skookster
2011-07-20, 00:43
I'm getting Google redirects.
"Defender" has taken over the PC twice in the last few days. Both times I deleted it via Safe Mode.
Also having svchost memory leaks like crazy, but I don't expect that's in your power to address.
The machine:
XP SP3
Windows updates automatically
MS Security Essentials always running, automatic updates, quick scan nightly
uTorrent 2.2 downloads only from trusted trackers
Spyware Blaster updated weekly
CCleaner, Malware Bytes and Tweak Now have been run recently
To prepare for your analysis, I have:
executed MS Security Essentials full scan
executed ERUNT
disabled Tea Timer
ActiveX set to Prompt and Disable
Thanks
---
DDS (Ver_2011-07-14.01) - FAT32_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by Dee at 18:31:25 on 2011-07-19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.150 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
============== Running Processes ================
.
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\fsproflt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\IDrive\IDriveE Service.exe
C:\Program Files\Screen Saver Control\ScreenSaverControl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDrive\IDriveWebM.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.exe
C:\Program Files\KeyText\KeyText.exe
C:\Program Files\ProcessExplorer\procexp.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\IDrive\IDriveETray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\IDrive\IDriveEBackground.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = file:///C:/Program%20Files/Internet%20Explorer/Blank.htm
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - <orphaned>
BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - <orphaned>
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: {D4027C7F-154A-4066-A1AD-4243D8127440} - <orphaned>
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll
TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>
uRun: [IDriveE Startup] "c:\program files\idrive\IDrvieEStartup.exe" Hide
uRun: [Screen Saver Control] c:\program files\screen saver control\ScreenSaverControl.exe -quiet
uRun: [TClockEx] c:\program files\tclockex\TCLOCKEX.EXE
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Security Protection] c:\documents and settings\all users\application data\defender.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SystemTray] SysTray.Exe
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [mylbx] c:\program files\my lockbox\mylbx.exe /a
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [OneTouch Monitor] c:\progra~1\vision~1\ONETOU~2.EXE
StartupFolder: c:\docume~1\user\startm~1\programs\startup\keytext.lnk - c:\program files\keytext\KeyText.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\idrive~1.lnk - c:\program files\idrive\IDriveEReg2ini.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\screen~1.lnk - c:\program files\screen saver control\ScreenSaverControl.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\proces~1.lnk - c:\program files\processexplorer\procexp.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\firefox.lnk - c:\program files\mozilla firefox\firefox.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\fastst~1.lnk - c:\program files\faststone capture\FSCapture.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\calcul~1.lnk - c:\program files\moffsoft freecalc\MoffFreeCalc.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Lookup on Merriam Webster - c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1259632841390
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
TCP: NameServer = 68.87.71.230 68.87.73.246
TCP: Interfaces\{86C114B1-6950-47C6-80DA-7B658D817BE9} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{86C114B1-6950-47C6-80DA-7B658D817BE9} : DHCPNameServer = 68.87.71.230 68.87.73.246
TCP: Interfaces\{96FCD304-90F6-4C01-B894-28DC74FEEBAB} : NameServer = 208.67.222.222,208.67.220.220
Handler: ipp - <Clsid value has no data>
Handler: msdaipp - <Clsid value has no data>
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
IFEO: taskmgr.exe - "c:\program files\processexplorer\PROCEXP.EXE"
IFEO: Your Image File Name Here without a path - ntsd -d
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\61a6e9yd.default\
FF - prefs.js: browser.startup.homepage - file:///C:/Program%20Files/Mozilla%20Firefox/blank-navy.htm
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\61a6e9yd.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\documents and settings\user\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\sony\reader\data\bin\npebldetectmoz.dll
.
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
============= SERVICES / DRIVERS ===============
.
R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2010-10-8 41912]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165264]
R1 MpKsl7392fc0d;MpKsl7392fc0d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\MpKsl7392fc0d.sys [2011-7-19 28752]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2010-10-8 142648]
R2 IDriveE Service;IDriveE Service;c:\program files\idrive\IDriveE Service.exe [2009-11-30 143360]
R2 IDriveWebM;IDrive WebManager;c:\program files\idrive\IDriveWebM.exe [2009-11-30 118784]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-1 10384]
S1 MpKsl031cff38;MpKsl031cff38;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41958ae7-d159-493a-af50-86f886f90271}\mpksl031cff38.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41958ae7-d159-493a-af50-86f886f90271}\MpKsl031cff38.sys [?]
S1 MpKsl181993ed;MpKsl181993ed;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8f2834f7-7df2-4456-a678-8d594cebdf1d}\mpksl181993ed.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8f2834f7-7df2-4456-a678-8d594cebdf1d}\MpKsl181993ed.sys [?]
S1 MpKsl1dfc68cd;MpKsl1dfc68cd;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\mpksl1dfc68cd.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\MpKsl1dfc68cd.sys [?]
