Click.Giftload problem

[Jak P]

Would be very grateful for your help. Spybot shows Click.Giftload, reoccurs when machine restarted. Followed all the 'new post' instructions on Spybot. Ran Erunt. Downloading / running DDS produced 'blue screen of death' twice; third attempt Windows started up and ran, DDS produced its two logs. System is XP 5.1 SP3 all up to date; Zone Alarm; AVG up to date; Spybot with Tea Timer, up to date. Thanks very much. DDS.txt log below and attach.txt zipped and attached; and below DDS is the previous Spybot log:

DDS

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by John at 17:05:12.45 on 13/05/2011
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.894.360 [GMT 1:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *Enabled*
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Brother\Brmfcmon\BrMfimon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Documents and Settings\John\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.facebook.com
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
uURLSearchHooks: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
TB: Nero Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\11\config\ereg\Ereg.ini"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {C0758729-D7D4-4455-A5FE-104A9C3EC618} = 194.72.9.34,194.72.9.38
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\windows\system32\Skype4COM.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\john\applic~1\mozilla\firefox\profiles\zwh89pt5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\john\application data\mozilla\firefox\profiles\zwh89pt5.default\extensions\{91da5e8a-3318-4f8c-b67e-5964de3ab546}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\john\application data\mozilla\firefox\profiles\zwh89pt5.default\extensions\{91da5e8a-3318-4f8c-b67e-5964de3ab546}\components\RadioWMPCore.dll
FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 299984]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-6-28 532224]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2010-11-5 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2010-11-5 488952]
R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2010-5-4 503080]
R2 Start BT in service;Start BT in service;c:\program files\ivt corporation\bluesoleil\StartSkysolSvc.exe [2007-12-27 51816]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-9-27 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2010-11-4 517448]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-9-27 136176]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\lavasoft\ad-aware\kernexplorer.sys --> c:\program files\lavasoft\ad-aware\KernExplorer.sys [?]
.
=============== Created Last 30 ================
.
2011-05-13 13:58:08 -------- d-----w- c:\docume~1\john\applic~1\Vygyop
2011-05-13 13:58:08 -------- d-----w- c:\docume~1\john\applic~1\Biiml
2011-04-29 17:24:30 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-04-29 17:24:30 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-04-29 17:24:30 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-04-29 17:24:30 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-04-29 17:24:30 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-04-29 17:24:29 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-04-29 17:24:29 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-04-29 17:24:29 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-28 16:38:29 -------- d-----w- c:\docume~1\john\applic~1\Auslogics
2011-04-26 22:21:07 -------- d-----w- c:\docume~1\alluse~1\applic~1\Zeon
2011-04-26 22:21:04 -------- d-----w- c:\docume~1\john\applic~1\Zeon
.
==================== Find3M ====================
.
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45:07 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-17 13:51:57 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-02-17 13:51:57 667136 ----a-w- c:\windows\system32\wininet.dll
2011-02-17 13:51:57 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-02-17 12:37:38 369664 ----a-w- c:\windows\system32\html.iec
2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: HTS541060G9AT00 rev.MB3OA60A -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x84AE76F0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x84aeda10]; MOV EAX, [0x84aeda8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x84B7DAB8]
3 CLASSPNP[0xF7734FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\00000086[0x84B649E8]
5 ACPI[0xF76AB620] -> nt!IofCallDriver[0x804E37D5] -> [0x84B64D98]
\Driver\atapi[0x84BD0890] -> IRP_MJ_CREATE -> 0x84AE76F0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x84AE753B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 17:06:49.59 ===============

EARLIER SPYBOT LOG:


--- Search result list ---
Click.GiftLoad: [SBI $89783858] User settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION\svchost.exe


