google search redirecting

[crape42]

Hi,

Links in my Google search pages redirect to something at google.com/go? which in turn redirects to advertisements. If I stop loading the search page immediately after the items on the search list appear, the links are good and do not redirect. (I am using IE and Chrome, both up to date.)

Appearing at the same time as the above problem was problems with DLLs on this computer -- they could not be loaded or something like that. Some programs, such as AdobeGammaLoader, could not start; some other programs, such as Notepad and Calc, would cause some sort of error when I tried to quit them.

The problems described in this paragraph seemed to go away after I used Spybot, but the problem in the first paragraph did not.

Thanks so much for your help!

--craig


Here is the DDS log:


DDS (Ver_10-12-12.02) - NTFSx86
Run by Craig at 18:49:01.71 on Fri 12/31/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2455 [GMT -8:00]

AV: Symantec AntiVirus Corporate Edition *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *Enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\WINDOWS\system32\nipalsm.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe
C:\WINDOWS\system32\nipalsm.exe
C:\VXIPNP\WinNT\NIvisa\niLxiDiscovery.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\National Instruments\NI-DAQ\HWConfig\nidevmon.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Clarus\Samsung Auto Backup\ISFGuage.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Desktop\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = http://www.google.com/ig/dell?hl=en&...us&ibd=6080821
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6080821
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080821
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: EndNote Web: {82d2e569-25a7-4e4d-9fa3-c5025b4b7912} - c:\program files\endnote web\ENWIEPlug.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\craig\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\symant~2\VPTray.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [AdobeVersionCue] c:\program files\adobe\adobe version cue\controlpanel\VersionCueTray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [niDevMon] c:\program files\national instruments\ni-daq\hwconfig\nidevmon.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [cleanmgr] c:\documents and settings\craig\application data\cleanmgr.exe
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~3.lnk - c:\program files\clarus\samsung auto backup\ISFGuage.exe
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~2.lnk - c:\program files\clarus\samsung auto backup\ISFRealTimeD.exe
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~1.lnk - c:\program files\clarus\samsung auto backup\ISFTimerD.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\adobe acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://access.hhmi.org/dana-cached/setup/JuniperSetupSP1.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {439113CE-2797-47E8-BA3D-03F300777207} - "c:\program files\hummingbird\connectivity\13.00\accessories\HumSettings.exe" INSTALL=ALL

NoFreeWhenWOW64=1 LOGGINGLEVEL=5
mASetup: {72B7C0F0-6036-48D7-A0C9-4FF886785E15} - "c:\program files\hummingbird\connectivity\13.00\accessories\HumSettings.exe" INSTALL=ALL

NoFreeWhenWOW64=1 LOGGINGLEVEL=5
Hosts: 212.117.178.25 www.google.com
Hosts: 212.117.163.43 search.yahoo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\craig\applic~1\mozilla\firefox\profiles\zwijfs5v.default\
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\craig\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\adobe\adobe acrobat 6.0\acrobat\browser\nppdf32.dll
FF - plugin: c:\program files\common files\parallelgraphics\cortona\npCortona.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCortona.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV80Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV82Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nplv85win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nplv86win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation

foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

============= SERVICES / DRIVERS ===============

R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [2008-8-21 15448]
R1 SAVRT;SAVRT;c:\program files\symantec client security\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec client security\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2007-5-29 192104]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2007-5-29 202344]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2007-5-29 169576]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-9-25 189736]
R2 ni488enumsvc;NI-488.2 Enumeration Service;c:\windows\system32\nipalsm.exe [2008-8-21 12696]
R2 niarbk;niarbk;c:\windows\system32\drivers\niarbk.dll [2007-4-16 37376]
R2 nibffrk;nibffrk;c:\windows\system32\drivers\nibffrk.dll [2007-4-16 21504]
R2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [2007-4-16 674304]
R2 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [2008-8-21 12696]
R2 nidmmk;NI DMM and Data Logger Kernel Driver;c:\windows\system32\drivers\nidmmk.dll [2007-4-16 50688]
R2 niLXIDiscovery;National Instruments LXI Discovery Service;c:\vxipnp\winnt\nivisa\niLxiDiscovery.exe [2008-6-20 129144]
R2 nimDNSResponder;National Instruments mDNS Responder Service;c:\program files\national instruments\shared\mdns responder\nimdnsResponder.exe [2008-6-18

192112]
R2 nimdsk;nimdsk;c:\windows\system32\drivers\nimdsk.dll [2007-4-16 30208]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [2008-6-25 11344]
R2 nistck;nistck;c:\windows\system32\drivers\niSTCk.dll [2007-4-16 111616]
R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [2008-6-20 11360]
R2 SavRoam;SAVRoam;c:\program files\symantec client security\symantec antivirus\SavRoam.exe [2007-10-7 116664]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec client security\symantec antivirus\Rtvscan.exe [2007-10-7 1822648]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-10 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20101231.002\naveng.sys [2010-12-31 86008]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20101231.002\navex15.sys [2010-12-31 1360760]
R3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [2008-6-13 11360]
R3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [2008-6-13 11360]
R3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [2008-7-23 11360]
R3 VDNG;Video to 1394, WDM Video Capture;c:\windows\system32\drivers\vid21394_4012.sys [2008-9-12 59520]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-5 135664]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-20

30192]
S3 imaq1394k;imaq1394k;c:\windows\system32\drivers\imaq1394kl.sys [2008-6-18 11480]
S3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [2008-6-23 20104]
S3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [2008-11-11 26192]
S3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [2008-11-11 11344]
S3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [2008-11-11 22608]
S3 ni488lock;NI-488.2 Locking Service;c:\windows\system32\drivers\ni488lock.sys [2008-9-4 16456]
S3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [2008-7-24 11352]
S3 nicsrk;nicsrk;c:\windows\system32\drivers\nicsrkl.sys [2008-7-31 11336]
S3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [2008-8-1 11336]
S3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [2008-7-25 11344]
S3 nidwgk;nidwgk;c:\windows\system32\drivers\nidwgkl.sys [2008-8-26 11360]
S3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [2008-7-31 11336]
S3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [2008-7-31 11336]
S3 nifslk;nifslk;c:\windows\system32\drivers\nifslkl.sys [2008-7-29 11352]
S3 nigplk;nigplk;c:\windows\system32\drivers\nigplkl.sys [2008-6-16 11640]
S3 nihsdrk;nihsdrk;c:\windows\system32\drivers\nihsdrkl.sys [2008-7-16 11352]
S3 niimaqdxk;niimaqdxk;c:\windows\system32\drivers\niimaqdxkl.sys [2008-6-23 11320]
S3 niimaqk;NI-IMAQ Driver;c:\windows\system32\drivers\niimaqk.sys --> c:\windows\system32\drivers\niimaqk.sys [?]
S3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [2008-7-23 11392]
S3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [2007-4-4 14464]
S3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [2007-4-4 151683]
S3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [2008-7-23 11368]
S3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [2008-7-30 11360]
S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [2008-12-16 11904]
S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [2008-12-16 11896]
S3 nipsdk;nipsdk;c:\windows\system32\drivers\nipsdkl.sys [2008-6-2 11392]
S3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [2008-6-25 20568]
S3 nirfsa2k;nirfsa2k;c:\windows\system32\drivers\niRFSA2kl.sys [2008-7-16 11328]
S3 niRFSGk;niRFSGk;c:\windows\system32\drivers\niRFSGkl.sys [2008-7-18 11328]
S3 NiRioRpc;National Instruments RIO Server;c:\windows\system32\NiRioRpc.exe [2008-12-23 27720]
S3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [2008-7-30 11376]
S3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [2008-8-7 11352]
S3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [2008-7-30 11344]
S3 nisldk;nisldk;c:\windows\system32\drivers\nisldkl.sys [2008-6-2 11344]
S3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [2008-7-30 11376]
S3 nisrcdk;nisrcdk;c:\windows\system32\drivers\nisrcdkl.sys [2008-7-11 11352]
S3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [2008-7-31 11336]
S3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [2008-7-25 11312]
S3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [2008-7-25 11360]
S3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [2008-7-28 11336]
S3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [2008-7-24 11360]
S3 nitnr2k;nitnr2k;c:\windows\system32\drivers\nitnr2kl.sys [2008-7-16 11328]
S3 niufurk;niufurk;c:\windows\system32\drivers\niufurkl.sys [2008-7-31 11368]
S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [2008-6-20 11384]
S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [2008-6-20 11360]
S3 niwdk;niwdk;c:\windows\system32\drivers\niwdk.sys [2008-12-15 27744]
S3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [2008-7-31 11336]
S3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [2008-7-31 11336]
S3 usb6xxxk;usb6xxxk;\??\c:\windows\system32\drivers\usb6xxxkl.sys --> c:\windows\system32\drivers\usb6xxxkl.sys [?]
S4 Agp88lr70-cn;Agp88lr70-cn; [x]

=============== Created Last 30 ================

2011-01-01 01:45:07 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-01-01 01:45:07 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-12-18 01:45:10 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-18 01:44:50 45568 ------w- c:\windows\system32\dllcache\wab.exe
2010-12-05 23:26:00 59904 ----a-w- c:\documents and settings\craig\7zDecode.exe

==================== Find3M ====================

2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-17 23:53:22 62976 --sh--w- c:\docume~1\craig\applic~1\cleanmgr.exe
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 18:49:42.95 ===============

[km2357]

Hello and welcome to Safer Networking.

