15:13 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7DBB8772-E0F2-4415-88FF-B993C4D1577B}\MpKsl28f03f24.sys
2011-11-20 15:12 . 2011-11-21 02:12 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7DBB8772-E0F2-4415-88FF-B993C4D1577B}\offreg.dll
2011-11-20 15:12 . 2011-10-06 09:48 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7DBB8772-E0F2-4415-88FF-B993C4D1577B}\mpengine.dll
2011-11-18 05:58 . 2011-11-18 06:00 -------- d-----w- c:\users\vasm.LOOKNET\AppData\Roaming\Skype
2011-11-18 05:58 . 2011-11-18 05:58 -------- d-----r- c:\program files\Skype
2011-11-18 04:50 . 2011-11-18 04:50 -------- d-----w- c:\windows\system32\SPReview
2011-11-18 04:38 . 2011-11-18 04:38 -------- d-----w- c:\users\vasm.LOOKNET\AppData\Local\ElevatedDiagnostics
2011-11-15 05:05 . 2011-11-15 05:05 -------- d-----w- c:\program files\ESET
2011-11-15 03:28 . 2011-11-21 02:15 -------- d-----w- c:\users\Jim Milligan\AppData\Local\temp
2011-11-15 02:54 . 2011-10-06 09:48 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-15 01:59 . 2011-04-25 02:35 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-11-14 23:27 . 2011-11-14 23:27 -------- d-----w- c:\users\Jim Milligan\AppData\Roaming\Malwarebytes
2011-11-14 23:27 . 2011-11-14 23:27 -------- d-----w- c:\programdata\Malwarebytes
2011-11-14 23:27 . 2011-11-14 23:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-13 23:16 . 2011-09-29 04:20 2339840 ----a-w- c:\windows\system32\win32k.sys
2011-11-13 23:16 . 2011-10-01 04:43 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-13 23:16 . 2011-09-29 15:43 1285488 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-13 23:05 . 2011-11-13 23:04 703824 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-11-13 23:05 . 2011-11-13 23:04 703824 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A7D926F4-163E-4714-BE71-24489CE3AE6E}\gapaengine.dll
2011-11-13 23:04 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-11-13 22:57 . 2011-11-13 22:58 -------- d-----w- c:\program files\Microsoft Security Client
2011-11-13 22:57 . 2010-04-09 07:24 240008 ----a-w- c:\windows\system32\drivers\netio.sys
2011-11-13 22:37 . 2011-11-13 22:37 -------- d-----w- c:\users\vasm\AppData\Roaming\Apple Computer
2011-11-13 22:36 . 2011-11-13 22:36 -------- d-----r- c:\users\vasm\Virtual Machines
2011-11-10 07:38 . 2011-11-10 07:38 -------- d--h--w- c:\windows\Sun
2011-10-25 06:02 . 2011-11-13 22:16 -------- d-----w- c:\program files\Apple Software Update
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-27 04:43 . 2011-10-12 08:20 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-08-27 04:43 . 2011-10-12 08:20 233472 ----a-w- c:\windows\system32\oleacc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-09 4240760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-11-17 421160]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2010-10-15 137752]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2010-10-15 171032]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2010-10-15 170520]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2011-09-13 04:23 13672 ----a-w- c:\program files\Citrix\GoToAssist\759\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
.
[HKLM\~\startupfolder\C:^Users^Jim Milligan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
path=c:\users\Jim Milligan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-04-17 06:04 133104 ----atw- c:\users\Jim Milligan\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoToMyPC]
2008-09-30 05:04 258856 ----a-w- c:\program files\Citrix\GoToMyPC\g2svc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 01:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2010-10-15 11:36 171032 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]
2007-11-02 04:52 36864 ----a-w- c:\program files\HP\HP UT\bin\hppusg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2010-10-15 11:36 137752 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-17 09:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaCie Backup]
2006-07-05 23:30 2596864 ----a-w- c:\program files\LaCie\Backup Software\LacieBackup.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-09 15:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-10-15 11:36 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 06:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-07-14 01:14 1173504 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2009-07-14 01:14 660480 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
R1 MpKsl0e8d288d;MpKsl0e8d288d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0608F85E-27D9-4F05-9FB9-6D065C1266BA}\MpKsl0e8d288d.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-14 1343400]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [x]
S1 MpKsl28f03f24;MpKsl28f03f24;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7DBB8772-E0F2-4415-88FF-B993C4D1577B}\MpKsl28f03f24.sys [2011-11-20 28752]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-03-14 127488]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - eeCtrl
*Deregistered* - SymEvent
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1078145449-682003330-1114Core.job
- c:\users\Jim Milligan\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-17 06:04]
.
2011-11-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1078145449-682003330-1114UA.job
- c:\users\Jim Milligan\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-17 06:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.5
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2011-11-21 13:30:56 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-21 02:30
.
Pre-Run: 65,087,528,960 bytes free
Post-Run: 65,372,876,800 bytes free
.
- - End Of File - - 9DAA85BE3CA19D1CDAC023E105467EE9