--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2010-06-17 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2011-03-18 Includes\Adware.sbi (*)
2011-05-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2010-12-14 Includes\Dialer.sbi (*)
2011-03-08 Includes\DialerC.sbi (*)
2011-02-24 Includes\HeavyDuty.sbi (*)
2011-03-29 Includes\Hijackers.sbi (*)
2011-03-29 Includes\HijackersC.sbi (*)
2010-09-15 Includes\iPhone.sbi (*)
2010-12-14 Includes\Keyloggers.sbi (*)
2011-03-08 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2011-04-05 Includes\Malware.sbi (*)
2011-05-09 Includes\MalwareC.sbi (*)
2011-02-24 Includes\PUPS.sbi (*)
2011-03-15 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2011-02-24 Includes\Security.sbi (*)
2011-05-03 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2011-02-24 Includes\Spyware.sbi (*)
2011-05-10 Includes\SpywareC.sbi (*)
2010-03-08 Includes\Tracks.uti
2010-12-28 Includes\Trojans.sbi (*)
2011-05-11 Includes\TrojansC-02.sbi (*)
2011-05-11 Includes\TrojansC-03.sbi (*)
2011-05-11 Includes\TrojansC-04.sbi (*)
2011-05-11 Includes\TrojansC-05.sbi (*)
2011-05-11 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 3 (5.1.2600)
/ MSXML4SP2: Security update for MSXML4 SP2 (KB954430)
/ MSXML4SP2: Security update for MSXML4 SP2 (KB973688)
/ Windows Media Player: Security Update for Windows Media Player (KB2378111)
/ Windows Media Player: Security Update for Windows Media Player (KB952069)
/ Windows Media Player: Security Update for Windows Media Player (KB954155)
/ Windows Media Player: Security Update for Windows Media Player (KB973540)
/ Windows Media Player: Security Update for Windows Media Player (KB973540)
/ Windows Media Player: Security Update for Windows Media Player (KB975558)
/ Windows Media Player: Security Update for Windows Media Player (KB978695)
/ Windows Media Player: Security Update for Windows Media Player (KB979402)
/ Windows Media Player: Security Update for Windows Media Player (KB979402)
/ Windows XP: Security Update for Windows XP (KB941569)
/ Windows XP / SP3: Windows XP Service Pack 3
/ Windows XP / SP4: Security Update for Windows XP (KB2079403)
/ Windows XP / SP4: Security Update for Windows XP (KB2115168)
/ Windows XP / SP4: Security Update for Windows XP (KB2121546)
/ Windows XP / SP4: Update for Windows XP (KB2141007)
/ Windows XP / SP4: Hotfix for Windows XP (KB2158563)
/ Windows XP / SP4: Security Update for Windows XP (KB2160329)
/ Windows XP / SP4: Security Update for Windows XP (KB2183461)
/ Windows XP / SP4: Security Update for Windows XP (KB2229593)
/ Windows XP / SP4: Security Update for Windows XP (KB2259922)
/ Windows XP / SP4: Security Update for Windows XP (KB2279986)
/ Windows XP / SP4: Security Update for Windows XP (KB2286198)
/ Windows XP / SP4: Security Update for Windows XP (KB2296011)
/ Windows XP / SP4: Security Update for Windows XP (KB2296199)
/ Windows XP / SP4: Update for Windows XP (KB2345886)
/ Windows XP / SP4: Security Update for Windows XP (KB2347290)
/ Windows XP / SP4: Security Update for Windows XP (KB2360131)
/ Windows XP / SP4: Security Update for Windows XP (KB2360937)
/ Windows XP / SP4: Security Update for Windows XP (KB2387149)
/ Windows XP / SP4: Security Update for Windows XP (KB2393802)
/ Windows XP / SP4: Security Update for Windows XP (KB2412687)
/ Windows XP / SP4: Security Update for Windows XP (KB2416400)
/ Windows XP / SP4: Security Update for Windows XP (KB2419632)
/ Windows XP / SP4: Security Update for Windows XP (KB2423089)
/ Windows XP / SP4: Security Update for Windows XP (KB2436673)
/ Windows XP / SP4: Security Update for Windows XP (KB2440591)
/ Windows XP / SP4: Security Update for Windows XP (KB2443105)
/ Windows XP / SP4: Hotfix for Windows XP (KB2443685)
/ Windows XP / SP4: Update for Windows XP (KB2467659)
/ Windows XP / SP4: Security Update for Windows XP (KB2476687)
/ Windows XP / SP4: Security Update for Windows XP (KB2478960)
/ Windows XP / SP4: Security Update for Windows XP (KB2478971)
/ Windows XP / SP4: Security Update for Windows XP (KB2479628)
/ Windows XP / SP4: Security Update for Windows XP (KB2479943)
/ Windows XP / SP4: Security Update for Windows XP (KB2481109)
/ Windows XP / SP4: Security Update for Windows XP (KB2482017)
/ Windows XP / SP4: Security Update for Windows XP (KB2483185)
/ Windows XP / SP4: Security Update for Windows XP (KB2485376)
/ Windows XP / SP4: Security Update for Windows XP (KB2485663)
/ Windows XP / SP4: Security Update for Windows XP (KB2497640)
/ Windows XP / SP4: Security Update for Windows XP (KB2503658)
/ Windows XP / SP4: Security Update for Windows XP (KB2506212)
/ Windows XP / SP4: Security Update for Windows XP (KB2506223)
/ Windows XP / SP4: Security Update for Windows XP (KB2507618)
/ Windows XP / SP4: Security Update for Windows XP (KB2508272)
/ Windows XP / SP4: Security Update for Windows XP (KB2508429)
/ Windows XP / SP4: Security Update for Windows XP (KB2509553)
/ Windows XP / SP4: Security Update for Windows XP (KB2510581)
/ Windows XP / SP4: Security Update for Windows XP (KB2511455)
/ Windows XP / SP4: Security Update for Windows XP (KB2524375)
/ Windows XP / SP4: Security Update for Windows XP (KB923561)
/ Windows XP / SP4: Hotfix for Windows XP (KB942288-v3)
/ Windows XP / SP4: Security Update for Windows XP (KB946648)
/ Windows XP / SP4: Security Update for Windows XP (KB950760)
/ Windows XP / SP4: Security Update for Windows XP (KB950762)
/ Windows XP / SP4: Security Update for Windows XP (KB950974)
/ Windows XP / SP4: Security Update for Windows XP (KB951376-v2)
/ Windows XP / SP4: Security Update for Windows XP (KB951748)
/ Windows XP / SP4: Update for Windows XP (KB951978)
/ Windows XP / SP4: Security Update for Windows XP (KB952004)
/ Windows XP / SP4: Hotfix for Windows XP (KB952287)
/ Windows XP / SP4: Security Update for Windows XP (KB952954)
/ Windows XP / SP4: Security Update for Windows XP (KB955069)
/ Windows XP / SP4: Update for Windows XP (KB955759)
/ Windows XP / SP4: Security Update for Windows XP (KB956572)
/ Windows XP / SP4: Security Update for Windows XP (KB956744)
/ Windows XP / SP4: Security Update for Windows XP (KB956802)
/ Windows XP / SP4: Security Update for Windows XP (KB956803)
/ Windows XP / SP4: Security Update for Windows XP (KB956844)
/ Windows XP / SP4: Security Update for Windows XP (KB958644)
/ Windows XP / SP4: Security Update for Windows XP (KB958869)
/ Windows XP / SP4: Security Update for Windows XP (KB959426)
/ Windows XP / SP4: Security Update for Windows XP (KB960225)
/ Windows XP / SP4: Security Update for Windows XP (KB960803)
/ Windows XP / SP4: Security Update for Windows XP (KB960859)
/ Windows XP / SP4: Security Update for Windows XP (KB961501)
/ Windows XP / SP4: Update for Windows XP (KB967715)
/ Windows XP / SP4: Update for Windows XP (KB968389)
/ Windows XP / SP4: Security Update for Windows XP (KB969059)
/ Windows XP / SP4: Security Update for Windows XP (KB970238)
/ Windows XP / SP4: Security Update for Windows XP (KB970430)
/ Windows XP / SP4: Update for Windows XP (KB971029)
/ Windows XP / SP4: Security Update for Windows XP (KB971468)
/ Windows XP / SP4: Security Update for Windows XP (KB971657)
/ Windows XP / SP4: Update for Windows XP (KB971737)
/ Windows XP / SP4: Security Update for Windows XP (KB971961)
/ Windows XP / SP4: Security Update for Windows XP (KB972270)
/ Windows XP / SP4: Security Update for Windows XP (KB973507)
/ Windows XP / SP4: Update for Windows XP (KB973687)
/ Windows XP / SP4: Update for Windows XP (KB973815)
/ Windows XP / SP4: Security Update for Windows XP (KB973869)
/ Windows XP / SP4: Security Update for Windows XP (KB973904)
/ Windows XP / SP4: Security Update for Windows XP (KB974112)
/ Windows XP / SP4: Security Update for Windows XP (KB974318)
/ Windows XP / SP4: Security Update for Windows XP (KB974392)
/ Windows XP / SP4: Security Update for Windows XP (KB974571)
/ Windows XP / SP4: Security Update for Windows XP (KB975025)
/ Windows XP / SP4: Security Update for Windows XP (KB975467)
/ Windows XP / SP4: Security Update for Windows XP (KB975560)
/ Windows XP / SP4: Security Update for Windows XP (KB975561)
/ Windows XP / SP4: Security Update for Windows XP (KB975562)
/ Windows XP / SP4: Security Update for Windows XP (KB975713)
/ Windows XP / SP4: Hotfix for Windows XP (KB976002-v5)
/ Windows XP / SP4: Security Update for Windows XP (KB977816)
/ Windows XP / SP4: Security Update for Windows XP (KB977914)
/ Windows XP / SP4: Security Update for Windows XP (KB978037)
/ Windows XP / SP4: Security Update for Windows XP (KB978338)
/ Windows XP / SP4: Security Update for Windows XP (KB978542)
/ Windows XP / SP4: Security Update for Windows XP (KB978601)
/ Windows XP / SP4: Security Update for Windows XP (KB978706)
/ Windows XP / SP4: Security Update for Windows XP (KB979309)
/ Windows XP / SP4: Security Update for Windows XP (KB979482)
/ Windows XP / SP4: Security Update for Windows XP (KB979559)
/ Windows XP / SP4: Security Update for Windows XP (KB979683)
/ Windows XP / SP4: Security Update for Windows XP (KB979687)
/ Windows XP / SP4: Security Update for Windows XP (KB980195)
/ Windows XP / SP4: Security Update for Windows XP (KB980218)
/ Windows XP / SP4: Security Update for Windows XP (KB980232)
/ Windows XP / SP4: Security Update for Windows XP (KB980436)
/ Windows XP / SP4: Security Update for Windows XP (KB981322)
/ Windows XP / SP4: Security Update for Windows XP (KB981349)
/ Windows XP / SP4: Hotfix for Windows XP (KB981793)
/ Windows XP / SP4: Security Update for Windows XP (KB981852)
/ Windows XP / SP4: Security Update for Windows XP (KB981957)
/ Windows XP / SP4: Security Update for Windows XP (KB981997)
/ Windows XP / SP4: Security Update for Windows XP (KB982132)
/ Windows XP / SP4: Security Update for Windows XP (KB982214)
/ Windows XP / SP4: Security Update for Windows XP (KB982381)
/ Windows XP / SP4: Security Update for Windows XP (KB982665)
/ Windows XP / SP4: Security Update for Windows XP (KB982802)