My name is km2357 and I will be helping you to remove any infection(s) that you may have.

I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:


Step # 1 Download and run DDS

Download DDS and save it to your desktop from here or here or here
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

Step # 2: Download and Run Gmer

Please download gmer.zip from Gmer and save it to your desktop.

***Please close any open programs ***

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked.

• Click the Scan button and let the program do its work. GMER will produce a log.
  
• Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
  
• GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

Please post the results from the GMER scan in your reply.


In your next post/reply, I need to see the following:

1. The two DDS Logs (DDS and Attach.txt)
2. The GMER Log

Use multiple posts if you can't fit everything into one post

[crape42]

Thanks for looking at my post. Here are the new DDS log and Attach.txt. Unfortunately, GMER crashes while running so I can't give you a GMER log. (I have attached a screenshot of the error log that comes up after trying to run GMER.)

Thanks for your help.

--craig



DDS (Ver_10-12-12.02) - NTFSx86
Run by Craig at 15:45:44.37 on Wed 01/05/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2397 [GMT -8:00]

AV: Symantec AntiVirus Corporate Edition *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *Enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\National Instruments\MAX\nimxs.exe
C:\WINDOWS\system32\nipalsm.exe
C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe
C:\WINDOWS\system32\nipalsm.exe
C:\VXIPNP\WinNT\NIvisa\niLxiDiscovery.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\National Instruments\NI-DAQ\HWConfig\nidevmon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Clarus\Samsung Auto Backup\ISFGuage.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Craig\Desktop\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = http://www.google.com/ig/dell?hl=en&...us&ibd=6080821
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6080821
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080821
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: EndNote Web: {82d2e569-25a7-4e4d-9fa3-c5025b4b7912} - c:\program files\endnote web\ENWIEPlug.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: EndNote Web: {945c8270-a848-11d5-a805-00b0d092f45b} - c:\program files\endnote web\ENWIEPlug.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\craig\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\symant~2\VPTray.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [AdobeVersionCue] c:\program files\adobe\adobe version cue\controlpanel\VersionCueTray.exe
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [niDevMon] c:\program files\national instruments\ni-daq\hwconfig\nidevmon.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [cleanmgr] c:\documents and settings\craig\application data\cleanmgr.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~3.lnk - c:\program files\clarus\samsung auto backup\ISFGuage.exe
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~2.lnk - c:\program files\clarus\samsung auto backup\ISFRealTimeD.exe
StartupFolder: c:\docume~1\craig\startm~1\programs\startup\samsun~1.lnk - c:\program files\clarus\samsung auto backup\ISFTimerD.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\adobe acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://access.hhmi.org/dana-cached/setup/JuniperSetupSP1.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: NavLogon - c:\windows\system32\NavLogon.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {439113CE-2797-47E8-BA3D-03F300777207} - "c:\program files\hummingbird\connectivity\13.00\accessories\HumSettings.exe" INSTALL=ALL NoFreeWhenWOW64=1 LOGGINGLEVEL=5
mASetup: {72B7C0F0-6036-48D7-A0C9-4FF886785E15} - "c:\program files\hummingbird\connectivity\13.00\accessories\HumSettings.exe" INSTALL=ALL NoFreeWhenWOW64=1 LOGGINGLEVEL=5
Hosts: 212.117.178.25 www.google.com
Hosts: 212.117.163.43 search.yahoo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\craig\applic~1\mozilla\firefox\profiles\zwijfs5v.default\
FF - plugin: c:\documents and settings\craig\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\common files\parallelgraphics\cortona\npCortona.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol500.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCortona.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV80Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV82Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nplv85win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nplv86win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

============= SERVICES / DRIVERS ===============

R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [2008-8-21 15448]
R1 SAVRT;SAVRT;c:\program files\symantec client security\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec client security\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2007-5-29 192104]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2007-5-29 202344]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2007-5-29 169576]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-9-25 189736]
R2 ni488enumsvc;NI-488.2 Enumeration Service;c:\windows\system32\nipalsm.exe [2008-8-21 12696]
R2 niarbk;niarbk;c:\windows\system32\drivers\niarbk.dll [2007-4-16 37376]
R2 nibffrk;nibffrk;c:\windows\system32\drivers\nibffrk.dll [2007-4-16 21504]
R2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [2007-4-16 674304]
R2 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [2008-8-21 12696]
R2 nidmmk;NI DMM and Data Logger Kernel Driver;c:\windows\system32\drivers\nidmmk.dll [2007-4-16 50688]
R2 niLXIDiscovery;National Instruments LXI Discovery Service;c:\vxipnp\winnt\nivisa\niLxiDiscovery.exe [2008-6-20 129144]
R2 nimDNSResponder;National Instruments mDNS Responder Service;c:\program files\national instruments\shared\mdns responder\nimdnsResponder.exe [2008-6-18 192112]
R2 nimdsk;nimdsk;c:\windows\system32\drivers\nimdsk.dll [2007-4-16 30208]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [2008-6-25 11344]
R2 nistck;nistck;c:\windows\system32\drivers\niSTCk.dll [2007-4-16 111616]
R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [2008-6-20 11360]
R2 SavRoam;SAVRoam;c:\program files\symantec client security\symantec antivirus\SavRoam.exe [2007-10-7 116664]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec client security\symantec antivirus\Rtvscan.exe [2007-10-7 1822648]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-10 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20110104.002\naveng.sys [2011-1-4 86008]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20110104.002\navex15.sys [2011-1-4 1360760]
R3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [2008-6-13 11360]
R3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [2008-6-13 11360]
R3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [2008-7-23 11360]
R3 VDNG;Video to 1394, WDM Video Capture;c:\windows\system32\drivers\vid21394_4012.sys [2008-9-12 59520]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-5 135664]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-20 30192]
S3 imaq1394k;imaq1394k;c:\windows\system32\drivers\imaq1394kl.sys [2008-6-18 11480]
S3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [2008-6-23 20104]
S3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [2008-11-11 26192]
S3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [2008-11-11 11344]
S3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [2008-11-11 22608]
S3 ni488lock;NI-488.2 Locking Service;c:\windows\system32\drivers\ni488lock.sys [2008-9-4 16456]
S3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [2008-7-24 11352]
S3 nicsrk;nicsrk;c:\windows\system32\drivers\nicsrkl.sys [2008-7-31 11336]
S3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [2008-8-1 11336]
S3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [2008-7-25 11344]
S3 nidwgk;nidwgk;c:\windows\system32\drivers\nidwgkl.sys [2008-8-26 11360]
S3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [2008-7-31 11336]
S3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [2008-7-31 11336]
S3 nifslk;nifslk;c:\windows\system32\drivers\nifslkl.sys [2008-7-29 11352]
S3 nigplk;nigplk;c:\windows\system32\drivers\nigplkl.sys [2008-6-16 11640]
S3 nihsdrk;nihsdrk;c:\windows\system32\drivers\nihsdrkl.sys [2008-7-16 11352]
S3 niimaqdxk;niimaqdxk;c:\windows\system32\drivers\niimaqdxkl.sys [2008-6-23 11320]
S3 niimaqk;NI-IMAQ Driver;c:\windows\system32\drivers\niimaqk.sys --> c:\windows\system32\drivers\niimaqk.sys [?]
S3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [2008-7-23 11392]
S3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [2007-4-4 14464]
S3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [2007-4-4 151683]
S3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [2008-7-23 11368]
S3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [2008-7-30 11360]
S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [2008-12-16 11904]
S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [2008-12-16 11896]
S3 nipsdk;nipsdk;c:\windows\system32\drivers\nipsdkl.sys [2008-6-2 11392]
S3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [2008-6-25 20568]
S3 nirfsa2k;nirfsa2k;c:\windows\system32\drivers\niRFSA2kl.sys [2008-7-16 11328]
S3 niRFSGk;niRFSGk;c:\windows\system32\drivers\niRFSGkl.sys [2008-7-18 11328]
S3 NiRioRpc;National Instruments RIO Server;c:\windows\system32\NiRioRpc.exe [2008-12-23 27720]
S3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [2008-7-30 11376]
S3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [2008-8-7 11352]
S3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [2008-7-30 11344]
S3 nisldk;nisldk;c:\windows\system32\drivers\nisldkl.sys [2008-6-2 11344]
S3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [2008-7-30 11376]
S3 nisrcdk;nisrcdk;c:\windows\system32\drivers\nisrcdkl.sys [2008-7-11 11352]
S3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [2008-7-31 11336]
S3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [2008-7-25 11312]
S3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [2008-7-25 11360]
S3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [2008-7-28 11336]
S3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [2008-7-24 11360]
S3 nitnr2k;nitnr2k;c:\windows\system32\drivers\nitnr2kl.sys [2008-7-16 11328]
S3 niufurk;niufurk;c:\windows\system32\drivers\niufurkl.sys [2008-7-31 11368]
S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [2008-6-20 11384]
S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [2008-6-20 11360]
S3 niwdk;niwdk;c:\windows\system32\drivers\niwdk.sys [2008-12-15 27744]
S3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [2008-7-31 11336]
S3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [2008-7-31 11336]
S3 uc480;uc480 kernel driver;c:\windows\system32\drivers\uc480.sys [2011-1-4 1306176]
S3 uc480_boot;uc480 boot driver;c:\windows\system32\drivers\uc480_boot.sys [2011-1-4 1303616]
S3 usb6xxxk;usb6xxxk;\??\c:\windows\system32\drivers\usb6xxxkl.sys --> c:\windows\system32\drivers\usb6xxxkl.sys [?]
S4 Agp88lr70-cn;Agp88lr70-cn; [x]

