Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Persistent Spyware or Virus (I'm Stumped!)

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. 2009-05-03, 00:38 #1
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default Persistent Spyware or Virus (I'm Stumped!)

    I have been trying to cleanse my laptop for days. I am having problems with browser redirects through clickcheck.ru. I have run a full virus scan with McAfee as well as scans with Spybot, Malwarebytes' Anti-malware, and SuperAntiSpyware. Still I am unable to rid myself of the issue. Through scans I have located and cleaned Virtumonde.sdn many times over as well as other trojans and registry entries. In the end though, the problems keep coming back. I am usually pretty good with this stuff, but this time I am stumped. Below is my HJT log. I have the logs from the other scans I have run if needed. Thanks a ton in advance!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:31:11 PM, on 5/2/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\mcshield.exe
    C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\ehome\RMSvc.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-18\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\2258903176.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\2258903176.exe (User 'Default user')
    O4 - S-1-5-18 Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'Default user')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
    O15 - Trusted Zone: http://springboard.uakron.edu
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1235024900343
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1235024556718
    O16 - DPF: {B2FCED61-570E-11D3-B160-00A0C9E70E84} (OmniForm Form Control) - https://www4.lsac.org/LSACD_XMLWebSe...veX/ofmctl.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.11) - http://gameadvisor.futuremark.com/global/msc311.cab
    O20 - AppInit_DLLs: wbsys.dll c:\windows\system32\,C:\WINDOWS\system32\zulahigu.dll c:\windows\system32\fukafati.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    --
    End of file - 11472 bytes
  2. 2009-05-03, 12:06 #2
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi Elader

    Rename HijackThis.exe to Elader.exe and post back a fresh hijackthis log, please
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  3. 2009-05-03, 18:16 #3
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default

    Hi Shaba!

    Here is the new HJT log after renaming to elader.exe.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:15:36 PM, on 5/3/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\mcshield.exe
    C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\ehome\RMSvc.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Documents and Settings\Owner\Desktop\elader.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-18\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\2258903176.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\2258903176.exe (User 'Default user')
    O4 - S-1-5-18 Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'Default user')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
    O15 - Trusted Zone: http://springboard.uakron.edu
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1235024900343
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1235024556718
    O16 - DPF: {B2FCED61-570E-11D3-B160-00A0C9E70E84} (OmniForm Form Control) - https://www4.lsac.org/LSACD_XMLWebSe...veX/ofmctl.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.11) - http://gameadvisor.futuremark.com/global/msc311.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    --
    End of file - 11215 bytes
  4. 2009-05-03, 18:18 #4
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Download gmer.zip and save to your desktop.
    alternate download site
    • Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.
    • When you have done this, disconnect from the Internet and close all running programs.
      There is a small chance this application may crash your computer so save any work you have open.
    • Double-click on Gmer.exe to start the program.
    • Allow the gmer.sys driver to load if asked.
    • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
    • Click on the Rootkit tab.
    • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
    • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
    • Click on the "Scan" and wait for the scan to finish.
      Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
    • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
    • Note: If you have any problems, try running GMER in SAFE MODE"

    Important! Please do not select the "Show all" checkbox during the scan..
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  5. 2009-05-03, 19:20 #5
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default

    The text makes the message size too large for one message and the txt file is too big to attach so I am splitting the file between two messages.

    GMER 1.0.15.14972 - http://www.gmer.net
    Rootkit scan 2009-05-03 13:15:16
    Windows 5.1.2600 Service Pack 3


    ---- System - GMER 1.0.15 ----

    INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F69194F6
    INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F691959C

    Code 8A6F4848 ZwEnumerateKey
    Code 8A7F9408 ZwFlushInstructionCache
    Code 8A7ECF6E IofCallDriver
    Code 8A7E6B16 IofCompleteRequest

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 8A7ECF73
    .text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 8A7E6B1B
    PAGE ntoskrnl.exe!ZwEnumerateKey 80570D64 5 Bytes JMP 8A6F484C
    PAGE ntoskrnl.exe!ZwFlushInstructionCache 80577693 5 Bytes JMP 8A7F940C

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\inetsrv\inetinfo.exe[188] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[244] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[444] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\services.exe[828] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\lsass.exe[840] WININET.dll!InternetOpenUrlA
  6. 2009-05-03, 19:21 #6
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default

    Part 2 of gmer log.