--- Startup entries list ---
Located: HK_LM:Run, AVG_TRAY
command: C:\Program Files\AVG\AVG10\avgtray.exe
file: C:\Program Files\AVG\AVG10\avgtray.exe
size: 2747744
MD5: 4719ED2A9E1F0FF37BC3FC1999F4FFC4

Located: HK_LM:Run, BrMfcWnd
command: C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
file: C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
size: 1085440
MD5: 8070D04DE18022E7E65701461C978AE3

Located: HK_LM:Run, ControlCenter3
command: C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
file: C:\Program Files\Brother\ControlCenter3\brctrcen.exe
size: 86016
MD5: 5983E84038FF6CB55B4BA740C341A54B

Located: HK_LM:Run, IndexSearch
command: "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
file: C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
size: 46368
MD5: BE72C212B14FC8F872A70C6C311D0529

Located: HK_LM:Run, ISW
command: "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
file: C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
size: 738808
MD5: 55BB967FBB994D52A7C9DADA8939FB6F

Located: HK_LM:Run, PaperPort PTD
command: "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
file: C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
size: 29984
MD5: 27249F2A900032F3C2DFAB8DE8F16399

Located: HK_LM:Run, PPort11reminder
command: "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
file: C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe
size: 328992
MD5: A4A66195EB0ECD574A32AAA92DC0A7BD

Located: HK_LM:Run, SSBkgdUpdate
command: "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
file: C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
size: 210472
MD5: 846965AE55A2662B1576C0F392DD1D6E

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
file: C:\Program Files\Common Files\Java\Java Update\jusched.exe
size: 248552
MD5: 93DB1FF92B03D24738A71E6E4992DFD3

Located: HK_LM:Run, ZoneAlarm Client
command: "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
file: C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
size: 1043968
MD5: FBE8EBAC021C641AB3AD011328F8ABAA

Located: HK_CU:Run, ctfmon.exe
where: .DEFAULT...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
where: S-1-5-21-1614895754-1757981266-682003330-1004...
command: "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
file: C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
size: 152872
MD5: 86F0D0B3A07C142C81DAB47E8495A822

Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-1614895754-1757981266-682003330-1004...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887

Located: HK_CU:Run, ctfmon.exe
where: S-1-5-18...
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, dimsntfy
command: %SystemRoot%\System32\dimsntfy.dll
file: %SystemRoot%\System32\dimsntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!



--- Browser helper object list ---
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (WormRadar.com IESiteBlocker.NavFilter)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: WormRadar.com IESiteBlocker.NavFilter
CLSID name: AVG Safe Search
Path: C:\Program Files\AVG\AVG10\
Long name: avgssie.dll
Short name:
Date (created): 07/01/2011 02:22:42
Date (last access): 13/05/2011 17:27:50
Date (last write): 07/01/2011 02:22:42
Filesize: 2731872
Attributes: archive
MD5: E0D679F19D3F45E911DB5A4F2110CD8E
CRC32: 81399660
Version: 10.0.0.1201

{53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Spybot-S&D IE Protection
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDHelper.dll
info link: http://www.safer-networking.org/
info source: Safer-Networking Ltd.
Path: C:\PROGRA~1\SPYBOT~1\
Long name: SDHelper.dll
Short name:
Date (created): 17/06/2010 18:36:28
Date (last access): 13/05/2011 17:27:50
Date (last write): 26/01/2009 15:31:02
Filesize: 1879896
Attributes: archive
MD5: 022C2F6DCCDFA0AD73024D254E62AFAC
CRC32: 5BA24007
Version: 1.6.2.14

{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} (ZoneAlarm Security Engine Registrar)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: ZoneAlarm Security Engine Registrar
CLSID name: ZoneAlarm Security Engine Registrar
Path: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\
Long name: TrustCheckerIEPlugin.dll
Short name: TRUSTC~1.DLL
Date (created): 05/11/2010 12:42:00
Date (last access): 13/05/2011 17:27:52
Date (last write): 05/11/2010 12:42:00
Filesize: 599544
Attributes: archive
MD5: DCAA8EC30CB1E037DA067BE09DCDFAAA
CRC32: 46B5B37A
Version: 1.5.260.0

{91da5e8a-3318-4f8c-b67e-5964de3ab546} (ZoneAlarm Security Toolbar)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: ZoneAlarm Security Toolbar
Path: C:\Program Files\ZoneAlarm_Security\
Long name: tbZone.dll
Short name:
Date (created): 15/01/2011 11:37:30
Date (last access): 13/05/2011 14:47:32
Date (last write): 01/12/2010 12:27:42
Filesize: 2735200
Attributes: archive
MD5: 02DE6B9AE1269AF813FE8B629EE50093
CRC32: 5BCFA001
Version: 5.7.4.0

{A3BC75A2-1F87-4686-AA43-5347D756017C} (AVG Security Toolbar BHO)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: AVG Security Toolbar BHO
Path: C:\Program Files\AVG\AVG10\Toolbar\
Long name: IEToolbar.dll
Short name: IETOOL~1.DLL
Date (created): 04/11/2010 14:47:08
Date (last access): 13/05/2011 16:37:16
Date (last write): 25/11/2010 10:49:42
Filesize: 2463048
Attributes: archive
MD5: A7F21CD5CDFCBA8E0778ADAA6A7D6566
CRC32: 380C0B3E
Version: 6.11.25.1

{D4027C7F-154A-4066-A1AD-4243D8127440} (Ask Toolbar BHO)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: Ask Toolbar BHO
CLSID name: Nero Toolbar
Path: C:\Program Files\Ask.com\
Long name: GenericAskToolbar.dll
Short name: GENERI~1.DLL
Date (created): 11/10/2010 17:12:10
Date (last access): 13/05/2011 14:47:28
Date (last write): 11/10/2010 17:12:10
Filesize: 1244040
Attributes: archive
MD5: 154433405E2C109C5A4A83ACA0517038
CRC32: 7E893340
Version: 5.6.13.184

{DBC80044-A445-435b-BC74-9C25C1C588A9} (Java(tm) Plug-In 2 SSV Helper)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: Java(tm) Plug-In 2 SSV Helper
Path: C:\Program Files\Java\jre6\bin\
Long name: jp2ssv.dll
Short name:
Date (created): 05/01/2011 14:47:40
Date (last access): 13/05/2011 17:22:00
Date (last write): 05/01/2011 14:47:40
Filesize: 41760
Attributes: archive
MD5: 67E74163C6178AA696E2B4A726770A02
CRC32: 87035BA5
Version: 6.0.230.5

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} (JQSIEStartDetectorImpl)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name: JQSIEStartDetectorImpl
CLSID name: JQSIEStartDetectorImpl Class
Path: C:\Program Files\Java\jre6\lib\deploy\jqs\ie\
Long name: jqs_plugin.dll
Short name: JQS_PL~1.DLL
Date (created): 05/01/2011 14:47:40
Date (last access): 13/05/2011 17:19:32
Date (last write): 05/01/2011 14:47:40
Filesize: 79648
Attributes: archive
MD5: 054DCC54B7DE3A9511F50B9FCBF4CDD1
CRC32: A287BEA2
Version: 6.0.230.5



--- ActiveX list ---
{17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool)
DPF name:
CLSID name: Windows Genuine Advantage Validation Tool
Installer: C:\WINDOWS\Downloaded Program Files\LegitCheckControl.inf
Codebase: http://go.microsoft.com/fwlink/?linkid=39204
description:
classification: Legitimate
known filename: LegitCheckControl.DLL
info link:
info source: Safer Networking Ltd.
Path: C:\WINDOWS\system32\
Long name: LegitCheckControl.DLL
Short name: LEGITC~1.DLL
Date (created): 20/03/2008 18:06:36
Date (last access): 13/05/2011 17:16:44
Date (last write): 25/06/2009 13:20:28
Filesize: 1485176
Attributes: archive
MD5: 3307A07B81206F354F0D4BEFEE922437
CRC32: 58E4DC38
Version: 1.9.42.0