=============== Created Last 30 ================

2011-01-05 23:38:28 -------- d-----w- c:\windows\system32\appmgmt
2011-01-04 22:43:26 1306176 ----a-w- c:\windows\system32\drivers\uc480.sys
2011-01-04 22:43:26 1303616 ----a-w- c:\windows\system32\drivers\uc480_boot.sys
2011-01-03 22:59:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-03 22:59:18 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-01-03 22:28:24 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe
2011-01-03 22:28:23 719832 ----a-w- c:\program files\mozilla firefox\mozcpp19.dll
2011-01-01 01:45:07 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-01-01 01:45:07 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-12-18 01:45:10 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-18 01:44:50 45568 ------w- c:\windows\system32\dllcache\wab.exe

==================== Find3M ====================

2010-11-30 01:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-17 23:53:22 62976 --sh--w- c:\docume~1\craig\applic~1\cleanmgr.exe
2010-11-13 00:34:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 15:51:31.84 ===============













UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 9/2/2008 4:37:20 PM
System Uptime: 1/5/2011 3:41:29 PM (0 hours ago)

Motherboard: Dell Inc. | | 0TP412
Processor: Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz | CPU | 2394/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 233 GiB total, 118.22 GiB free.
D: is FIXED (NTFS) - 74 GiB total, 18.241 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

Class GUID:
Description: Multimedia Video Controller
Device ID: PCI\VEN_10E8&DEV_81E6&SUBSYS_00000000&REV_00\4&210641D0&0&00F0
Manufacturer:
Name: Multimedia Video Controller
PNP Device ID: PCI\VEN_10E8&DEV_81E6&SUBSYS_00000000&REV_00\4&210641D0&0&00F0
Service:

Class GUID: {7C797140-F6D8-11CF-9FD6-00A024178A17}
Description: PCI Device
Device ID: PCI\VEN_1093&DEV_18B0&SUBSYS_00000000&REV_00\4&210641D0&0&20F0
Manufacturer:
Name: PCI Device
PNP Device ID: PCI\VEN_1093&DEV_18B0&SUBSYS_00000000&REV_00\4&210641D0&0&20F0
Service:

==== System Restore Points ===================

RP592: 11/10/2010 6:39:20 PM - System Checkpoint
RP593: 11/11/2010 10:31:51 PM - System Checkpoint
RP594: 11/13/2010 1:51:34 AM - System Checkpoint
RP595: 11/14/2010 5:38:04 AM - System Checkpoint
RP596: 11/15/2010 5:52:34 AM - System Checkpoint
RP597: 11/16/2010 9:29:04 AM - System Checkpoint
RP598: 11/17/2010 9:30:04 AM - System Checkpoint
RP599: 11/18/2010 9:38:00 AM - System Checkpoint
RP600: 11/19/2010 1:26:00 PM - System Checkpoint
RP601: 11/20/2010 1:38:00 PM - System Checkpoint
RP602: 11/21/2010 5:26:00 PM - System Checkpoint
RP603: 11/22/2010 5:59:52 PM - System Checkpoint
RP604: 11/27/2010 1:49:33 PM - System Checkpoint
RP605: 11/28/2010 5:15:41 PM - System Checkpoint
RP606: 11/30/2010 12:38:26 PM - System Checkpoint
RP607: 12/1/2010 6:36:01 PM - System Checkpoint
RP608: 12/2/2010 8:08:09 PM - System Checkpoint
RP609: 12/4/2010 12:07:04 AM - System Checkpoint
RP610: 12/5/2010 4:07:04 AM - System Checkpoint
RP611: 12/6/2010 8:07:06 AM - System Checkpoint
RP612: 12/7/2010 11:55:05 AM - System Checkpoint
RP613: 12/8/2010 3:14:52 PM - System Checkpoint
RP614: 12/9/2010 7:14:50 PM - System Checkpoint
RP615: 12/17/2010 6:37:47 PM - System Checkpoint
RP616: 12/18/2010 5:00:18 AM - Software Distribution Service 3.0
RP617: 12/19/2010 5:26:51 AM - System Checkpoint
RP618: 12/20/2010 9:26:50 AM - System Checkpoint
RP619: 1/2/2011 1:57:26 PM - System Checkpoint
RP620: 1/3/2011 2:15:09 PM - System Checkpoint
RP621: 1/3/2011 2:26:12 PM - Installed QuickTime
RP622: 1/3/2011 2:59:00 PM - Installed Java(TM) 6 Update 23
RP623: 1/4/2011 2:42:37 PM - Installed Thorlabs DCx camera
RP624: 1/5/2011 5:00:14 AM - Software Distribution Service 3.0
RP625: 1/5/2011 3:36:03 PM - Removed Thorlabs DCx camera