    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1004] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1108] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1152] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1392] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1460] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[1624] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\System32\svchost.exe[1924] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\svchost.exe[2192] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\Explorer.EXE[2384] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!ReadFile 7C801812 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!WriteFile 7C810E17 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!CreatePipe 7C81D827 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!PeekNamedPipe 7C860817 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] kernel32.dll!WinExec 7C8623AD 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] msvcrt.dll!system 77C293C7 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] msvcrt.dll!_creat 77C2D40F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] msvcrt.dll!_read 77C2FAA3 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] msvcrt.dll!_write 77C30303 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WS2_32.dll!select 71AB30A8 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WS2_32.dll!socket 71AB4211 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WS2_32.dll!bind 71AB4480 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WS2_32.dll!send 71AB4C27 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WS2_32.dll!recv 71AB676F 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WININET.dll!InternetReadFile 7806ABB4 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WININET.dll!InternetOpenA 7806C865 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)
    .text C:\WINDOWS\system32\dllhost.exe[3372] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes CALL 37001160 C:\WINDOWS\system32\EntApi.dll (EntAPI/Network Associates, Inc)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs naiavf5x.sys (Anti-Virus File System Filter Driver/Network Associates, Inc.)

    Device \FileSystem\Udfs \UdfsCdRom tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
    Device \FileSystem\meiudf \MeiUDF_Disk tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
    Device \FileSystem\meiudf \MeiUDF_CdRom tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
    Device \FileSystem\Udfs \UdfsDisk tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

    AttachedDevice \Driver\Tcpip \Device\Ip mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Tcp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Udp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
    AttachedDevice \Driver\Tcpip \Device\RawIp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)

    Device \FileSystem\cdudf_xp \Device\CdUdf_XP tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
    Device \FileSystem\Cdfs \Cdfs EB00B400

    ---- EOF - GMER 1.0.15 ----
  7. 2009-05-03, 20:58 #7
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default

    Here are the combofix.txt and new HJT log.

    ComboFix 09-05-02.4 - Owner 05/03/2009 13:51.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1381 [GMT -4:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\IE4 Error Log.txt
    c:\windows\system32\Cache

    .
    ((((((((((((((((((((((((( Files Created from 2009-04-03 to 2009-05-03 )))))))))))))))))))))))))))))))
    .

    2009-05-02 22:27 . 2009-05-02 22:27 -------- d-----w c:\program files\ERUNT
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\program files\SUPERAntiSpyware
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
    2009-04-29 01:02 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-04-29 01:02 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-23 05:49 . 2009-04-23 05:49 -------- d-----w c:\program files\Enlight
    2009-04-20 06:05 . 2009-04-20 06:05 -------- d-----w c:\program files\JoWooD
    2009-04-19 05:43 . 2009-04-19 05:44 -------- d-----w c:\documents and settings\Owner\Application Data\Stardock
    2009-04-19 05:43 . 2009-04-19 05:43 -------- d-----w c:\documents and settings\All Users\Application Data\Stardock
    2009-04-19 05:43 . 2009-04-19 05:43 -------- dc-h--w c:\documents and settings\All Users\Application Data\{1E77E486-38CF-4688-B1E4-B86D08856D09}
    2009-04-06 06:58 . 2009-04-06 06:58 -------- d-----w c:\documents and settings\Owner\Application Data\Acreon
    2009-04-06 06:58 . 2009-04-06 07:09 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\._Revolution_
    2009-04-06 04:32 . 2009-04-06 06:38 -------- d-----w c:\program files\UltimateBet
    2009-04-06 04:32 . 2009-04-06 04:32 -------- d-----w c:\program files\_uninstallation_info