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_23
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre6\bin\
Long name: npjpi160_23.dll
Short name: NPJPI1~1.DLL
Date (created): 12/11/2010 17:34:14
Date (last access): 11/05/2011 17:46:02
Date (last write): 12/11/2010 19:53:14
Filesize: 141088
Attributes: archive
MD5: 44E02BCB6E86B337F85E84BF30D1F21F
CRC32: A050C619
Version: 6.0.230.5

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_22
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_22\bin\
Long name: npjpi160_22.dll
Short name: NPJPI1~1.DLL
Date (created): 03/04/2011 15:40:06
Date (last access): 11/05/2011 17:46:02
Date (last write): 03/04/2011 15:40:06
Filesize: 141088
Attributes: archive
MD5: AFB7EFCDE5277F6514EF0E9FF8D8D862
CRC32: 2A43B8CC
Version: 6.0.220.4

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_23
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Path: C:\Program Files\Java\jre6\bin\
Long name: npjpi160_23.dll
Short name: NPJPI1~1.DLL
Date (created): 12/11/2010 17:34:14
Date (last access): 13/05/2011 17:32:10
Date (last write): 12/11/2010 19:53:14
Filesize: 141088
Attributes: archive
MD5: 44E02BCB6E86B337F85E84BF30D1F21F
CRC32: A050C619
Version: 6.0.230.5

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_23
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
description:
classification: Legitimate
known filename: npjpi150_06.dll
info link:
info source: Safer Networking Ltd.
Path: C:\Program Files\Java\jre6\bin\
Long name: npjpi160_23.dll
Short name: NPJPI1~1.DLL
Date (created): 12/11/2010 17:34:14
Date (last access): 13/05/2011 17:32:10
Date (last write): 12/11/2010 19:53:14
Filesize: 141088
Attributes: archive
MD5: 44E02BCB6E86B337F85E84BF30D1F21F
CRC32: A050C619
Version: 6.0.230.5

{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
Installer: C:\WINDOWS\Downloaded Program Files\swflash.inf
Codebase: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\system32\Macromed\Flash\
Long name: Flash10h.ocx
Short name:
Date (created): 06/07/2010 15:54:42
Date (last access): 13/05/2011 16:37:34
Date (last write): 06/07/2010 15:54:42
Filesize: 5712336
Attributes: readonly archive
MD5: F366D1694E4D244A73F4E52817C38D5B
CRC32: 1F489DFC
Version: 10.1.53.64



--- Process list ---
PID: 0 ( 0) [System]
PID: 896 ( 4) \SystemRoot\System32\smss.exe
size: 50688
PID: 960 ( 952) \??\C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
size: 650592
PID: 1160 ( 896) \??\C:\WINDOWS\system32\csrss.exe
size: 6144
PID: 1184 ( 896) \??\C:\WINDOWS\system32\winlogon.exe
size: 507904
PID: 1232 (1184) C:\WINDOWS\system32\services.exe
size: 110592
MD5: 65DF52F5B8B6E9BBD183505225C37315
PID: 1252 (1184) C:\WINDOWS\system32\lsass.exe
size: 13312
MD5: BF2466B3E18E970D8A976FB95FC1CA85
PID: 1400 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 1464 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 1760 (1740) C:\WINDOWS\Explorer.EXE
size: 1033728
MD5: 12896823FB95BFB3DC9B46BCAEDC9923
PID: 1920 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 128 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 172 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 216 (1232) C:\WINDOWS\system32\ZoneLabs\vsmon.exe
size: 2435592
MD5: AEEC11FC2B0DBF973F54E30ECF42E73E
PID: 352 (1232) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
size: 488952
MD5: 82D57415B28E1F374DF9EBA6D16A1B46
PID: 420 (1232) C:\WINDOWS\system32\spoolsv.exe
size: 58880
MD5: 60784F891563FB1B767F70117FC2428F
PID: 280 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 1964 (1232) C:\Program Files\AVG\AVG10\avgwdsvc.exe
size: 265400
MD5: 4AF61A15B3614FEF25FE93EA2FABD620
PID: 1996 (1232) C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
size: 166520
MD5: 2072720F0848312C40E01C2AEC8ED439
PID: 564 (1232) C:\Program Files\Java\jre6\bin\jqs.exe
size: 153376
MD5: E731921DB2E17DCD3DB472FAD5549C57
PID: 680 (1232) C:\Program Files\Nero\Update\NASvc.exe
size: 503080
MD5: 9D1CCE440552500DED3A62F9D779CDB4
PID: 1256 (1232) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 1552 (1964) C:\Program Files\AVG\AVG10\avgnsx.exe
size: 1084256
MD5: 7E6741A17CFDCD700DA5B6EC624F83B3
PID: 1516 (1964) C:\Program Files\AVG\AVG10\avgemcx.exe
size: 1052512
MD5: D640784CA5BEF5A18322C45F8DEB2A5C
PID: 2316 (1232) C:\WINDOWS\System32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 2376 (1232) C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
size: 51816
MD5: 329EBFCE6BA46C29EA1B8624E7823CAD
PID: 2524 (1232) C:\WINDOWS\system32\svchost.exe
size: 14336
MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18
PID: 2560 (1232) C:\WINDOWS\system32\wdfmgr.exe
size: 38912
MD5: C81B8635DEE0D3EF5F64B3DD643023A5
PID: 2616 (1232) C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
size: 6128720
MD5: 288778D9E2D1C7E8A5DBD5C6DB8046B0
PID: 3008 (1232) C:\WINDOWS\System32\alg.exe
size: 44544
MD5: 8C515081584A38AA007909CD02020B3D
PID: 2740 (1760) C:\Program Files\Common Files\Java\Java Update\jusched.exe
size: 248552
MD5: 93DB1FF92B03D24738A71E6E4992DFD3
PID: 3748 (1760) C:\Program Files\AVG\AVG10\avgtray.exe
size: 2747744
MD5: 4719ED2A9E1F0FF37BC3FC1999F4FFC4
PID: 3028 (1760) C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
size: 1043968
MD5: FBE8EBAC021C641AB3AD011328F8ABAA
PID: 3728 (1760) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
size: 29984
MD5: 27249F2A900032F3C2DFAB8DE8F16399
PID: 4072 (1760) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
size: 1085440
MD5: 8070D04DE18022E7E65701461C978AE3
PID: 1208 (3748) C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
size: 737872
MD5: 0CCE84F6F693478A769BFC1E993CBF67
PID: 508 (1760) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2260480
MD5: 390679F7A217A5E73D756276C40AE887
PID: 644 (1760) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
size: 152872
MD5: 86F0D0B3A07C142C81DAB47E8495A822
PID: 1724 (4072) C:\Program Files\Brother\Brmfcmon\BrMfimon.exe
size: 118784
MD5: 601197F17B5CFFC4E4C8ECEA433E11F0
PID: 3152 (1116) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
size: 835584
MD5: 7C5DF34EE483BBE5B45280B0DDF82AC6
PID: 3344 (1232) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
size: 279848
MD5: A328A46D87BB92CE4D8A4528E9D84787
PID: 2756 (1400) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
size: 1213736
MD5: FFBD5650348D4F9E0AA8E72938DC6478
PID: 2968 (3028) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
size: 738808
MD5: 55BB967FBB994D52A7C9DADA8939FB6F
PID: 3576 (1016) \??\C:\PROGRA~1\AVG\AVG10\avgrsx.exe
size: 654176
PID: 1796 (3576) \??\C:\Program Files\AVG\AVG10\avgcsrvx.exe
size: 845664
PID: 3300 (1760) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 5365592
MD5: 0477C2F9171599CA5BC3307FDFBA8D89
PID: 804 (1760) C:\Program Files\Mozilla Firefox\firefox.exe
size: 924632
MD5: E83508D9A0F0D0D8449317DC6A4C5E02
PID: 4 ( 0) System