==== Installed Programs ======================


Acrobat.com
Adobe AIR
Adobe Creative Suite
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 9.4.1
Adobe SVG Viewer 3.0
Apple Application Support
Apple Software Update
Broadcom ASF Management Applications
Broadcom Management Programs
Browser Address Error Redirector
Citrix Presentation Server Client - Web Only
Connectivity Secure Shell 2008
Cortona® VRML Client
Critical Update for Windows Media Player 11 (KB959772)
Dell Driver Download Manager
Dell ETS Factory Installation
Dragon NaturallySpeaking 9
EndNote Web
ERUNT 1.1j
Google Chrome
Google Desktop
Google Toolbar for Internet Explorer
Google Update Helper
High Definition Audio Driver Package - KB835221
HostExplorer 2008
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
IC Capture 1.1 Trial
IC LabVIEW Extension 2.0
ImageJ 1.42q
Intel(R) Matrix Storage Manager
IQ Solutions
IVI Shared Component
IVI Shared Components
IVI VISA COM Standard Components
Java Auto Updater
Java(TM) 6 Update 23
Java(TM) 6 Update 5
Juniper Networks Cache Cleaner 6.0.0
Juniper Networks Host Checker
LabVIEW Web Services
LiveUpdate 3.2 (Symantec Corporation)
MATLAB R2006b
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 ??? Language Pack
Microsoft .NET Framework 2.0 Language Pack - DEU
Microsoft .NET Framework 2.0 Language Pack - FRA
Microsoft .NET Framework 2.0 Language Pack - JPN
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA
Mozilla Firefox (3.6.13)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
National Instruments Software
NI-488.2 2.6
NI-488.2 Provider for MAX version 2.6
NI-653x Installer 1.9.0
NI-APAL Error Files 1.4.0f0
NI-CAN: Shared LV code
NI-DAQ C and VB6 API
NI-DAQ Document Set
NI-DAQ INF Files
NI-DAQ Provider for MAX
NI-DAQmx - LabVIEW shared documentation
NI-DAQmx 8.8.0
NI-DAQmx Documentation
NI-DAQmx MAX Support 1.11.0
NI-DAQmx OPC Support
NI-DAQmx support for LabVIEW
NI-DAQmx Switch Core 1.15.0
NI-DAQmxEF 2.1.0
NI-DCPower 1.2.2
NI-DIM 1.5.0f0 for Phar Lap ETS
NI-DIM 1.9.0f0
NI-DIM 1.9.0f0 for Phar Lap ETS
NI-DIO Driver 152f1
NI-DMM 2.9
NI-FGEN 2.6
NI-FGEN Driver 160f3
NI-HSD Driver 1.10.0f4
NI-HSDIO 1.5.4
NI-IMAQ .NET Support
NI-IMAQ 32-bit Driver Support
NI-IMAQ 4.1
NI-IMAQ Camera Files
NI-IMAQ Configuration 2.6
NI-IMAQ IO .NET Support
NI-IMAQ IO 2.2
NI-IMAQ Provider for MAX
NI-IMAQdx .NET Support
NI-IMAQdx 3.2
NI-IMAQdx 32-bit Driver Support
NI-Intel8254x for LabVIEW Real-Time
NI-Intel8255x for LabVIEW Real-Time
NI-MDBG 1.9.0f0
NI-MDBG 1.9.0f0 for Phar Lap ETS
NI-MRU 2.10.0f0
NI-MXDF 1.10.0f0
NI-MXDF 1.10.0f0 for Phar Lap ETS
NI-MXLC 1.2.0f0
NI-ORB 1.5.0f0 for Phar Lap ETS
NI-ORB 1.9.0f0
NI-ORB 1.9.0f0 for Phar Lap ETS
NI-PAL 1.11.1f0 for Phar Lap ETS
NI-PAL 1.8.2f0 for Phar Lap ETS
NI-PAL 2.3.0f0 for Phar Lap ETS
NI-PAL 2.4.0f0
NI-PAL 2.4.0f0 for Phar Lap ETS
NI-RFSA 2.1
NI-RFSG 1.4
NI-RIO 3.1.0
NI-RIO 3.1.0 driver for Real-Time Embedded Targets
NI-RIO Common Files for LabVIEW 8.6
NI-RIO FCF 2.2.0 for Real-Time Embedded Targets
NI-RIO for 32-bit Windows
NI-RIO I/O Control for LabVIEW 8.5
NI-RIO I/O Control for LabVIEW 8.6
NI-RIO Scan Interface for Real-Time Embedded Targets
NI-RPC 3.1.1f0 for PharLap
NI-RPC 3.3.0f0 for Phar Lap ETS
NI-RPC 3.3.1f0 for Phar Lap ETS
NI-RPC 4.0.0f0
NI-RPC 4.0.0f0 for Phar Lap ETS
NI-SCOPE 3.5
NI-Serial 3.3 for LabVIEW Real-Time
NI-Serial 3.3.2 for LabVIEW Real-Time
NI-Serial 3.3.3 for LabVIEW Real-Time
NI-Serial 3.4
NI-Serial 3.4 Help
NI-Serial 3.4 MAX Provider
NI-STE10/100A for Phar Lap ETS
NI-SWITCH 3.8
NI-TClk 1.7
NI-TNF 1.4.0f0 for Phar Lap ETS
NI-TNF 1.4.2f0 for Phar Lap ETS
NI-TNR Driver
NI-Tuner 1.6.8
NI-VISA 4.0 for LabVIEW Real-Time
NI-VISA 4.3 for LabVIEW Real-Time
NI-VISA 4.4
NI-VISA 4.4 for LabVIEW Real-Time
NI-VISA 4.4 MAX Provider
NI-VISA Runtime 4.4.1
NI-VISA Server 4.4
NI-WatchDog for LabVIEW Real-Time 3.0.1
NI-WatchDog Host 3.0.1
NI 985x Software 1.3.3
NI AFW Channel Configuration Tool
NI AFW Custom UI
NI Assistant Framework
NI Assistant Framework LabVIEW 8.2
NI Assistant Framework LabVIEW 8.6 Support
NI Assistant Framework LabVIEW Code Generator 6.1
NI Assistant Framework LabVIEW Code Generator 7.0
NI Assistant Framework LabVIEW Code Generator 7.1
NI Assistant Framework LabVIEW Code Generator 8.0
NI Assistant Framework LabVIEW Code Generator 8.2
NI Assistant Framework LabVIEW Code Generator 8.5
NI Assistant Framework LabVIEW Code Generator 8.6
NI Calibration Provider for MAX
NI Certificates Deployment Support
NI Common Digital 1.8.0
NI Common RIO Plug-In Files
NI CompactRIO 3.1.0
NI CompactRIO Controller BIOS Update 10.5
NI CompactRIO LabVIEW 8.6 Module Support
NI CompactRIO LV 8.2 Common Module Support
NI CompactRIO MAX Provider
NI CompactRIO Module Software 3.1.0
NI CompactRIO Module Support
NI CompactRIO Recommended Software Sets
NI CompactRIO Reconfigurable Target Support for LabVIEW 8.6
NI CompactRIO Reconfigurable Targets Core
NI cRIO-910x LabVIEW Support
NI cRIO Motion for LabVIEW 8.2
NI CVS-1450 Series Remote Provider
NI DAQ Assistant 1.9.0
NI DataSocket 4.6.0
NI DHV DCMP Installer 1.1.2f0
NI DHV GPL 108f3
NI Distributed System Manager
NI DN 2.0 installer
NI DN 2.0 Language Pack installer
NI Dynamic Signal Acquisition Installer 1.12.0
NI EULA Depot
NI Example Finder 8.6
NI FlexRIO support for Real-Time Embedded Targets
NI FSL Installer 1.7.0
NI Help Assistant
NI Hierarchical Waveform Storage 1.4.6
NI IMAQ Vision for Measurement Studio Upgrade Manager
NI Instrument I/O Assistant
NI Instrument IO Assistant for LabVIEW 8.2
NI Instrument IO Assistant for LabVIEW 8.6
NI IVI Class Driver LabVIEW 8.2 Support
NI IVI Class Driver LabVIEW 8.6 Support
NI IVI Class Drivers
NI IVI Class Simulation Drivers
NI IVI Compliance Package 3.3
NI IVI Engine
NI IVI Online Help
NI IVI Provider for MAX
NI LabVIEW 7.1.1 Real-Time Update
NI LabVIEW 8.2 Device Detection and Deployment Support
NI LabVIEW 8.2 FPGA Realtime Support
NI LabVIEW 8.2 Help