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-03 17:57 . 2005-08-05 23:16 6 ---ha-w c:\windows\Tasks\SA.DAT
    2009-05-03 16:12 . 2009-03-02 21:06 422 ---ha-w c:\windows\Tasks\User_Feed_Synchronization-{79F80F27-C953-4849-B054-89AFF0A67371}.job
    2009-05-01 05:28 . 2006-10-31 22:15 -------- d-----w c:\program files\Viewpoint
    2009-04-19 05:43 . 2006-03-16 02:40 -------- d-----w c:\program files\Stardock
    2009-04-16 07:23 . 2006-01-26 06:47 -------- d-----w c:\program files\World of Warcraft
    2009-04-06 04:33 . 2007-07-11 02:29 -------- d-----w c:\program files\UBNet
    2009-03-30 06:43 . 2009-03-30 06:43 53760 ----a-w c:\windows\system32\drivers\SSHDRV76.sys
    2009-03-29 23:15 . 2006-06-09 08:50 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-03-28 08:58 . 2008-11-21 11:30 -------- d-----w c:\program files\Microsoft Silverlight
    2009-03-28 08:55 . 2009-03-27 03:43 -------- d-----w c:\program files\Microsoft LifeChat
    2009-03-28 07:16 . 2009-03-28 07:16 -------- d-----w c:\program files\Ascaron Entertainment
    2009-03-27 03:25 . 2009-03-27 03:25 -------- d-----w c:\program files\Ford Motor Company
    2009-03-12 09:51 . 2008-05-23 20:28 -------- d-----w c:\program files\Free Video Converter
    2009-03-12 08:36 . 2008-05-05 03:36 -------- d-----w c:\program files\Free FLV Converter
    2009-03-12 04:05 . 2009-03-12 04:05 -------- d-----w c:\program files\AviSynth 2.5
    2009-03-12 04:04 . 2009-03-12 04:04 -------- d-----w c:\program files\eRightSoft
    2009-03-10 07:58 . 2008-04-26 05:39 256 ----a-w c:\windows\system32\pool.bin
    2009-03-03 08:28 . 2006-01-23 07:49 78752 ----a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-02-19 08:11 . 2005-08-05 23:08 87931 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
    2007-03-21 08:40 . 2007-03-21 08:40 251 ----a-w c:\program files\wt3d.ini
    2003-08-27 18:19 . 2006-07-16 04:49 36963 ----a-r c:\program files\Common Files\SM1updtr.dll
    2007-12-14 19:28 . 2007-11-20 07:35 865 --sha-w c:\windows\system32\mmf.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-04-28 1830128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
    "McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
    "Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
    "Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
    "Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-04-16 819200]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-04-16 970752]
    "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 774168]

    c:\documents and settings\Owner\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "EnableProfileQuota"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
    2001-12-21 03:34 24576 ----a-w c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
    backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Extender Resource Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Extender Resource Monitor.lnk
    backup=c:\windows\pss\Extender Resource Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
    backup=c:\windows\pss\RAMASST.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Ati HotKey Poller"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\BitTorrent_DNA\\dna.exe"=
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3776:UDP"= 3776:UDP:Media Center Extender Service
    "3390:TCP"= 3390:TCP:Remote Media Center Experience

    R0 rdejcw;rdejcw; [x]
    R3 lredbooo;lredbooo; [x]
    R3 MSOLAP$SQLEXPRESS;SQL Server Analysis Services (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.3\OLAP\bin\msmdsrv.exe [2007-02-14 14625648]
    R3 ReportServer$SQLEXPRESS;SQL Server Reporting Services (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.4\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2007-03-03 17264]
    R3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\SQLAGENT90.EXE [2006-04-14 319776]
    R3 xlink;XLink Driver (xlink.sys);c:\windows\system32\Drivers\xlink.sys [2002-11-13 19677]
    R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]
    S1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2004-08-18 58016]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-28 9968]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-04-28 72944]
    S1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [2009-03-30 53760]
    S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2007-03-03 206192]
    S2 msftesql$SQLEXPRESS;SQL Server FullText Search (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe [2006-02-14 92880]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-04-28 7408]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    QWAVE REG_MULTI_SZ QWAVE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8a06450-96f9-11dc-bd94-0013ce6bbae2}]
    \Shell\AutoRun\command - e:\jdsecure\Windows\JDSecure31.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-05-03 c:\windows\Tasks\User_Feed_Synchronization-{79F80F27-C953-4849-B054-89AFF0A67371}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 16:58]
    .
    - - - - ORPHANS REMOVED - - - -