S1 MpKsl4b5e7a29;MpKsl4b5e7a29;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c91156f9-9ada-4273-b585-31c251c5ce5c}\mpksl4b5e7a29.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c91156f9-9ada-4273-b585-31c251c5ce5c}\MpKsl4b5e7a29.sys [?]
S1 MpKsl4cd0e030;MpKsl4cd0e030;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{12166d97-593b-409d-9877-945ee790a7e6}\mpksl4cd0e030.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{12166d97-593b-409d-9877-945ee790a7e6}\MpKsl4cd0e030.sys [?]
S1 MpKsl61f0b96a;MpKsl61f0b96a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea61a01d-c928-47bc-80f7-8a45fb1d348b}\mpksl61f0b96a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea61a01d-c928-47bc-80f7-8a45fb1d348b}\MpKsl61f0b96a.sys [?]
S1 MpKsl7422c9be;MpKsl7422c9be;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\mpksl7422c9be.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\MpKsl7422c9be.sys [?]
S1 MpKsl7a0a5f84;MpKsl7a0a5f84;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{79f7eef1-1087-4dbc-9c2c-da41adf5be4b}\mpksl7a0a5f84.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{79f7eef1-1087-4dbc-9c2c-da41adf5be4b}\MpKsl7a0a5f84.sys [?]
S1 MpKsl7ff50370;MpKsl7ff50370;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{017c2bef-3849-470f-8432-e6cbf104c660}\mpksl7ff50370.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{017c2bef-3849-470f-8432-e6cbf104c660}\MpKsl7ff50370.sys [?]
S1 MpKsl9e731847;MpKsl9e731847;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95d708e9-e6d6-41fd-9cbd-46e3f9280a10}\mpksl9e731847.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95d708e9-e6d6-41fd-9cbd-46e3f9280a10}\MpKsl9e731847.sys [?]
S1 MpKslbe01cc62;MpKslbe01cc62;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9bf0e77e-a687-41f0-9654-82ca5b263d51}\mpkslbe01cc62.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9bf0e77e-a687-41f0-9654-82ca5b263d51}\MpKslbe01cc62.sys [?]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2009-12-15 38976]
.
=============== File Associations ===============
.
ShellExec: AcroRd32.exe: print="c:\program files\adobe\acrobat 4.0\reader\AcroRd32.exe"
ShellExec: AcroRd32.exe: printto="c:\program files\adobe\acrobat 4.0\reader\AcroRd32.exe"
ShellExec: Foxit Reader.exe: print="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/p "%1"
ShellExec: Foxit Reader.exe: printto="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/t "%1" "%2" "%3" "%4"
.
=============== Created Last 30 ================
.
2011-07-19 15:22:57 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\MpKsl7392fc0d.sys
2011-07-19 15:20:59 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\mpengine.dll
2011-07-17 19:23:36 -------- d-sh--w- C:\FOUND.026
2011-07-17 17:18:58 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-07-17 17:18:58 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-12 18:58:00 -------- d-----w- c:\documents and settings\user\application data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
2011-07-12 18:57:50 -------- d-----w- c:\program files\TweetDeck
2011-07-12 18:57:05 -------- d-----w- c:\documents and settings\user\local settings\application data\Adobe
2011-07-11 21:48:12 12800 ----a-w- c:\program files\mozilla firefox\plugins\npwachk.dll
2011-07-11 14:59:45 -------- d-----w- c:\documents and settings\user\application data\KDE
2011-07-11 14:59:34 -------- d-----w- c:\program files\KDE
2011-07-09 19:56:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-07-09 19:50:19 -------- d-----w- c:\documents and settings\all users\application data\PDF reDirect
2011-07-09 19:47:03 -------- d-----w- c:\documents and settings\user\application data\PDF reDirect
2011-07-09 19:46:52 -------- d-----w- c:\program files\PDF reDirect
2011-07-09 03:53:54 -------- d-----w- c:\windows\SxsCaPendDel
2011-07-04 04:42:45 -------- d-----w- c:\program files\Revo Uninstaller
2011-07-04 00:46:10 -------- d-sh--w- C:\FOUND.025
2011-06-28 03:57:25 -------- d-----w- C:\ProcAlyzer Dumps
2011-06-26 07:06:13 -------- d-----w- c:\documents and settings\user\application data\IObit
2011-06-26 03:15:40 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-26 03:15:39 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-21 03:51:44 -------- d-sh--w- C:\FOUND.024
.
==================== Find3M ====================
.
2011-07-06 23:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-11 00:19:52 770384 ----a-w- c:\windows\system32\msvcr100.dll
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:28 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:44 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:12 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:12 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:44 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 18:32:20.14 ===============
"Defender" has taken over the PC twice in the last few days. Both times I deleted it via Safe Mode.