NI LabVIEW 8.2 Help File
NI LabVIEW 8.2 Manuals
NI LabVIEW 8.2 MeasAppChm File
NI LabVIEW 8.2.1
NI LabVIEW 8.2.1 Activity
NI LabVIEW 8.2.1 Applibs
NI LabVIEW 8.2.1 CINtools
NI LabVIEW 8.2.1 Examples
NI LabVIEW 8.2.1 gMath
NI LabVIEW 8.2.1 iMath
NI LabVIEW 8.2.1 Instr.lib
NI LabVIEW 8.2.1 License
NI LabVIEW 8.2.1 Menus
NI LabVIEW 8.2.1 Project
NI LabVIEW 8.2.1 Resource
NI LabVIEW 8.2.1 Simulation
NI LabVIEW 8.2.1 Templates
NI LabVIEW 8.2.1 User.lib
NI LabVIEW 8.2.1 VI.lib
NI LabVIEW 8.2.1 WWW
NI LabVIEW 8.5.1 Real-Time cRIO 9014 Upgrade
NI LabVIEW 8.6 Deployment Framework
NI LabVIEW 8.6 FPGA Elemental I_O Common
NI LabVIEW 8.6 Help
NI LabVIEW 8.6 Help File
NI LabVIEW 8.6 License
NI LabVIEW 8.6 Manuals
NI LabVIEW 8.6 MeasAppChm File
NI LabVIEW 8.6 Real-Time LabVIEW
NI LabVIEW 8.6 Real-Time MSVS71 Support
NI LabVIEW 8.6 Real-Time Pharlap Base
NI LabVIEW 8.6 Real-Time Pharlap LabVIEW
NI LabVIEW 8.6 Real-Time Support for cRIO
NI LabVIEW 8.6 Real-Time VxWorks Base Support
NI LabVIEW 8.6 Real-Time VxWorks LabVIEW
NI LabVIEW 8.6 Simulation
NI LabVIEW 8.6.1
NI LabVIEW 8.6.1 Applibs
NI LabVIEW 8.6.1 CINtools
NI LabVIEW 8.6.1 Examples
NI LabVIEW 8.6.1 FPGA Realtime Support
NI LabVIEW 8.6.1 FPGA Support for Host Communication
NI LabVIEW 8.6.1 gMath
NI LabVIEW 8.6.1 iMath
NI LabVIEW 8.6.1 Instr.lib
NI LabVIEW 8.6.1 Integer Math and Analysis
NI LabVIEW 8.6.1 Menus
NI LabVIEW 8.6.1 Project
NI LabVIEW 8.6.1 Resource
NI LabVIEW 8.6.1 Templates
NI LabVIEW 8.6.1 User.lib
NI LabVIEW 8.6.1 VI.lib
NI LabVIEW 8.6.1 WWW
NI LabVIEW Broker
NI LabVIEW C Interface
NI LabVIEW Deployable License 8.2
NI LabVIEW Deployable License 8.6.1
NI LabVIEW EWB DeviceHandler 300
NI LabVIEW FPGA Elemental I_O Common
NI LabVIEW FPGA Support for Host Communication
NI LabVIEW Integer Math and Analysis
NI LabVIEW MAX XML
NI LabVIEW Merge Utility 8.6.0
NI LabVIEW Real-Time Error Dialog
NI LabVIEW Real-Time FIFO for Runtime
NI LabVIEW Real-Time NBFifo
NI LabVIEW Run-Time Engine 6.1
NI LabVIEW Run-Time Engine 7.0
NI LabVIEW Run-Time Engine 7.1.1
NI LabVIEW Run-Time Engine 8.0.1
NI LabVIEW Run-Time Engine 8.2.1
NI LabVIEW Run-Time Engine 8.5.1
NI LabVIEW Run-Time Engine 8.6.1
NI LabVIEW SignalExpress 3.0
NI LabVIEW SignalExpress 3.0 Core
NI LabVIEW SignalExpress 3.0 Core LabVIEW Support
NI LabVIEW SignalExpress 3.0 Core LabVIEW82 Support
NI LabVIEW SignalExpress 3.0 Core LabVIEW86 Support
NI LabVIEW SignalExpress 3.0 Datatypes
NI LabVIEW SignalExpress 3.0 Datatypes LabVIEW 8.2 Support
NI LabVIEW SignalExpress 3.0 Datatypes LabVIEW 8.6 Support
NI LabVIEW SignalExpress 3.0 LabVIEW 8.2 Support
NI LabVIEW SignalExpress 3.0 LabVIEW 8.6 Support
NI LabVIEW SignalExpress 3.0 LabVIEW Support
NI LabVIEW SignalExpress 3.0 Licenses
NI LabVIEW SignalExpress 3.0 Steps
NI LabVIEW SignalExpress 3.0 Tools
NI LabVIEW TEDS Installer
NI LabVIEW Web Server
NI LabVIEW Web Server for Run-Time Engine
NI LabVIEW Web Services Runtime
NI LabWindows/CVI 8.5.1 Run-Time Engine
NI LabWindows/CVI Code Generator
NI Legacy DAQmxRF
NI License Manager
NI Light Weight PSP Control Environment
NI Logos 5.0
NI Logos LabVIEW 8.2 Support
NI Logos LabVIEW 8.6 Support
NI Logos XT Support
NI LVBrokerAux 8.2.1
NI LVBrokerAux 8.5.0
NI LVBrokerAux 8.6.0
NI LVBrokerAux1071
NI LVBrokerAux61
NI LVBrokerAux70
NI LVBrokerAux71
NI LVBrokerAux8.0
NI Math Kernel Libraries
NI MAX LabVIEW Support
NI MDF Support
NI mDNS Responder 1.0.0
NI Measurement & Automation Explorer 4.5
NI Measurement Studio 8.1 Enterprise RunTime for VS2005
NI Measurement Studio Common .NET Language Assemblies for the .NET Framework 1.1
NI Measurement Studio Common .NET Language Assemblies for the .NET Framework 2.0
NI Measurement Studio Recipe Processor
NI MIO Device Drivers 1.15.0
NI ModInst 1.4.3
NI MXS
NI MXS 4.5.0f0 for LabVIEW Real-Time
NI OCR Upgrade Manager
NI OPC Support
NI Portable Configuration
NI PXI-5660 Support
NI PXI Platform Framework 1.0.1
NI PXI Platform Framework 1.0.1 for Phar Lap ETS
NI PXI Platform Services 2.4.2
NI PXI Platform Services 2.4.2 Configuration Support
NI PXI Platform Services 2.4.2 Expert
NI PXI Platform Services 2.4.2 Expert for LabVIEW Real-Time
NI PXI Platform Services 2.4.2 for LabVIEW Real-Time
NI PXI Platform Services for LabVIEW Real-Time 2.1.0
NI R Series 3.1.0
NI R Series LabVIEW 8.6 Support
NI R Series LabVIEW Support
NI Registration Wizard
NI Remote Provider for MAX
NI Remote PXI Provider for MAX
NI Script Editor 1.3.1
NI SCXI 1.9.1
NI Service Locator
NI Software Provider for MAX
NI Sound and Vibration Frequency Analysis 7.0
NI Sound and Vibration Frequency Analysis LabVIEW 8.2 Support
NI Sound and Vibration Frequency Analysis LabVIEW 8.6 Support
NI Spy 2.6.0
NI STC 1.2.0
NI TDMS
NI TDMS RT
NI Timing Installer 1.12.0
NI Trace Engine
NI Uninstaller
NI USI 1.5.1
NI Variable Engine
NI Variable Engine LabVIEW 8.2.1 Support
NI Variable Engine LabVIEW 8.6 Support
NI Variable Manager
NI VC2005MSMs x86
NI Vision 8.6 Run-Time Engine
NI Vision 8.6.0
NI Vision Acquisition Express VI
NI Vision Assistant 7.1.1
NI Vision Assistant 8.6
NI Web Pipeline
NI Xerces Delay Load 2.7
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Origin7
PowerDVD
QuickTime
ResearchSoft Direct Export Helper
Rhapsody
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio Express Labeler 3
Roxio Update Manager
Samsung Auto Backup
Seagate Manager Installer
SearchAssist
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB2288953)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Skype™ 4.2
Sonic CinePlayer Decoder Pack
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
Symantec Client Security
TBS WMP Plug-in
Traditional NI-DAQ 7.4.4 (Legacy)
Traditional NI-DAQ Documentation
UCSF Chimera production version 1.4.1 (build 30365)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Outlook 2007 Junk Email Filter (KB2466076)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinRAR archiver
WinSCP 4.1.7
Xvid 1.1.3 final uninstall