    HKU-Default-Run-Diagnostic Manager - c:\windows\TEMP\2258903176.exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    uInternet Connection Wizard,ShellNext = iexplore
    IE: Convert link target to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: {{10F055B8-F443-4adf-948A-EC551E9DBCE4} - c:\documents and settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk
    Trusted Zone: lsac.org
    Trusted Zone: uakron.edu\springboard
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kbtwolpm.default\
    FF - plugin: c:\program files\BitTorrent_DNA\npbtdna.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava11.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava12.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava13.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava14.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava32.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJPI150_01.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPOJI610.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-03 13:59
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\windows\system32\drivers\ovfsthskwpixraoplyqnsljntelhjvkehwyqbh.sys 83968 bytes executable
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthijwtmmpyfv.tmp 107520 bytes executable
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthksuvxqbdmc.tmp 133632 bytes executable
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthpveecrjktq.tmp 343040 bytes executable
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthx000 0 bytes
    c:\windows\system32\ovfsthfchbqecdjseehkqfqbdaiqakdmttxryj.dat 272608 bytes
    c:\windows\system32\ovfsthbmuhuyfjibvmycwahpphdwfcbilynaju.dll 18944 bytes executable
    c:\windows\system32\ovfsthigeoetpvaukymrqpkjwsxhplvdqiafyl.dll 60928 bytes executable
    c:\windows\system32\ovfsthtrwxyvfycbqadpdjfnqbduasadumbeam.dat 43 bytes
    c:\windows\system32\ovfsthxodyphqdvvalvdjkpxueypxvmkitvtoq.dll 18432 bytes executable

    scan completed successfully
    hidden files: 10

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
    @Denied: (Full) (LocalSystem)
    @SACL=

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\SecuROM\License information*]
    "datasecu"=hex:e6,18,fc,50,6d,77,61,f8,dc,8d,8c,27,1d,fe,a1,4e,53,df,8c,3e,98,
    e3,a3,aa,67,4d,c3,06,e7,a7,da,ce,0e,9f,84,70,95,b3,80,6f,61,c9,a4,8c,2a,19,\
    "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F93383AA3238BCCB]
    "1"=hex:47,af,e3,b9,38,4b,f6,e6,cb,8b,59,0c,3a,af,c5,a2,d6,9f,52,ce,23,dc,1a,
    c2
    "2"=hex:d1,c8,c3,5e,08,10,b9,8f,1e,fd,a6,7c,f5,6d,b0,f3,a6,71,8f,f8,ab,bd,bd,
    76,64,10,04,f0,92,77,f9,20
    "3"=hex:47,af,e3,b9,38,4b,f6,e6,cb,8b,59,0c,3a,af,c5,a2,ac,98,11,9b,be,95,83,
    07,ae,ba,7e,d8,e6,d6,56,50,c4,dc,bb,7b,18,78,a4,de,04,5c,25,4e,9f,d7,39,6d

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F93383AA3238BCCB\B405A2EBBFCE91A4C13BDEA4B89DC260]
    "1"=hex:47,e4,6c,02,68,b4,3b,2b,30,11,db,3c,35,63,21,d4,11,b1,7e,c5,ed,aa,8e,
    1a,40,6d,c3,6d,0e,a9,b1,96
    "2"=hex:82,9d,b7,04,75,a2,e0,2a
    "3"=hex:81,20,8f,ab,28,6a,52,9c
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:3b,e8,2f,01,6c,32,33,d8,e1,d7,f3,f6,0e,0a,fa,46,62,39,09,43,d3,da,73,
    d4,4e,db,d0,f9,b1,fb,0a,f1,d3,99,57,af,7d,98,93,fd,a5,1e,64,b6,5b,35,28,e1,\
    "8"=hex:63,5a,d7,1b,b1,d4,18,46,0a,a7,b3,1c,99,c8,a4,fc,08,21,24,20,f1,96,6a,
    7a,cd,13,31,a6,7d,dc,f4,81,0d,1c,44,d3,0b,59,cb,af
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(784)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\Ati2evxx.dll
    c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

    - - - - - - - > 'lsass.exe'(844)
    c:\windows\system32\EntApi.dll

    - - - - - - - > 'explorer.exe'(908)
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\Shellex.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\windows\system32\DVDRAMSV.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\windows\system32\inetsrv\inetinfo.exe
    c:\program files\Network Associates\Common Framework\FrameworkService.exe
    c:\program files\Network Associates\VirusScan\mcshield.exe
    c:\program files\Network Associates\VirusScan\vstskmgr.exe
    c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\windows\ehome\RMSvc.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\windows\ehome\McrdSvc.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\windows\system32\dllhost.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Apoint2K\ApntEx.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2009-05-03 14:06 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-05-03 18:06

    Pre-Run: 10,743,672,832 bytes free
    Post-Run: 10,609,995,776 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    286