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 13/05/2011 17:32:11

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
https://www.facebook.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip

Protocol 3: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 4: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider

Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{45C3CF44-7C35-441B-8191-7CE3CC8CAE2F}] SEQPACKET 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{45C3CF44-7C35-441B-8191-7CE3CC8CAE2F}] DATAGRAM 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1A66B721-C5C3-43A6-A038-678CFB8A0505}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{1A66B721-C5C3-43A6-A038-678CFB8A0505}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C0758729-D7D4-4455-A5FE-104A9C3EC618}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{C0758729-D7D4-4455-A5FE-104A9C3EC618}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{749C9290-3433-4E71-A854-8C66663572F0}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{749C9290-3433-4E71-A854-8C66663572F0}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7F7BCF1A-F63E-4C17-A380-F0FD39C403D4}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7F7BCF1A-F63E-4C17-A380-F0FD39C403D4}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *

Namespace Provider 0: Tcpip
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP

Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS

Namespace Provider 2: Network Location Awareness (NLA) Namespace
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace

[ken545]

:snwelcome:


Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.

Besides Click. Giftload, your infected with a nasty Rootkit


This will remove Click.Giftload



REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-




Copy the entire contents inside the Quote box and Paste it into Notepad ( this will only work with Notepad ) name the file Regfix.reg and in the drop down box, save it as All Files. Save it to your desktop. Then Rightclick on the Regfix.reg file and click on Merge, when it asks you to merge with the Registry, say yes.

If you saved the file correctly it should look like this http://i24.photobucket.com/albums/c30/ken545/reg.jpg




Download aswMBR.exe (http://public.avast.com/~gmerek/aswMBR.exe) ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
http://public.avast.com/~gmerek/aswMBR1.png

On completion of the scan click save log, save it to your desktop and post in your next reply
http://public.avast.com/~gmerek/aswMBR2.png

[Jak P]

Thanks so much ken545, that's great. I've done the registry item, but http://public.avast.com/~gmerek/aswMBR.exe keeps giving 'problem loading page' so will continue to try downloading it.

[ken545]

See if this will run

Please download TDSSKiller.zip (http://support.kaspersky.com/downloads/utils/tdsskiller.zip)
Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan

Only if Malicious objects are found then ensure Cure is selected
Then click Continue > Reboot now

Copy and paste the log in your next reply

A copy of the log will be saved automatically to the root of the drive (typically C:\)

[Jak P]

Thanks Ken545, all done as instructed, I've been able to download and run both those programs, logs below

Just to mention I have Spybot (up to date) with Resident/Teatimer on; AVG (updated) with Resident on - it has been picking up several viruses and quarantining some of them; ZoneAlarm on. If any of these should be off please tell me.

I ran TDSSKiller.exe twice by accident as at first I couldn't find the report (have now found it), with two reboots after cure. Both times it found malicious item and cured it, but evidently hadn't cured it as it showed on the second run again - don't know if it has yet as haven't run it again.

Thanks very much for your continuing help, much appreciated, Jak P

Logs:

(a) aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-20 14:08:52
-----------------------------
14:08:52.796 OS Version: Windows 5.1.2600 Service Pack 3
14:08:52.796 Number of processors: 1 586 0xD08
14:08:52.796 ComputerName: JOHN-48E4D4636A UserName: John
14:09:00.968 Initialize success
14:09:14.500 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
14:09:14.515 Disk 0 Vendor: HTS541060G9AT00 MB3OA60A Size: 57231MB BusType: 3
14:09:14.531 Device \Driver\atapi -> DriverStartIo 84af053b
14:09:16.546 Disk 0 MBR read successfully
14:09:16.546 Disk 0 MBR scan
14:09:16.546 Disk 0 TDL4@MBR code has been found
14:09:16.546 Disk 0 Windows XP default MBR code found via API
14:09:16.546 Disk 0 MBR hidden
14:09:16.546 Disk 0 MBR [TDL4] **ROOTKIT**
14:09:16.546 Disk 0 trace - called modules:
14:09:16.546 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x84af06f0]<<
14:09:16.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84b6eab8]
14:09:16.546 3 CLASSPNP.SYS[f7734fd7] -> nt!IofCallDriver -> \Device\00000073[0x84b709e8]
14:09:16.546 5 ACPI.sys[f76ab620] -> nt!IofCallDriver -> [0x84bc9940]
14:09:16.593 \Driver\atapi[0x84b7ff38] -> IRP_MJ_CREATE -> 0x84af06f0
14:09:16.609 Scan finished successfully
14:11:17.046 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\John\Desktop\MBR.dat"
14:11:17.078 The log file has been saved successfully to "C:\Documents and Settings\John\Desktop\aswMBR.txt"