==== Event Viewer Messages From Past Week ========

12/31/2010 6:16:25 PM, error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.
12/31/2010 5:15:29 PM, error: Service Control Manager [7024] - The NI PXI Resource Manager service terminated with service-specific error 4294967295 (0xFFFFFFFF).
1/5/2011 3:28:50 PM, error: System Error [1003] - Error code 1000000a, parameter1 00461000, parameter2 0000001c, parameter3 00000000, parameter4 80615ab5.

==== End Of File ===========================

[km2357]

Since GMER didn't work, we'll try another rootkit scanner in its place.


Step # 1: Download and Run RKUnHooker

• Please Download Rootkit Unhooker Save it to your desktop.
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers, Stealth. Uncheck the rest. then Click OK.
• Wait till the scanner has finished and then click File, Save Report.
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

[crape42]

The report is attached below. The electrical transformer for my building is being replaced tomorrow so I won't be able to do anything between 12am - 5 pm my time (8:00 GMT 07-01-2011 to 1:00 GMT 08-01-2011).

--craig




RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xB8361000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 7442432 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 169.26 )
0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 5775360 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 169.26 )
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xA36BA000 C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110105.003\navex15.sys 1355776 bytes (Symantec Corporation, AV Engine)
0xA7F54000 C:\WINDOWS\System32\Drivers\dump_iaStor.sys 819200 bytes
0xB9E5B000 iaStor.sys 819200 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)
0xA68F1000 C:\WINDOWS\System32\Drivers\Nidaq32k.SYS 696320 bytes (National Instruments Corporation, NI-DAQ Windows NT Kernel Driver)
0xB9D5D000 nipalk.sys 647168 bytes (National Instruments Corporation, NI-PAL Driver for Windows)
0xB9CA3000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA8097000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xA8132000 C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 413696 bytes (Symantec Corporation, SPBBC Driver)
0xAACC1000 C:\WINDOWS\system32\drivers\Senfilt.sys 393216 bytes (Sensaura, Sensaura WDM 3D Audio Driver)
0xA8039000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0xB81E9000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xA82AD000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA84CE000 C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys 360448 bytes (Symantec Corporation, AutoProtect)
0xA7381000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xAAD45000 C:\WINDOWS\system32\drivers\ADIHdAud.sys 319488 bytes (Analog Devices, Inc., High Definition Audio Function Driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA81E1000 C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20101215.002\symidsco.sys 290816 bytes (Symantec Corporation, IDS Core Driver)
0xA6A3B000 C:\WINDOWS\system32\drivers\nimru2k.dll 270336 bytes (National Instruments Corporation, NI Measurement Routing Utilities)
0xA63C5000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xA706F000 C:\WINDOWS\system32\drivers\nimxdfk.dll 249856 bytes (National Instruments Corporation, NI mx Driver Framework)
0xA8274000 C:\WINDOWS\System32\Drivers\SYMTDI.SYS 233472 bytes (Symantec Corporation, Network Dispatch Driver)
0xA70AC000 C:\WINDOWS\system32\drivers\nimdbgk.dll 196608 bytes (National Instruments Corporation, NI Measurements DeBuG Library)
0xB8247000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA7665000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB9D30000 C:\WINDOWS\System32\drivers\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB82D6000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 176128 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.)
0xA7030000 C:\WINDOWS\system32\drivers\nidimk.dll 176128 bytes (National Instruments Corporation, NI Device Interconnect Manager)
0xA8107000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB8301000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xA81B9000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xA824E000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xA8228000 C:\WINDOWS\System32\Drivers\SYMFW.SYS 155648 bytes (Symantec Corporation, Firewall Filter Driver)
0xA3ED0000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xAAD21000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB8329000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB82B3000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xA8197000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xA84AC000 C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 139264 bytes (Symantec Corporation, Symantec Event Library)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB9E3B000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xA7010000 C:\WINDOWS\system32\drivers\nistck.dll 131072 bytes (National Instruments Corporation, STC Manager for Windows (Kernel))
0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xA801C000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0xB9C89000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xA7D3B000 C:\WINDOWS\System32\Drivers\DLAIFS_M.SYS 102400 bytes (Roxio, Drive Letter Access Component)
0xA48B7000 C:\DOCUME~1\Craig\LOCALS~1\Temp\ugtdrpod.sys 98304 bytes
0xA7D0E000 C:\WINDOWS\System32\Drivers\DLAUDF_M.SYS 94208 bytes (Roxio, Drive Letter Access Component)
0xB9E12000 DRVMCDB.SYS 94208 bytes (Sonic Solutions, Device Driver)
0xB9DFB000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB8288000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA7D25000 C:\WINDOWS\System32\Drivers\DLAUDFAM.SYS 90112 bytes (Roxio, Drive Letter Access Component)
0xA78C1000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xA36A6000 C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110105.003\naveng.sys 81920 bytes (Symantec Corporation, AV Engine)
0xA705B000 C:\WINDOWS\system32\drivers\nipxirmk.dll 81920 bytes (National Instruments Corporation, NI PXI Resource Manager)
0xB829F000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xA8498000 C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys 81920 bytes (Symantec Corporation, SAVRTPEL)
0xB834D000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xA8306000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB9E29000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xA68E0000 C:\WINDOWS\system32\drivers\nidmmk.dll 69632 bytes (National Instruments Corporation, NIDMM Kernel Mode Component for WinNT/2k)
0xA6FAE000 C:\WINDOWS\system32\drivers\nimstsk.dll 69632 bytes (National Instruments Corporation, NI Measurements Status Component)
0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB8277000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xBA298000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xB8E9E000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB8EDE000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)
0xBA108000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xB8EBE000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xB6E5F000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)
0xB0317000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xB8E8E000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA792E000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xB2B38000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xB8EFE000 C:\WINDOWS\system32\drivers\vid21394_4012.sys 61440 bytes (OEM, Video 2 1394 WDM Driver)
0xBA118000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xA72B5000 C:\WINDOWS\system32\drivers\niorbk.dll 57344 bytes (National Instruments Corporation, NI Object Request Broker)
0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xB8ECE000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xB02F7000 C:\WINDOWS\system32\drivers\niarbk.dll 53248 bytes (National Instruments Corporation, NI-ARB Kernel Library for Windows)
0xB8D59000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xB8EEE000 C:\WINDOWS\system32\drivers\STREAM.SYS 53248 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xB8D39000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xBA2E8000 C:\WINDOWS\System32\Drivers\SYMIDS.SYS 49152 bytes (Symantec Corporation, IDS Filter Driver)
0xAE953000 C:\WINDOWS\System32\Drivers\DRVNDDM.SYS 45056 bytes (Roxio, Device Driver Manager)
0xB6E2F000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xB8EAE000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xA72A5000 C:\WINDOWS\system32\drivers\nimdsk.dll 45056 bytes (National Instruments Corporation, NI-MDS Kernel Library for Windows)
0xB8D49000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xB5E98000 C:\WINDOWS\System32\Drivers\SYMNDIS.SYS 45056 bytes (Symantec Corporation, NDIS Filter Driver)
0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB2B78000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xBA0F8000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xBA1E8000 C:\WINDOWS\System32\Drivers\SYMREDRV.SYS 40960 bytes (Symantec Corporation, Redirector Filter Driver)
0xB8D19000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xB6DEF000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB8F0E000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xB8D29000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xB6C29000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA7831000 C:\WINDOWS\system32\drivers\nibffrk.dll 36864 bytes (National Instruments Corporation, NI Buffer Services Kernel Library for Windows)
0xA4B8C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xAE963000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xBA3C8000 C:\WINDOWS\System32\Drivers\DLABMFSM.SYS 32768 bytes (Roxio, Drive Letter Access Component)
0xBA328000 nipbcfk.sys 32768 bytes (National Instruments Corporation, NI PCI Bridge Class Filter)
0xBA448000 C:\WINDOWS\System32\drivers\NiViPxiK.sys 32768 bytes (National Instruments Corporation, NI-VISA Kernel Component for PXI)
0xBA3E8000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xBA400000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA3D0000 C:\WINDOWS\System32\Drivers\DLABOIOM.SYS 28672 bytes (Roxio, Drive Letter Access Component)
0xBA3B8000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xB076F000 C:\DOCUME~1\Craig\LOCALS~1\Temp\mbr.sys 28672 bytes
0xB07AF000 C:\WINDOWS\System32\Drivers\SYMDNS.SYS 28672 bytes (Symantec Corporation, DNS Filter Driver)
0xB2A80000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xBA3C0000 C:\WINDOWS\System32\Drivers\DLAOPIOM.SYS 24576 bytes (Roxio, Drive Letter Access Component)
0xBA428000 C:\WINDOWS\System32\Drivers\DLARTL_M.SYS 24576 bytes (Roxio, Shared Driver Component)
0xBA420000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA408000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xBA3A0000 C:\WINDOWS\system32\drivers\nidimkl.sys 24576 bytes (National Instruments Corporation, NI Device Interconnect Manager)
0xBA4A0000 C:\WINDOWS\system32\drivers\nimdbgkl.sys 24576 bytes (National Instruments Corporation, NI Measurements DeBuG Library)
0xB2A78000 C:\WINDOWS\system32\drivers\nimru2kl.sys 24576 bytes (National Instruments Corporation, NI Measurement Routing Utilities)
0xBA468000 C:\WINDOWS\system32\drivers\nimstskl.sys 24576 bytes (National Instruments Corporation, NI Measurements Status Component)
0xB55D1000 C:\WINDOWS\system32\drivers\nimxdfkl.sys 24576 bytes (National Instruments Corporation, NI mx Driver Framework)
0xB2A88000 C:\WINDOWS\system32\drivers\niorbkl.sys 24576 bytes (National Instruments Corporation, NI Object Request Broker)
0xB2A68000 C:\WINDOWS\system32\drivers\nipxirmkl.sys 24576 bytes (National Instruments Corporation, NI PXI Resource Manager)
0xBA440000 C:\WINDOWS\System32\drivers\NiViPxiKl.sys 24576 bytes (National Instruments Corporation, NI-VISA Kernel Component for PXI)
0xBA3F8000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xBA478000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xBA3A8000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xBA410000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xBA418000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xBA338000 C:\WINDOWS\System32\drivers\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xBA3D8000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xB4614000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA588000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xB2AF4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB971A000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xB5A29000 C:\WINDOWS\System32\Drivers\DLAPoolM.SYS 12288 bytes (Roxio, Drive Letter Access Component)
0xB5F23000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xB5F2B000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xB9722000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xB9712000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB8A86000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xBA64E000 C:\Program Files\Broadcom\ASFIPMon\BASFND.sys 8192 bytes (Broadcom Corporation, Broadcom NetDetect Driver.)
0xBA5D8000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xBA5AE000 DLACDBHM.SYS 8192 bytes (Roxio, Shared Driver Component)
0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xBA5CC000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xBA5E4000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xBA5EC000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xBA5E6000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xBA60C000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xBA711000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xBA6D7000 C:\WINDOWS\System32\Drivers\cvintdrv.SYS 4096 bytes
0xA878D000 C:\WINDOWS\System32\Drivers\DLADResM.SYS 4096 bytes (Roxio, Drive Letter Access Component)
0xBA70F000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xBA7C2000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
==============================================
>Stealth
==============================================

[km2357]

Step # 1: Disable Teatimer

Spybot S&D's tea timer normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.