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:57:28 PM, on 5/3/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\mcshield.exe
    C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\ehome\RMSvc.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
    C:\Program Files\Toshiba\Tvs\TvsTray.exe
    C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Owner\Desktop\elader.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - S-1-5-18 Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE (User 'Default user')
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
    O15 - Trusted Zone: http://springboard.uakron.edu
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1235024900343
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1235024556718
    O16 - DPF: {B2FCED61-570E-11D3-B160-00A0C9E70E84} (OmniForm Form Control) - https://www4.lsac.org/LSACD_XMLWebSe...veX/ofmctl.cab
    O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.11) - http://gameadvisor.futuremark.com/global/msc311.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    --
    End of file - 10871 bytes
  8. 2009-05-03, 21:04 #8
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      Rootkit::
c:\windows\system32\drivers\ovfsthskwpixraoplyqnsljntelhjvkehwyqbh.sys 
c:\docume~1\Owner\LOCALS~1\Temp\ovfsthijwtmmpyfv.tmp 
c:\docume~1\Owner\LOCALS~1\Temp\ovfsthksuvxqbdmc.tmp 
c:\docume~1\Owner\LOCALS~1\Temp\ovfsthpveecrjktq.tmp 
c:\docume~1\Owner\LOCALS~1\Temp\ovfsthx000 
c:\windows\system32\ovfsthfchbqecdjseehkqfqbdaiqakdmttxryj.dat 
c:\windows\system32\ovfsthbmuhuyfjibvmycwahpphdwfcbilynaju.dll 
c:\windows\system32\ovfsthigeoetpvaukymrqpkjwsxhplvdqiafyl.dll 
c:\windows\system32\ovfsthtrwxyvfycbqadpdjfnqbduasadumbeam.dat 
c:\windows\system32\ovfsthxodyphqdvvalvdjkpxueypxvmkitvtoq.dll 

Folder::
c:\Program Files\BitTorrent_DNA
c:\Program Files\BitTorrent

Driver::
rdejcw
lredbooo

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent_DNA\\dna.exe"=-
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=-
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.


    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  9. 2009-05-03, 21:49 #9
    Elader
    Elader is offline
    Junior Member
    Join Date
    May 2009
    Posts
    8

    Default

    Here is the new combofix log.

    ComboFix 09-05-02.4 - Owner 05/03/2009 15:28.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1376 [GMT -4:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthijwtmmpyfv.tmp
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthksuvxqbdmc.tmp
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthpveecrjktq.tmp
    c:\docume~1\Owner\LOCALS~1\Temp\ovfsthx000
    c:\program files\BitTorrent
    c:\program files\BitTorrent\bittorrent.exe
    c:\program files\BitTorrent\BitTorrentIE.2.dll
    c:\program files\BitTorrent\credits-l10n.txt
    c:\program files\BitTorrent\etc\gtk-2.0\gdk-pixbuf.loaders
    c:\program files\BitTorrent\etc\gtk-2.0\gtkrc
    c:\program files\BitTorrent\etc\pango\pango.aliases
    c:\program files\BitTorrent\etc\pango\pango.modules
    c:\program files\BitTorrent\share\locale\af\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\af\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\bg\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\bg\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\bg\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\ca\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\ca\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\ca\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\cs\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\cs\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\cs\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\da\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\da\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\da\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\de\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\de\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\de\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\el\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\el\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\el\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\es\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\es\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\es\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\fr\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\fr\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\fr\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\he\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\he\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\he\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\hu\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\hu\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\hu\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\is\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\is\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\is\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\it\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\it\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\it\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\ja\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\ja\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\ja\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\ko\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\ko\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\ko\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\nl\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\nl\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\nl\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\pl\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\pl\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\pl\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\pt\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\pt\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\pt\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\pt_BR\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\pt_BR\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\pt_BR\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\ro\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\ro\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\ro\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\ru\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\ru\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\ru\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\sk\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\sk\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\sk\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\sl\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\sl\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\sl\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\sv\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\sv\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\sv\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\tr\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\tr\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\tr\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\vi\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\vi\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\vi\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\zh_CN\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\zh_CN\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\zh_CN\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\locale\zh_TW\LC_MESSAGES\glib20.mo
    c:\program files\BitTorrent\share\locale\zh_TW\LC_MESSAGES\gtk20-properties.mo
    c:\program files\BitTorrent\share\locale\zh_TW\LC_MESSAGES\gtk20.mo
    c:\program files\BitTorrent\share\themes\MS-Windows\gtk-2.0\gtkrc
    c:\program files\BitTorrent\uninst.exe
    c:\program files\BitTorrent_DNA
    c:\program files\BitTorrent_DNA\dna.exe
    c:\program files\BitTorrent_DNA\DNAcpl.cpl
    c:\program files\BitTorrent_DNA\npbtdna.dll
    c:\windows\system32\drivers\ovfsthskwpixraoplyqnsljntelhjvkehwyqbh.sys
    c:\windows\system32\ovfsthbmuhuyfjibvmycwahpphdwfcbilynaju.dll
    c:\windows\system32\ovfsthfchbqecdjseehkqfqbdaiqakdmttxryj.dat
    c:\windows\system32\ovfsthigeoetpvaukymrqpkjwsxhplvdqiafyl.dll
    c:\windows\system32\ovfsthtrwxyvfycbqadpdjfnqbduasadumbeam.dat
    c:\windows\system32\ovfsthxodyphqdvvalvdjkpxueypxvmkitvtoq.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_LREDBOOO
    -------\Service_lredbooo
    -------\Service_rdejcw