(b) 2011/05/20 14:48:51.0343 2068 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29
2011/05/20 14:48:51.0625 2068 ================================================================================
2011/05/20 14:48:51.0625 2068 SystemInfo:
2011/05/20 14:48:51.0625 2068
2011/05/20 14:48:51.0625 2068 OS Version: 5.1.2600 ServicePack: 3.0
2011/05/20 14:48:51.0625 2068 Product type: Workstation
2011/05/20 14:48:51.0625 2068 ComputerName: JOHN-48E4D4636A
2011/05/20 14:48:51.0625 2068 UserName: John
2011/05/20 14:48:51.0625 2068 Windows directory: C:\WINDOWS
2011/05/20 14:48:51.0625 2068 System windows directory: C:\WINDOWS
2011/05/20 14:48:51.0625 2068 Processor architecture: Intel x86
2011/05/20 14:48:51.0625 2068 Number of processors: 1
2011/05/20 14:48:51.0625 2068 Page size: 0x1000
2011/05/20 14:48:51.0625 2068 Boot type: Normal boot
2011/05/20 14:48:51.0625 2068 ================================================================================
2011/05/20 14:48:52.0031 2068 Initialize success
2011/05/20 14:49:13.0218 0140 ================================================================================
2011/05/20 14:49:13.0218 0140 Scan started
2011/05/20 14:49:13.0218 0140 Mode: Manual;
2011/05/20 14:49:13.0218 0140 ================================================================================
2011/05/20 14:49:13.0843 0140 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/05/20 14:49:13.0906 0140 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/05/20 14:49:14.0078 0140 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/05/20 14:49:14.0203 0140 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/05/20 14:49:14.0578 0140 ALCXWDM (95aa37bec6c72c277c2caeaee736dd2d) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2011/05/20 14:49:14.0984 0140 AR5416 (864160f5f4fbdd97b6a686854bfebd86) C:\WINDOWS\system32\DRIVERS\athw.sys
2011/05/20 14:49:15.0265 0140 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/05/20 14:49:15.0343 0140 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/05/20 14:49:15.0437 0140 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/05/20 14:49:15.0562 0140 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/05/20 14:49:15.0828 0140 AVGIDSDriver (0c61f066f4d94bd67063dc6691935143) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
2011/05/20 14:49:15.0890 0140 AVGIDSEH (84853f800cd69252c3c764fe50d0346f) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
2011/05/20 14:49:15.0968 0140 AVGIDSFilter (28d6adcd03e10f3838488b9b5d407dd4) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
2011/05/20 14:49:16.0062 0140 AVGIDSShim (0eb16f4dbbb946360af30d2b13a52d1d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
2011/05/20 14:49:16.0171 0140 Avgldx86 (5fe5a2c2330c376a1d8dcff8d2680a2d) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
2011/05/20 14:49:16.0281 0140 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
2011/05/20 14:49:16.0359 0140 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
2011/05/20 14:49:16.0453 0140 Avgtdix (660788ec46f10ece80274d564fa8b4aa) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
2011/05/20 14:49:16.0593 0140 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/05/20 14:49:17.0078 0140 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/05/20 14:49:17.0171 0140 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/05/20 14:49:17.0281 0140 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/05/20 14:49:17.0375 0140 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/05/20 14:49:17.0578 0140 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/05/20 14:49:17.0703 0140 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/05/20 14:49:18.0015 0140 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/05/20 14:49:18.0140 0140 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/05/20 14:49:18.0265 0140 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/05/20 14:49:18.0343 0140 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/05/20 14:49:18.0453 0140 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/05/20 14:49:18.0625 0140 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/05/20 14:49:18.0984 0140 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/05/20 14:49:19.0109 0140 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/05/20 14:49:19.0187 0140 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/05/20 14:49:19.0250 0140 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/05/20 14:49:19.0312 0140 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/05/20 14:49:19.0375 0140 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/05/20 14:49:19.0453 0140 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/05/20 14:49:19.0562 0140 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/05/20 14:49:19.0656 0140 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/05/20 14:49:19.0843 0140 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/05/20 14:49:20.0062 0140 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/05/20 14:49:20.0171 0140 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/05/20 14:49:20.0406 0140 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/05/20 14:49:20.0484 0140 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/05/20 14:49:20.0562 0140 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/05/20 14:49:20.0609 0140 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/05/20 14:49:20.0703 0140 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/05/20 14:49:20.0750 0140 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/05/20 14:49:20.0828 0140 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/05/20 14:49:20.0890 0140 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/05/20 14:49:21.0015 0140 ISWKL (5c7c9ea45700f5187f71eb7b0dab18c5) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
2011/05/20 14:49:21.0140 0140 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/05/20 14:49:21.0187 0140 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/05/20 14:49:21.0281 0140 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/05/20 14:49:21.0390 0140 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/05/20 14:49:21.0703 0140 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/05/20 14:49:21.0812 0140 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/05/20 14:49:21.0906 0140 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/05/20 14:49:22.0031 0140 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/05/20 14:49:22.0093 0140 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/05/20 14:49:22.0218 0140 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/05/20 14:49:22.0296 0140 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/05/20 14:49:22.0375 0140 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/05/20 14:49:22.0484 0140 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/05/20 14:49:22.0546 0140 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/05/20 14:49:22.0640 0140 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/05/20 14:49:22.0734 0140 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/05/20 14:49:22.0796 0140 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/05/20 14:49:22.0906 0140 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/05/20 14:49:22.0968 0140 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/05/20 14:49:23.0015 0140 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/05/20 14:49:23.0093 0140 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/05/20 14:49:23.0281 0140 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/05/20 14:49:23.0406 0140 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/05/20 14:49:23.0515 0140 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/05/20 14:49:23.0593 0140 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/05/20 14:49:23.0671 0140 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/05/20 14:49:23.0765 0140 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/05/20 14:49:23.0859 0140 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/05/20 14:49:23.0921 0140 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/05/20 14:49:24.0000 0140 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/05/20 14:49:24.0062 0140 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/05/20 14:49:24.0171 0140 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/05/20 14:49:24.0234 0140 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/05/20 14:49:24.0750 0140 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/05/20 14:49:24.0828 0140 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/05/20 14:49:24.0890 0140 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/05/20 14:49:25.0250 0140 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/05/20 14:49:25.0359 0140 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/05/20 14:49:25.0500 0140 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/05/20 14:49:25.0546 0140 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/05/20 14:49:25.0609 0140 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/05/20 14:49:25.0718 0140 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/05/20 14:49:25.0812 0140 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/05/20 14:49:25.0906 0140 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
2011/05/20 14:49:25.0984 0140 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2011/05/20 14:49:26.0125 0140 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/05/20 14:49:26.0250 0140 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/05/20 14:49:26.0328 0140 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/05/20 14:49:26.0390 0140 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/05/20 14:49:26.0453 0140 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/05/20 14:49:26.0687 0140 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/05/20 14:49:26.0796 0140 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/05/20 14:49:26.0937 0140 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/05/20 14:49:27.0062 0140 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
2011/05/20 14:49:27.0234 0140 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/05/20 14:49:27.0343 0140 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/05/20 14:49:27.0828 0140 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/05/20 14:49:27.0968 0140 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/05/20 14:49:28.0062 0140 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/05/20 14:49:28.0140 0140 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/05/20 14:49:28.0218 0140 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/05/20 14:49:28.0421 0140 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/05/20 14:49:28.0625 0140 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/05/20 14:49:28.0765 0140 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/05/20 14:49:28.0812 0140 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/05/20 14:49:28.0890 0140 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/05/20 14:49:28.0953 0140 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/05/20 14:49:29.0046 0140 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/05/20 14:49:29.0171 0140 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/05/20 14:49:29.0265 0140 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/05/20 14:49:29.0468 0140 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/05/20 14:49:29.0609 0140 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/05/20 14:49:29.0750 0140 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
2011/05/20 14:49:29.0937 0140 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/05/20 14:49:30.0109 0140 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/05/20 14:49:30.0343 0140 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/05/20 14:49:30.0468 0140 WSIMD (7a36f3083e28405d6c5ecdb942513c3b) C:\WINDOWS\system32\DRIVERS\wsimd.sys
2011/05/20 14:49:30.0687 0140 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/05/20 14:49:30.0703 0140 ================================================================================
2011/05/20 14:49:30.0703 0140 Scan finished
2011/05/20 14:49:30.0703 0140 ================================================================================
2011/05/20 14:49:30.0750 1096 Detected object count: 1
2011/05/20 14:49:42.0812 1096 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/20 14:49:42.0812 1096 \HardDisk0 - ok
2011/05/20 14:49:42.0812 1096 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/05/20 14:49:48.0203 1184 Deinitialize success

[ken545]

Go ahead and run aswMBR again, just to scan, not to fix and post the new log please

Please download Malwarebytes from Here (http://www.malwarebytes.org/mbam-download.php) or Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)


Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
http://i24.photobucket.com/albums/c30/ken545/MBAMCapture.jpg
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please

[Jak P]

Thank you ken545, done both those things aswMBR scan and Malwarebytes quick scan and remove infected. Logs below, thanks Jak P:

(a) aswMBR log

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-20 17:22:07
-----------------------------
17:22:07.500 OS Version: Windows 5.1.2600 Service Pack 3
17:22:07.500 Number of processors: 1 586 0xD08
17:22:07.500 ComputerName: JOHN-48E4D4636A UserName: John
17:22:08.765 Initialize success
17:22:13.546 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
17:22:13.562 Disk 0 Vendor: HTS541060G9AT00 MB3OA60A Size: 57231MB BusType: 3
17:22:13.718 Disk 0 MBR read successfully
17:22:13.734 Disk 0 MBR scan
17:22:13.750 Disk 0 Windows XP default MBR code
17:22:15.765 Disk 0 scanning sectors +117210240
17:22:15.906 Disk 0 scanning C:\WINDOWS\system32\drivers
17:22:24.078 Service scanning
17:22:25.187 Disk 0 trace - called modules:
17:22:25.218 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
17:22:25.234 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84b6eab8]
17:22:25.250 3 CLASSPNP.SYS[f7734fd7] -> nt!IofCallDriver -> \Device\00000073[0x84b709e8]
17:22:25.281 5 ACPI.sys[f76ab620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x84bc9940]
17:22:25.296 Scan finished successfully
17:22:34.046 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\John\Desktop\MBR.dat"
17:22:34.125 The log file has been saved successfully to "C:\Documents and Settings\John\Desktop\aswMBR.txt"
17:23:27.781 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\John\Desktop\MBR.dat"
17:23:28.921 The log file has been saved successfully to "C:\Documents and Settings\John\Desktop\aswMBR.txt"

(b) Malwarebytes log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6628

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

20/05/2011 17:36:14
mbam-log-2011-05-20 (17-36-14).txt

Scan type: Quick scan
Objects scanned: 137360
Time elapsed: 5 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WORT (Trojan.Vilsel) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

END

[ken545]

Looking good, how are things running now, any redirects or unwanted pop up windows ?