Also having svchost memory leaks like crazy, but I don't expect that's in your power to address.
The machine:
XP SP3
Windows updates automatically
MS Security Essentials always running, automatic updates, quick scan nightly
uTorrent 2.2 downloads only from trusted trackers
Spyware Blaster updated weekly
CCleaner, Malware Bytes and Tweak Now have been run recently
To prepare for your analysis, I have:
executed MS Security Essentials full scan
executed ERUNT
disabled Tea Timer
ActiveX set to Prompt and Disable
Thanks
---
DDS (Ver_2011-07-14.01) - FAT32_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by Dee at 18:31:25 on 2011-07-19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.150 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
============== Running Processes ================
.
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\fsproflt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\IDrive\IDriveE Service.exe
C:\Program Files\Screen Saver Control\ScreenSaverControl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDrive\IDriveWebM.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Moffsoft FreeCalc\MoffFreeCalc.exe
C:\Program Files\KeyText\KeyText.exe
C:\Program Files\ProcessExplorer\procexp.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\IDrive\IDriveETray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\IDrive\IDriveEBackground.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uStart Page = file:///C:/Program%20Files/Internet%20Explorer/Blank.htm
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - <orphaned>
BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - <orphaned>
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: {D4027C7F-154A-4066-A1AD-4243D8127440} - <orphaned>
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll
TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - c:\program files\orbitdownloader\GrabPro.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>
uRun: [IDriveE Startup] "c:\program files\idrive\IDrvieEStartup.exe" Hide
uRun: [Screen Saver Control] c:\program files\screen saver control\ScreenSaverControl.exe -quiet
uRun: [TClockEx] c:\program files\tclockex\TCLOCKEX.EXE
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Security Protection] c:\documents and settings\all users\application data\defender.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SystemTray] SysTray.Exe
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [mylbx] c:\program files\my lockbox\mylbx.exe /a
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [OneTouch Monitor] c:\progra~1\vision~1\ONETOU~2.EXE
StartupFolder: c:\docume~1\user\startm~1\programs\startup\keytext.lnk - c:\program files\keytext\KeyText.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\idrive~1.lnk - c:\program files\idrive\IDriveEReg2ini.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\screen~1.lnk - c:\program files\screen saver control\ScreenSaverControl.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\proces~1.lnk - c:\program files\processexplorer\procexp.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\firefox.lnk - c:\program files\mozilla firefox\firefox.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\fastst~1.lnk - c:\program files\faststone capture\FSCapture.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\calcul~1.lnk - c:\program files\moffsoft freecalc\MoffFreeCalc.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Lookup on Merriam Webster - c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1259632841390
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
TCP: NameServer = 68.87.71.230 68.87.73.246
TCP: Interfaces\{86C114B1-6950-47C6-80DA-7B658D817BE9} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{86C114B1-6950-47C6-80DA-7B658D817BE9} : DHCPNameServer = 68.87.71.230 68.87.73.246
TCP: Interfaces\{96FCD304-90F6-4C01-B894-28DC74FEEBAB} : NameServer = 208.67.222.222,208.67.220.220
Handler: ipp - <Clsid value has no data>
Handler: msdaipp - <Clsid value has no data>
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
IFEO: taskmgr.exe - "c:\program files\processexplorer\PROCEXP.EXE"
IFEO: Your Image File Name Here without a path - ntsd -d
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\61a6e9yd.default\
FF - prefs.js: browser.startup.homepage - file:///C:/Program%20Files/Mozilla%20Firefox/blank-navy.htm
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\61a6e9yd.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\documents and settings\user\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\sony\reader\data\bin\npebldetectmoz.dll
.
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
============= SERVICES / DRIVERS ===============
.
R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2010-10-8 41912]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165264]
R1 MpKsl7392fc0d;MpKsl7392fc0d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\MpKsl7392fc0d.sys [2011-7-19 28752]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2010-10-8 142648]
R2 IDriveE Service;IDriveE Service;c:\program files\idrive\IDriveE Service.exe [2009-11-30 143360]
R2 IDriveWebM;IDrive WebManager;c:\program files\idrive\IDriveWebM.exe [2009-11-30 118784]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-1 10384]
S1 MpKsl031cff38;MpKsl031cff38;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41958ae7-d159-493a-af50-86f886f90271}\mpksl031cff38.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{41958ae7-d159-493a-af50-86f886f90271}\MpKsl031cff38.sys [?]
S1 MpKsl181993ed;MpKsl181993ed;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8f2834f7-7df2-4456-a678-8d594cebdf1d}\mpksl181993ed.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8f2834f7-7df2-4456-a678-8d594cebdf1d}\MpKsl181993ed.sys [?]
S1 MpKsl1dfc68cd;MpKsl1dfc68cd;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\mpksl1dfc68cd.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\MpKsl1dfc68cd.sys [?]