    ((((((((((((((((((((((((( Files Created from 2009-04-03 to 2009-05-03 )))))))))))))))))))))))))))))))
    .

    2009-05-02 22:27 . 2009-05-02 22:27 -------- d-----w c:\program files\ERUNT
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\program files\SUPERAntiSpyware
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
    2009-05-02 02:58 . 2009-05-02 02:58 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
    2009-04-29 01:02 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-04-29 01:02 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-04-29 01:02 . 2009-04-29 01:02 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-23 05:49 . 2009-04-23 05:49 -------- d-----w c:\program files\Enlight
    2009-04-20 06:05 . 2009-04-20 06:05 -------- d-----w c:\program files\JoWooD
    2009-04-19 05:43 . 2009-04-19 05:44 -------- d-----w c:\documents and settings\Owner\Application Data\Stardock
    2009-04-19 05:43 . 2009-04-19 05:43 -------- d-----w c:\documents and settings\All Users\Application Data\Stardock
    2009-04-19 05:43 . 2009-04-19 05:43 -------- dc-h--w c:\documents and settings\All Users\Application Data\{1E77E486-38CF-4688-B1E4-B86D08856D09}
    2009-04-06 06:58 . 2009-04-06 06:58 -------- d-----w c:\documents and settings\Owner\Application Data\Acreon
    2009-04-06 06:58 . 2009-04-06 07:09 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\._Revolution_
    2009-04-06 04:32 . 2009-04-06 06:38 -------- d-----w c:\program files\UltimateBet
    2009-04-06 04:32 . 2009-04-06 04:32 -------- d-----w c:\program files\_uninstallation_info