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.



Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://eset.com/onlinescan)
Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetOnline.png button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
Click on http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
Double click on the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstallDesktopIcon.png icon on your desktop.

Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetAcceptTerms.png
Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetStart.png button.
Accept any security warnings from your browser.
Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetScanArchives.png
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png
Push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png, and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetBack.png button.
Push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetFinish.png
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

[Jak P]

Thank you ken 345.

Replying to questions: no redirects or unwanted pop up windows ?

I deleted all items from the AVG virus vault and ran AVG scan - clean. Ran Spybot scan clean. I then disabled them both as requested and disabled Zone Alarm. I've installed and run ESET as requested and it has brought up a threat item. Report below:

ESET Scan log:

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\1KXA88CB\index[1].htm JS/Kryptik.AI trojan

Thanks very much for your continuing help

[Jak P]

ken545:

Correcting the last post: There's a question mark that shouldn't be there. The reply is there have been no redirects or unwanted pop ups. The rest is correct.

[ken545]

That threat is in your Temporary Internet Files, we need to flush it all out

Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.



With the seriousness of this threat lets make sure there is no more lurking

Download ComboFix from one of these locations:

Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)


* IMPORTANT !!! Save ComboFix.exe to your Desktop


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link (http://www.bleepingcomputer.com/forums/topic114351.html) for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.


Double click on ComboFix.exe & follow the prompts.


As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.


Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



http://img.photobucket.com/albums/v706/ried7/RC1.png


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v706/ried7/RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[Jak P]

Thank you.

I downloaded and ran ATF Cleaner.

I downloaded ComboFix. Unfortunately I can't run it. It said to uninstall AVG. I uninstalled AVG but bits of it (about 143 of them using Search 'avg') remained. I deleted as many of these as I could - it left a lot of them saying 'access denied', and rebooted. ComboFix loads but won't run, it says it won't run with AVG installed. AVG isn't installed any more, but ComboFix still won't run.

[ken545]

My bad on this one, Combofix will not run with AVG running, you need to uninstall it, then run CF again and post the log. You can do this via Add Remove programs in the Control Panel, we will reinstall this when where done

[Jak P]

Thank you ken545.

Unfortunately I can't get ComboFix to work.

I uninstalled AVG using its uninstall option then manually removed as much as possible (as previous post). After a couple of reboots ComboFix then started working. It downloaded the Windows item. Then it brought up a blue screen saying that it usually takes 10 minutes to run. I left it running overnight. Nothing. Tried it a few other times - it froze after a while each time, so I had to pull the battery out to restart the computer (it's a laptop). It doesn't complete, just sticks with the blue screen saying it takes 10 minutes to run.

[ken545]

Lets try a few things

Make sure AVG is uninstalled


Please download exeHelper (http://www.raktor.net/exeHelper/exeHelper.com) to your desktop.

Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).




Then drag Combofix to the trash and redownload it but do it this way

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)


http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_FF.gif


http://i266.photobucket.com/albums/ii277/sUBs_/combofix/CF_download_rename.gif

* IMPORTANT !!! Save ComboFix.exe to your Desktop


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link (http://www.bleepingcomputer.com/forums/topic114351.html) for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.


Double click on ComboFix.exe & follow the prompts.


As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.


Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



http://img.photobucket.com/albums/v706/ried7/RC1.png


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v706/ried7/RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[Jak P]

Thank you ken545. I didn't see that last post from you until being able to get to another computer with web access just now. In the meantime, because of the freezing and CombiFix problems, I thought it best to do a clean install of the operating system. I wiped/reformatted the hard drive removing the operating system / everything and reinstalled (genuine) XP from the original disk. I'm getting it reconnected to the internet at the moment when I can work out how to do that, then installing the XP updates and Firefox. That should be completely clean when it's finished and CombiFix shouldn't then be needed. Could you advise what I should run to send you a log to double-check that it's clean, and then the prevention measures to keep it clean? Thanks very much Jay P

[ken545]

Hey,

Sometimes a format and clean install is the way to go . If you need help with this then post here
http://forums.whatthetech.com/index.php?showforum=119


When your up and running just a DDS log will be fine

Download DDS from one of the links below to your desktop

Link 1 (http://download.bleepingcomputer.com/sUBs/dds.scr)
Link 2 (http://download.bleepingcomputer.com/sUBs/dds.com)


Double click the tool to run it.
A black Screen will open, just read the contents and do nothing.
When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
Copy/Paste the contents of 'DDS.txt' into your post.
'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files) (http://windows.microsoft.com/en-us/windows-vista/Compress-and-uncompress-files-zip-files)

[Jak P]

Thanks very much ken545. I've attached the DDS attach file and the log is pasted below. These are of course from the computer which had the problem, but I can't access http://forums.spybot.info from it, so have had to use a memory stick to take the DDS program to it, and to take the logs back to another computer to send to you. On the computer which had the problem I've only installed XP and all its updates, including IE 8; and Firefox. Neither Firefox nor IE8 will open the spybot forums. The message is respectively 'Server not found' and 'Internet Explorer cannot display the webpage'. The two browsers easily access the internet apart from this. Is there a setting in the browsers which I need to adjust?

And is the computer now all clear? If so what safety items should I install?