This is a two step process.
First step:

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
• If you have the version 1.5 or 1.6, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
• If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

• Open Spybot S&D
• Click Mode, choose Advanced Mode
• Go To the bottom of the Vertical Panel on the Left, Click Tools
• then, also in left panel, click Resident shows a red/white shield.
• If your firewall raises a question, say OK
• In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
• OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine for the changes to take effect.

Step # 2 Download HostsXpert

Download HostsXpert and unzip it to your desktop.

Open HostsXpert that you earlier unzipped on your Desktop.

• Click "Make Hosts Writable?" upper right corner (if available)
• Click "Restore Microsoft's Original Hosts File" and then click OK
• Close HostsXpert

Note; IF you used any custom Hosts (eg. MVPS Hosts), you will have put them back manually


Step # 3: Download and Run ComboFix

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

*Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

When finished, it shall produce a log for you. Please post C:\ComboFix.txt in your next reply.

[crape42]

Here is the Combofix log:



ComboFix 11-01-06.03 - Craig 01/06/2011 15:30:07.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2605 [GMT -8:00]
Running from: c:\documents and settings\Craig\Desktop\Downloads\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *Disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Craig\Application Data\cleanmgr.exe
c:\documents and settings\Craig\Recent\020410B2LinearAnalyzed.mat
c:\documents and settings\Craig\Recent\1104B6LinearAnalyzed.mat
c:\windows\system32\Core.dll

.
((((((((((((((((((((((((( Files Created from 2010-12-06 to 2011-01-06 )))))))))))))))))))))))))))))))
.

2011-01-04 22:43 . 2011-01-04 22:43 -------- d-----w- c:\program files\DIFX
2011-01-04 22:43 . 2010-09-20 20:07 1306176 ----a-w- c:\windows\system32\drivers\uc480.sys
2011-01-04 22:43 . 2010-09-20 20:07 1303616 ----a-w- c:\windows\system32\drivers\uc480_boot.sys
2011-01-03 22:59 . 2010-11-13 02:53 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-03 22:59 . 2010-11-13 02:53 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-01-03 22:28 . 2011-01-03 22:28 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-01-03 22:28 . 2011-01-03 22:28 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-01-03 22:26 . 2011-01-03 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2011-01-03 22:25 . 2011-01-03 22:25 -------- d-----w- c:\program files\Common Files\Apple
2011-01-03 22:25 . 2011-01-03 22:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2011-01-01 01:45 . 2011-01-01 01:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-01-01 01:45 . 2011-01-01 01:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-01-01 01:38 . 2011-01-01 01:38 -------- d-----w- c:\program files\ERUNT
2010-12-18 01:45 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-18 01:44 . 2010-10-11 14:59 45568 ------w- c:\windows\system32\dllcache\wab.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-30 01:38 . 2010-11-30 01:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38 . 2010-11-30 01:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-18 18:12 . 2004-08-11 22:12 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-13 00:34 . 2008-08-21 00:21 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26 . 2004-08-11 22:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2004-08-11 22:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2004-08-11 22:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2004-08-11 22:00 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2004-08-11 22:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2004-08-11 22:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2004-08-11 22:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2008-02-08 04:46 . 2008-02-08 04:46 13624 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-02-08 04:46 . 2008-02-08 04:46 87360 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-02-08 04:46 . 2008-02-08 04:46 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-02-08 04:46 . 2008-02-08 04:46 21824 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-02-08 04:46 . 2008-02-08 04:46 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-02-08 04:46 . 2008-02-08 04:46 31544 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-02-08 04:46 . 2008-02-08 04:46 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2007-03-17 00:27 . 2007-03-17 00:27 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2007-03-17 00:27 . 2007-03-17 00:27 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2007-03-17 00:27 . 2007-03-17 00:27 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2007-07-20 19:47 . 2007-07-20 19:47 981170 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-02-08 04:46 . 2008-02-08 04:46 24384 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2004-03-16 00:51 . 2004-03-16 00:51 114688 ----a-w- c:\program files\internet explorer\plugins\LV71ActiveXControl.dll
2003-05-01 17:36 . 2003-05-01 17:36 114688 ----a-w- c:\program files\internet explorer\plugins\LV7ActiveXControl.dll
2006-01-23 17:32 . 2006-01-23 17:32 131072 ----a-w- c:\program files\internet explorer\plugins\LV80ActiveXControl.dll
2007-02-08 17:48 . 2007-02-08 17:48 133920 ----a-w- c:\program files\internet explorer\plugins\LV82ActiveXControl.dll
2007-07-25 02:03 . 2007-07-25 02:03 118784 ----a-w- c:\program files\internet explorer\plugins\LV85ActiveXControl.dll
2008-12-10 22:50 . 2008-12-10 22:50 118784 ----a-w- c:\program files\internet explorer\plugins\LV86ActiveXControl.dll
2001-12-14 04:56 . 2001-12-14 04:56 98304 ----a-w- c:\program files\internet explorer\plugins\LVActiveXControl.dll
2010-09-08 21:58 . 2009-12-15 22:03 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"Google Update"="c:\documents and settings\Craig\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-20 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-21 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-13 8523776]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-09-11 1015808]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-08 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-26 17920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 52840]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe" [2007-10-08 125368]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AdobeVersionCue"="c:\program files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2004-03-25 1732608]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"niDevMon"="c:\program files\National Instruments\NI-DAQ\HWConfig\nidevmon.exe" [2008-07-28 106576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]

c:\documents and settings\Craig\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
Samsung Auto Backup Guage.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFGuage.exe [2010-5-24 888832]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2010-5-24 77824]
Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2010-5-24 94208]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-9-17 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\National Instruments\\Shared\\mDNS Responder\\nimdnsResponder.exe"=
"c:\\Program Files\\Rhapsody\\rhapsody.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"139:TCP"= 139:TCP:128.32.30.64/255.255.255.224:Enabled:@xpsp2res.dll,-22004
"137:TCP"= 137:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-137:TCP
"445:TCP"= 445:TCP:128.32.30.64/255.255.255.224:Enabled:@xpsp2res.dll,-22005
"23:TCP"= 23:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-23:TCP
"25:TCP"= 25:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-25:TCP
"20:TCP"= 20:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-20:TCP
"113:TCP"= 113:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-113:TCP
"1025:TCP"= 1025:TCP:128.32.30.64/255.255.255.224:Enabled:SNS-1025:TCP
"135:UDP"= 135:UDP:128.32.30.64/255.255.255.224:Enabled:SNS-135:UDP
"137:UDP"= 137:UDP:128.32.30.64/255.255.255.224:Enabled:@xpsp2res.dll,-22001