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-03 19:35 . 2005-08-05 23:16 6 ---ha-w c:\windows\Tasks\SA.DAT
    2009-05-03 16:12 . 2009-03-02 21:06 422 ---ha-w c:\windows\Tasks\User_Feed_Synchronization-{79F80F27-C953-4849-B054-89AFF0A67371}.job
    2009-05-01 05:28 . 2006-10-31 22:15 -------- d-----w c:\program files\Viewpoint
    2009-04-19 05:43 . 2006-03-16 02:40 -------- d-----w c:\program files\Stardock
    2009-04-16 07:23 . 2006-01-26 06:47 -------- d-----w c:\program files\World of Warcraft
    2009-04-06 04:33 . 2007-07-11 02:29 -------- d-----w c:\program files\UBNet
    2009-03-30 06:43 . 2009-03-30 06:43 53760 ----a-w c:\windows\system32\drivers\SSHDRV76.sys
    2009-03-29 23:15 . 2006-06-09 08:50 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-03-28 08:58 . 2008-11-21 11:30 -------- d-----w c:\program files\Microsoft Silverlight
    2009-03-28 08:55 . 2009-03-27 03:43 -------- d-----w c:\program files\Microsoft LifeChat
    2009-03-28 07:16 . 2009-03-28 07:16 -------- d-----w c:\program files\Ascaron Entertainment
    2009-03-27 03:25 . 2009-03-27 03:25 -------- d-----w c:\program files\Ford Motor Company
    2009-03-12 09:51 . 2008-05-23 20:28 -------- d-----w c:\program files\Free Video Converter
    2009-03-12 08:36 . 2008-05-05 03:36 -------- d-----w c:\program files\Free FLV Converter
    2009-03-12 04:05 . 2009-03-12 04:05 -------- d-----w c:\program files\AviSynth 2.5
    2009-03-12 04:04 . 2009-03-12 04:04 -------- d-----w c:\program files\eRightSoft
    2009-03-10 07:58 . 2008-04-26 05:39 256 ----a-w c:\windows\system32\pool.bin
    2009-03-03 08:28 . 2006-01-23 07:49 78752 ----a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-02-19 08:11 . 2005-08-05 23:08 87931 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
    2007-03-21 08:40 . 2007-03-21 08:40 251 ----a-w c:\program files\wt3d.ini
    2003-08-27 18:19 . 2006-07-16 04:49 36963 ----a-r c:\program files\Common Files\SM1updtr.dll
    2007-12-14 19:28 . 2007-11-20 07:35 865 --sha-w c:\windows\system32\mmf.sys
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-05-03_17.59.31 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-05-03 19:35 . 2009-05-03 19:35 16384 c:\windows\Temp\Perflib_Perfdata_2f4.dat
    + 2005-08-05 23:14 . 2009-05-03 19:26 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2005-08-05 23:14 . 2009-05-03 17:57 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2005-08-05 23:14 . 2009-05-03 19:26 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2005-08-05 23:14 . 2009-05-03 17:57 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2005-08-05 23:14 . 2009-05-03 19:26 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2005-08-05 23:14 . 2009-05-03 17:57 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2009-03-27 05:51 . 2009-05-03 19:35 235084 c:\windows\system32\inetsrv\MetaBase.bin
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-04-28 1830128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
    "McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
    "Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
    "Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
    "Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-04-16 819200]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-04-16 970752]
    "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 774168]

    c:\documents and settings\Owner\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "EnableProfileQuota"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
    2001-12-21 03:34 24576 ----a-w c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
    backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Extender Resource Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Extender Resource Monitor.lnk
    backup=c:\windows\pss\Extender Resource Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
    backup=c:\windows\pss\RAMASST.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Ati HotKey Poller"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Warlords\\Civ4Warlords_PitBoss.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3776:UDP"= 3776:UDP:Media Center Extender Service
    "3390:TCP"= 3390:TCP:Remote Media Center Experience

    R3 MSOLAP$SQLEXPRESS;SQL Server Analysis Services (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.3\OLAP\bin\msmdsrv.exe [2007-02-14 14625648]
    R3 ReportServer$SQLEXPRESS;SQL Server Reporting Services (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.4\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2007-03-03 17264]
    R3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\SQLAGENT90.EXE [2006-04-14 319776]
    R3 xlink;XLink Driver (xlink.sys);c:\windows\system32\Drivers\xlink.sys [2002-11-13 19677]
    R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2006-12-02 2805000]
    S1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2004-08-18 58016]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-28 9968]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-04-28 72944]
    S1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [2009-03-30 53760]
    S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2007-03-03 206192]
    S2 msftesql$SQLEXPRESS;SQL Server FullText Search (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe [2006-02-14 92880]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-04-28 7408]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    QWAVE REG_MULTI_SZ QWAVE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8a06450-96f9-11dc-bd94-0013ce6bbae2}]
    \Shell\AutoRun\command - e:\jdsecure\Windows\JDSecure31.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-05-03 c:\windows\Tasks\User_Feed_Synchronization-{79F80F27-C953-4849-B054-89AFF0A67371}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 16:58]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    uInternet Connection Wizard,ShellNext = iexplore
    IE: Convert link target to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert to existing PDF - c:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: {{10F055B8-F443-4adf-948A-EC551E9DBCE4} - c:\documents and settings\Owner\Start Menu\Programs\UltimateBet\UltimateBet.lnk
    Trusted Zone: lsac.org
    Trusted Zone: uakron.edu\springboard
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kbtwolpm.default\
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava11.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava12.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava13.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava14.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJava32.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPJPI150_01.dll
    FF - plugin: c:\program files\Java\jre1.5.0_01\bin\NPOJI610.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-03 15:36
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
    @Denied: (Full) (LocalSystem)
    @SACL=