Thanks very much for all your kind help. Jak P


DDS log
.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Jay at 13:44:50 on 2011-05-27
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.707 [GMT 1:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\WINDOWS\system32\wscntfy.exe
E:\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1306354945386
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1306360807968
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jay\application data\mozilla\firefox\profiles\aa06xmfg.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2011-05-27 12:19:09 -------- d-sh--w- c:\documents and settings\jay\IECompatCache
2011-05-27 12:04:32 -------- d-----w- c:\documents and settings\jay\local settings\application data\Mozilla
2011-05-27 11:56:48 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2011-05-27 11:56:47 274288 ----a-w- c:\windows\system32\mucltui.dll
2011-05-25 21:43:31 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2011-05-25 21:43:13 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2011-05-25 21:42:42 978944 -c----w- c:\windows\system32\dllcache\mfc42.dll
2011-05-25 21:42:42 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2011-05-25 21:41:48 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\scripting
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\en
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\bits
2011-05-25 21:23:50 -------- d-----w- c:\windows\l2schemas
2011-05-25 21:19:45 -------- d-----w- c:\windows\network diagnostic
2011-05-25 21:18:13 -------- d-----w- c:\windows\system32\ReinstallBackups
2011-05-25 21:09:18 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2011-05-25 20:58:26 -------- d-sh--w- c:\documents and settings\jay\PrivacIE
2011-05-25 20:57:55 -------- d-sh--w- c:\documents and settings\jay\IETldCache
2011-05-25 20:49:56 -------- d-----w- c:\windows\ie8updates
2011-05-25 20:49:50 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-05-25 20:49:49 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-05-25 20:49:49 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-05-25 20:49:49 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-05-25 20:49:49 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-05-25 20:49:49 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-05-25 20:49:49 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-05-25 20:48:35 -------- dc-h--w- c:\windows\ie8
2011-05-25 20:42:48 -------- d-----w- c:\windows\ServicePackFiles
2011-05-25 20:38:59 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2011-05-25 20:37:25 293376 ------w- c:\windows\system32\browserchoice.exe
2011-05-25 20:36:23 455936 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-05-25 20:36:03 357888 -c----w- c:\windows\system32\dllcache\srv.sys
2011-05-25 20:35:19 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2011-05-25 20:35:19 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2011-05-25 20:35:11 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-05-25 20:30:09 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2011-05-25 20:29:23 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-05-25 20:29:22 272128 ------w- c:\windows\system32\drivers\bthport.sys
2011-05-25 20:29:19 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2011-05-25 20:26:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2011-05-25 20:26:20 -------- d-----w- c:\windows\system32\PreInstall
2011-05-25 20:26:19 -------- d--h--w- c:\windows\$hf_mig$
2011-05-25 20:23:42 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2011-05-25 20:23:42 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2011-05-25 20:23:42 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2011-05-25 20:23:42 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2011-05-25 20:23:41 -------- d-----w- c:\windows\system32\SoftwareDistribution
2011-05-25 20:18:23 -------- d-sh--w- c:\documents and settings\jay\UserData
2011-05-25 20:15:58 58208 ----a-w- c:\windows\system32\wsimd.sys
2011-05-25 20:15:58 58208 ----a-w- c:\windows\system32\drivers\wsimd.sys
2011-05-25 20:15:50 1503840 ----a-w- c:\windows\system32\drivers\athw.sys
2011-05-25 20:15:49 -------- d-----w- c:\program files\Atheros
2011-05-25 20:15:48 -------- d-----w- c:\documents and settings\all users\application data\Atheros
2011-05-25 20:15:43 -------- d-----w- c:\documents and settings\jay\application data\WinBatch
2011-05-25 18:27:24 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-05-25 18:27:22 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-05-25 18:27:11 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-05-25 18:27:11 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-05-25 18:27:08 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-05-25 18:27:04 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
.
==================== Find3M ====================
.
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 13:45:39.89 ===============

[Jak P]

Sorry forgot to attach the DDS attach file with last post, here it is.

[ken545]

Let me ask you, can you access other sites or is it just this forum, are you connected to a router ?

Lets reset your hosts file and see if it helps

Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)

In the window under Custom Scans/Fixes copy and paste the following text in the Quote box



:OTL

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[RESETHOSTS]
[start explorer]
[Reboot]




Click the Run Fix button. ( NOT RUN SCAN )Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

[Jak P]

Thank you ken545.

Well, that problem is solved! Before getting your reply I installed CCleaner and got it to clean out everything including wiping the free space. Whether from that or not the computer which had the problem now freely accesses the forum both with Firefox and with IE8, and I'm using it now. So therefore I have not downloaded OTL.

[To answer your questions: yes I could access other sites, it was just this forum it wouldn't connect to; and I'm not connected to a router, I am using wifi].

So I've now directly downloaded DDS to the computer which had the problem, and have rerun it. I've pasted the new log and attached the attach file. Apologies for any confusion! Please let me know if the scans show anything and if not, what protection to apply - many thanks.

Latest DDS log:

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Jay at 15:53:43 on 2011-05-27
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.704 [GMT 1:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jay\Desktop\dds.scr
C:\WINDOWS\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1306354945386
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1306360807968
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jay\application data\mozilla\firefox\profiles\aa06xmfg.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2011-05-27 13:46:14 -------- d-----w- c:\program files\CCleaner
2011-05-27 12:19:09 -------- d-sh--w- c:\documents and settings\jay\IECompatCache
2011-05-27 12:04:32 -------- d-----w- c:\documents and settings\jay\local settings\application data\Mozilla
2011-05-27 11:56:48 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2011-05-27 11:56:47 274288 ----a-w- c:\windows\system32\mucltui.dll
2011-05-25 21:43:31 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2011-05-25 21:43:13 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2011-05-25 21:42:42 978944 -c----w- c:\windows\system32\dllcache\mfc42.dll
2011-05-25 21:42:42 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2011-05-25 21:41:48 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\scripting
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\en
2011-05-25 21:23:50 -------- d-----w- c:\windows\system32\bits
2011-05-25 21:23:50 -------- d-----w- c:\windows\l2schemas
2011-05-25 21:19:45 -------- d-----w- c:\windows\network diagnostic
2011-05-25 21:18:13 -------- d-----w- c:\windows\system32\ReinstallBackups
2011-05-25 21:09:18 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2011-05-25 20:58:26 -------- d-sh--w- c:\documents and settings\jay\PrivacIE
2011-05-25 20:57:55 -------- d-sh--w- c:\documents and settings\jay\IETldCache
2011-05-25 20:49:56 -------- d-----w- c:\windows\ie8updates
2011-05-25 20:49:50 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-05-25 20:49:49 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-05-25 20:49:49 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-05-25 20:49:49 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-05-25 20:49:49 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-05-25 20:49:49 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-05-25 20:49:49 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-05-25 20:48:35 -------- dc-h--w- c:\windows\ie8
2011-05-25 20:42:48 -------- d-----w- c:\windows\ServicePackFiles
2011-05-25 20:38:59 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2011-05-25 20:37:25 293376 ------w- c:\windows\system32\browserchoice.exe
2011-05-25 20:36:23 455936 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-05-25 20:36:03 357888 -c----w- c:\windows\system32\dllcache\srv.sys
2011-05-25 20:35:19 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2011-05-25 20:35:19 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2011-05-25 20:35:11 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-05-25 20:30:09 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2011-05-25 20:29:23 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-05-25 20:29:22 272128 ------w- c:\windows\system32\drivers\bthport.sys
2011-05-25 20:29:19 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2011-05-25 20:26:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2011-05-25 20:26:20 -------- d-----w- c:\windows\system32\PreInstall
2011-05-25 20:26:19 -------- d--h--w- c:\windows\$hf_mig$
2011-05-25 20:23:42 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2011-05-25 20:23:42 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2011-05-25 20:23:42 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2011-05-25 20:23:42 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2011-05-25 20:23:41 -------- d-----w- c:\windows\system32\SoftwareDistribution
2011-05-25 20:18:23 -------- d-sh--w- c:\documents and settings\jay\UserData
2011-05-25 20:15:58 58208 ----a-w- c:\windows\system32\wsimd.sys
2011-05-25 20:15:58 58208 ----a-w- c:\windows\system32\drivers\wsimd.sys
2011-05-25 20:15:50 1503840 ----a-w- c:\windows\system32\drivers\athw.sys
2011-05-25 20:15:49 -------- d-----w- c:\program files\Atheros
2011-05-25 20:15:48 -------- d-----w- c:\documents and settings\all users\application data\Atheros
2011-05-25 20:15:43 -------- d-----w- c:\documents and settings\jay\application data\WinBatch
2011-05-25 18:27:24 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-05-25 18:27:22 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-05-25 18:27:11 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-05-25 18:27:11 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-05-25 18:27:08 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-05-25 18:27:04 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
.
==================== Find3M ====================
.
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 15:54:25.54 ===============

[ken545]

Looks fine,


How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)



Safe Surfn
Ken

[Jak P]

Ken, thanks for all your patient help! Very much appreciated Jak P

[ken545]

Your very welcome :)

[ken545]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.