R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [8/21/2008 8:04 PM 15448]
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [6/20/2007 11:30 AM 79168]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 10:32 PM 189736]
R2 ni488enumsvc;NI-488.2 Enumeration Service;c:\windows\system32\nipalsm.exe [8/21/2008 10:51 PM 12696]
R2 niarbk;niarbk;c:\windows\system32\drivers\niarbk.dll [4/16/2007 3:40 PM 37376]
R2 nibffrk;nibffrk;c:\windows\system32\drivers\nibffrk.dll [4/16/2007 3:40 PM 21504]
R2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [4/16/2007 5:04 PM 674304]
R2 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [8/21/2008 10:51 PM 12696]
R2 nidmmk;NI DMM and Data Logger Kernel Driver;c:\windows\system32\drivers\nidmmk.dll [4/16/2007 5:06 PM 50688]
R2 niLXIDiscovery;National Instruments LXI Discovery Service;c:\vxipnp\WinNT\NIvisa\niLxiDiscovery.exe [6/20/2008 4:53 PM 129144]
R2 nimDNSResponder;National Instruments mDNS Responder Service;c:\program files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [6/18/2008 4:57 PM 192112]
R2 nimdsk;nimdsk;c:\windows\system32\drivers\nimdsk.dll [4/16/2007 3:41 PM 30208]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [6/25/2008 11:01 AM 11344]
R2 nistck;nistck;c:\windows\system32\drivers\niSTCk.dll [4/16/2007 3:42 PM 111616]
R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [6/20/2008 9:27 PM 11360]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [10/7/2007 7:48 PM 116664]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/10/2010 1:11 PM 102448]
R3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [6/13/2008 3:51 PM 11360]
R3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [6/13/2008 3:51 PM 11360]
R3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [7/23/2008 12:54 PM 11360]
R3 VDNG;Video to 1394, WDM Video Capture;c:\windows\system32\drivers\vid21394_4012.sys [9/12/2008 4:25 PM 59520]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/5/2010 4:35 PM 135664]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/20/2008 4:25 PM 30192]
S3 imaq1394k;imaq1394k;c:\windows\system32\drivers\imaq1394kl.sys [6/18/2008 2:33 PM 11480]
S3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [6/23/2008 6:11 PM 20104]
S3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [11/11/2008 1:50 PM 26192]
S3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [11/11/2008 1:52 PM 11344]
S3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [11/11/2008 1:53 PM 22608]
S3 ni488lock;NI-488.2 Locking Service;c:\windows\system32\drivers\ni488lock.sys [9/4/2008 6:04 PM 16456]
S3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [7/24/2008 11:32 AM 11352]
S3 nicsrk;nicsrk;c:\windows\system32\drivers\nicsrkl.sys [7/31/2008 8:21 PM 11336]
S3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [8/1/2008 12:30 PM 11336]
S3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [7/25/2008 11:04 AM 11344]
S3 nidwgk;nidwgk;c:\windows\system32\drivers\nidwgkl.sys [8/26/2008 6:45 PM 11360]
S3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [7/31/2008 8:21 PM 11336]
S3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [7/31/2008 8:21 PM 11336]
S3 nifslk;nifslk;c:\windows\system32\drivers\nifslkl.sys [7/29/2008 7:21 PM 11352]
S3 nigplk;nigplk;c:\windows\system32\drivers\nigplkl.sys [6/16/2008 3:21 PM 11640]
S3 nihsdrk;nihsdrk;c:\windows\system32\drivers\nihsdrkl.sys [7/16/2008 10:51 AM 11352]
S3 niimaqdxk;niimaqdxk;c:\windows\system32\drivers\niimaqdxkl.sys [6/23/2008 11:11 AM 11320]
S3 niimaqk;NI-IMAQ Driver;c:\windows\system32\drivers\niimaqk.sys --> c:\windows\system32\drivers\niimaqk.sys [?]
S3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [7/23/2008 1:00 PM 11392]
S3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [4/4/2007 9:06 AM 14464]
S3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [4/4/2007 9:06 AM 151683]
S3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [7/23/2008 12:55 PM 11368]
S3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [7/30/2008 9:58 AM 11360]
S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [12/16/2008 1:57 AM 11904]
S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [12/16/2008 1:55 AM 11896]
S3 nipsdk;nipsdk;c:\windows\system32\drivers\nipsdkl.sys [6/2/2008 2:39 PM 11392]
S3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [6/25/2008 11:02 AM 20568]
S3 nirfsa2k;nirfsa2k;c:\windows\system32\drivers\niRFSA2kl.sys [7/16/2008 4:51 PM 11328]
S3 niRFSGk;niRFSGk;c:\windows\system32\drivers\niRFSGkl.sys [7/18/2008 4:22 PM 11328]
S3 NiRioRpc;National Instruments RIO Server;c:\windows\system32\NiRioRpc.exe [12/23/2008 4:20 PM 27720]
S3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [7/30/2008 4:26 AM 11376]
S3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [8/7/2008 5:23 PM 11352]
S3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [7/30/2008 9:59 AM 11344]
S3 nisldk;nisldk;c:\windows\system32\drivers\nisldkl.sys [6/2/2008 6:56 PM 11344]
S3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [7/30/2008 4:26 AM 11376]
S3 nisrcdk;nisrcdk;c:\windows\system32\drivers\nisrcdkl.sys [7/11/2008 10:41 AM 11352]
S3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [7/31/2008 8:21 PM 11336]
S3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [7/25/2008 9:44 AM 11312]
S3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [7/25/2008 9:44 AM 11360]
S3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [7/28/2008 3:08 PM 11336]
S3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [7/24/2008 5:38 PM 11360]
S3 nitnr2k;nitnr2k;c:\windows\system32\drivers\nitnr2kl.sys [7/16/2008 1:18 PM 11328]
S3 niufurk;niufurk;c:\windows\system32\drivers\niufurkl.sys [7/31/2008 8:21 PM 11368]
S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [6/20/2008 9:28 PM 11384]
S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [6/20/2008 9:27 PM 11360]
S3 niwdk;niwdk;c:\windows\system32\drivers\niwdk.sys [12/15/2008 11:35 AM 27744]
S3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [7/31/2008 8:21 PM 11336]
S3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [7/31/2008 8:21 PM 11336]
S3 uc480;uc480 kernel driver;c:\windows\system32\drivers\uc480.sys [1/4/2011 2:43 PM 1306176]
S3 uc480_boot;uc480 boot driver;c:\windows\system32\drivers\uc480_boot.sys [1/4/2011 2:43 PM 1303616]
S3 usb6xxxk;usb6xxxk;\??\c:\windows\system32\drivers\usb6xxxkl.sys --> c:\windows\system32\drivers\usb6xxxkl.sys [?]
S4 Agp88lr70-cn;Agp88lr70-cn; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{439113CE-2797-47E8-BA3D-03F300777207}]
2007-04-29 07:24 99960 ----a-w- c:\program files\Hummingbird\Connectivity\13.00\Accessories\HumSettings.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{72B7C0F0-6036-48D7-A0C9-4FF886785E15}]
2007-04-29 07:24 99960 ----a-w- c:\program files\Hummingbird\Connectivity\13.00\Accessories\HumSettings.exe
.
Contents of the 'Scheduled Tasks' folder

2011-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 20:34]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 00:35]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-06 00:35]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1032557538-2433304080-3904741746-1005Core.job
- c:\documents and settings\Craig\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-20 20:29]

2011-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1032557538-2433304080-3904741746-1005UA.job
- c:\documents and settings\Craig\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-20 20:29]

2011-01-06 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 23:07]
.
.
------- Supplementary Scan -------
.
uStart Page = http://www.google.com/ig/dell?hl=en&...us&ibd=6080821
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080821
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Craig\Application Data\Mozilla\Firefox\Profiles\zwijfs5v.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-cleanmgr - c:\documents and settings\Craig\Application Data\cleanmgr.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-06 15:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4260)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Hummingbird\Connectivity\13.00\Hummingbird Neighborhood\heshell.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\program files\common files\roxio shared\9.0\dllshared\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\program files\WinSCP\DragExt.dll
c:\program files\Hummingbird\Connectivity\13.00\Hummingbird Neighborhood\hncomlib.dll
c:\program files\Hummingbird\Connectivity\13.00\Hummingbird Neighborhood\humprdfw.dll
c:\program files\Hummingbird\Connectivity\13.00\Accessories\Humpud.dll
c:\program files\hummingbird\connectivity\13.00\accessories\humsettings.eng.nls
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lkcitdl.exe
c:\windows\system32\lkads.exe
c:\windows\system32\lktsrv.exe
c:\program files\National Instruments\MAX\nimxs.exe
c:\program files\National Instruments\Shared\Security\nidmsrv.exe
c:\windows\system32\nisvcloc.exe
c:\program files\National Instruments\Shared\Tagger\tagsrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2011-01-06 15:42:06 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-06 23:42

Pre-Run: 126,780,358,656 bytes free
Post-Run: 126,724,792,320 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30

- - End Of File - - 12FCB2E9DA242922BA5EB176382B75CC

[crape42]

The redirect problem seems to be fixed in both Chrome and IE. Is there anything else I should worry about?

[crape42]

Thank you so much!

[km2357]

The redirect problem seems to be fixed in both Chrome and IE. Is there anything else I should worry about?

Great to hear that the redirect problem seems to be fixed.

We're not done yet, we still have a few more steps to do.


Step # 1 Remove old versions of Java

Older Java versions have vulnerabilities and need to be removed.

Go to Start-Settings-Control Panel, click on Add Remove Programs. If any of the following programs are listed there, click on the program to highlight it, and click on remove. Then close the Control Panel.

Java(TM) 6 Update 5

Reboot your Computer.




Step # 2: Download and Run ATF Cleaner
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.



Step # 3 Download and Run Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


In your next post/reply, I need to see the following:

1. MalwareBytes' Log
2. A fresh DDS Log