S1 MpKsl4b5e7a29;MpKsl4b5e7a29;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c91156f9-9ada-4273-b585-31c251c5ce5c}\mpksl4b5e7a29.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c91156f9-9ada-4273-b585-31c251c5ce5c}\MpKsl4b5e7a29.sys [?]
S1 MpKsl4cd0e030;MpKsl4cd0e030;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{12166d97-593b-409d-9877-945ee790a7e6}\mpksl4cd0e030.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{12166d97-593b-409d-9877-945ee790a7e6}\MpKsl4cd0e030.sys [?]
S1 MpKsl61f0b96a;MpKsl61f0b96a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea61a01d-c928-47bc-80f7-8a45fb1d348b}\mpksl61f0b96a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ea61a01d-c928-47bc-80f7-8a45fb1d348b}\MpKsl61f0b96a.sys [?]
S1 MpKsl7422c9be;MpKsl7422c9be;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\mpksl7422c9be.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8564bbe1-c607-4b27-af53-58de05f04db4}\MpKsl7422c9be.sys [?]
S1 MpKsl7a0a5f84;MpKsl7a0a5f84;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{79f7eef1-1087-4dbc-9c2c-da41adf5be4b}\mpksl7a0a5f84.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{79f7eef1-1087-4dbc-9c2c-da41adf5be4b}\MpKsl7a0a5f84.sys [?]
S1 MpKsl7ff50370;MpKsl7ff50370;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{017c2bef-3849-470f-8432-e6cbf104c660}\mpksl7ff50370.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{017c2bef-3849-470f-8432-e6cbf104c660}\MpKsl7ff50370.sys [?]
S1 MpKsl9e731847;MpKsl9e731847;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95d708e9-e6d6-41fd-9cbd-46e3f9280a10}\mpksl9e731847.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{95d708e9-e6d6-41fd-9cbd-46e3f9280a10}\MpKsl9e731847.sys [?]
S1 MpKslbe01cc62;MpKslbe01cc62;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9bf0e77e-a687-41f0-9654-82ca5b263d51}\mpkslbe01cc62.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9bf0e77e-a687-41f0-9654-82ca5b263d51}\MpKslbe01cc62.sys [?]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2009-12-15 38976]
.
=============== File Associations ===============
.
ShellExec: AcroRd32.exe: print="c:\program files\adobe\acrobat 4.0\reader\AcroRd32.exe"
ShellExec: AcroRd32.exe: printto="c:\program files\adobe\acrobat 4.0\reader\AcroRd32.exe"
ShellExec: Foxit Reader.exe: print="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/p "%1"
ShellExec: Foxit Reader.exe: printto="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/t "%1" "%2" "%3" "%4"
.
=============== Created Last 30 ================
.
2011-07-19 15:22:57 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\MpKsl7392fc0d.sys
2011-07-19 15:20:59 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8d84bb94-70af-4875-9040-bf4ae81847f7}\mpengine.dll
2011-07-17 19:23:36 -------- d-sh--w- C:\FOUND.026
2011-07-17 17:18:58 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-07-17 17:18:58 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-12 18:58:00 -------- d-----w- c:\documents and settings\user\application data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
2011-07-12 18:57:50 -------- d-----w- c:\program files\TweetDeck
2011-07-12 18:57:05 -------- d-----w- c:\documents and settings\user\local settings\application data\Adobe
2011-07-11 21:48:12 12800 ----a-w- c:\program files\mozilla firefox\plugins\npwachk.dll
2011-07-11 14:59:45 -------- d-----w- c:\documents and settings\user\application data\KDE
2011-07-11 14:59:34 -------- d-----w- c:\program files\KDE
2011-07-09 19:56:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-07-09 19:50:19 -------- d-----w- c:\documents and settings\all users\application data\PDF reDirect
2011-07-09 19:47:03 -------- d-----w- c:\documents and settings\user\application data\PDF reDirect
2011-07-09 19:46:52 -------- d-----w- c:\program files\PDF reDirect
2011-07-09 03:53:54 -------- d-----w- c:\windows\SxsCaPendDel
2011-07-04 04:42:45 -------- d-----w- c:\program files\Revo Uninstaller
2011-07-04 00:46:10 -------- d-sh--w- C:\FOUND.025
2011-06-28 03:57:25 -------- d-----w- C:\ProcAlyzer Dumps
2011-06-26 07:06:13 -------- d-----w- c:\documents and settings\user\application data\IObit
2011-06-26 03:15:40 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-26 03:15:39 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-21 03:51:44 -------- d-sh--w- C:\FOUND.024
.
==================== Find3M ====================
.
2011-07-06 23:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-11 00:19:52 770384 ----a-w- c:\windows\system32\msvcr100.dll
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:28 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:44 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:12 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:12 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:44 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 18:32:20.14 ===============