    [HKEY_USERS\S-1-5-21-1291811506-2078486248-198677482-1005\Software\SecuROM\License information*]
    "datasecu"=hex:e6,18,fc,50,6d,77,61,f8,dc,8d,8c,27,1d,fe,a1,4e,53,df,8c,3e,98,
    e3,a3,aa,67,4d,c3,06,e7,a7,da,ce,0e,9f,84,70,95,b3,80,6f,61,c9,a4,8c,2a,19,\
    "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F93383AA3238BCCB]
    "1"=hex:47,af,e3,b9,38,4b,f6,e6,cb,8b,59,0c,3a,af,c5,a2,d6,9f,52,ce,23,dc,1a,
    c2
    "2"=hex:d1,c8,c3,5e,08,10,b9,8f,1e,fd,a6,7c,f5,6d,b0,f3,a6,71,8f,f8,ab,bd,bd,
    76,64,10,04,f0,92,77,f9,20
    "3"=hex:47,af,e3,b9,38,4b,f6,e6,cb,8b,59,0c,3a,af,c5,a2,ac,98,11,9b,be,95,83,
    07,ae,ba,7e,d8,e6,d6,56,50,c4,dc,bb,7b,18,78,a4,de,04,5c,25,4e,9f,d7,39,6d

    [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \F93383AA3238BCCB\B405A2EBBFCE91A4C13BDEA4B89DC260]
    "1"=hex:47,e4,6c,02,68,b4,3b,2b,30,11,db,3c,35,63,21,d4,11,b1,7e,c5,ed,aa,8e,
    1a,40,6d,c3,6d,0e,a9,b1,96
    "2"=hex:82,9d,b7,04,75,a2,e0,2a
    "3"=hex:81,20,8f,ab,28,6a,52,9c
    "4"=hex:2f,ad,a2,e7,8a,bf,05,5e
    "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
    1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
    "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
    51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
    "7"=hex:3b,e8,2f,01,6c,32,33,d8,e1,d7,f3,f6,0e,0a,fa,46,62,39,09,43,d3,da,73,
    d4,4e,db,d0,f9,b1,fb,0a,f1,d3,99,57,af,7d,98,93,fd,a5,1e,64,b6,5b,35,28,e1,\
    "8"=hex:63,5a,d7,1b,b1,d4,18,46,0a,a7,b3,1c,99,c8,a4,fc,08,21,24,20,f1,96,6a,
    7a,cd,13,31,a6,7d,dc,f4,81,0d,1c,44,d3,0b,59,cb,af
    "9"=hex:81,20,8f,ab,28,6a,52,9c
    "18"=hex:70,56,26,33,e3,20,f8,ab
    "10"=hex:81,20,8f,ab,28,6a,52,9c
    "11"=hex:81,20,8f,ab,28,6a,52,9c
    "12"=hex:81,20,8f,ab,28,6a,52,9c
    "13"=hex:81,20,8f,ab,28,6a,52,9c
    "14"=hex:81,20,8f,ab,28,6a,52,9c
    "24"=hex:81,20,8f,ab,28,6a,52,9c
    "26"=hex:81,20,8f,ab,28,6a,52,9c
    "27"=hex:81,20,8f,ab,28,6a,52,9c
    "19"=hex:81,20,8f,ab,28,6a,52,9c
    "22"=hex:81,20,8f,ab,28,6a,52,9c
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(788)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\Ati2evxx.dll
    c:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

    - - - - - - - > 'lsass.exe'(848)
    c:\windows\system32\EntApi.dll

    - - - - - - - > 'explorer.exe'(1860)
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\Shellex.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\windows\system32\DVDRAMSV.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\windows\system32\inetsrv\inetinfo.exe
    c:\program files\Network Associates\Common Framework\FrameworkService.exe
    c:\program files\Network Associates\VirusScan\mcshield.exe
    c:\program files\Network Associates\VirusScan\vstskmgr.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\windows\ehome\RMSvc.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\windows\ehome\McrdSvc.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\windows\system32\dllhost.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Apoint2K\ApntEx.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2009-05-03 15:45 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-05-03 19:45
    ComboFix2.txt 2009-05-03 18:06

    Pre-Run: 10,769,362,944 bytes free
    Post-Run: 10,763,018,240 bytes free

    387
  10. 2009-05-04, 06:07 #10
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Please go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply along with a fresh HijackThis log.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules