Page 1 of 3 123 LastLast
Results 1 to 10 of 24

Thread: Infected

  1. #1
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default Infected

    I am posting the DDS Logs:
    DS (Ver_11-05-19.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702
    Run by HP_Administrator at 16:55:02 on 2011-05-28
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2193 [GMT -4:00]
    .
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\AWS\WeatherBug\Weather.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    C:\WINDOWS\System32\svchost.exe -k Akamai
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Comodo\CBOClean\BOCORE.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft\BingBar\SeaPort.EXE
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\BYG9XJLE\dds[1].scr
    C:\WINDOWS\system32\WSCRIPT.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.refdesk.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: CatcherBHO Class: {9b4df450-dcc7-4b07-935d-0cd757a64583} - c:\program files\moyea\youtube flv downloader\MoyeaCatcher.dll
    BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    TB: {4064EA35-578D-4073-A834-C96D82CBCF40} - No File
    TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\hp_administrator\start menu\programs\imvu\Run IMVU.lnk
    IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: netflix.com\www
    Trusted Zone: turbotax.com
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/6/7/5/675d28f5-2a8e-4bac-bd9b-ee147f352714/OGAControl.cab
    DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab
    DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} - hxxp://o.aolcdn.com/pictures/ap/Resources/2.0.8.98/cab/aolpPlugins.10.6.0.6.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
    DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} - hxxp://rd1.surfernetwork.com/surferplugin.ocx
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160778582500
    DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
    DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} - hxxps://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab
    DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} - hxxp://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
    DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5205/mcfscan.cab
    DPF: {F55C25D3-D16A-11D3-81DF-00A0C91F5E7D} - hxxp://www.kiddonet.com/kiddonet/GtekPrt.ocx
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-30 64288]
    R0 XMS1563K;XMS1563K;c:\windows\system32\drivers\XMS1563K.SYS [2005-11-12 49692]
    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-14 11608]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-10 14336]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-14 136360]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-14 269480]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-14 61960]
    R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-1-13 73472]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 2151128]
    R2 LF30FS;LF30FS;c:\program files\everstrike software\lock folder xp 3.6\LF30XP.sys [2004-11-19 101488]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-1-26 50704]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    S0 MFX;MFX; [x]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\common files\binarysense\disksvc.exe" --> c:\program files\common files\binarysense\disksvc.exe [?]
    S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
    S3 cpuz132;cpuz132;\??\c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15232]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
    S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]
    S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys --> c:\windows\system32\drivers\TMPassthru.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S3 XET1001Sp50;XET1001Sp50 NDIS Protocol Driver;c:\windows\system32\drivers\xet1001sp50.sys --> c:\windows\system32\drivers\XET1001Sp50.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-05-28 19:09:30 340480 ---ha-w- c:\documents and settings\all users\application data\21159716.exe
    2011-05-28 17:28:09 432128 ---ha-w- c:\documents and settings\all users\application data\LoBoUYvVYw.exe
    2011-05-27 07:08:41 6962000 ---ha-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{dab2bec2-b80e-47c9-abf8-0015cf630183}\mpengine.dll
    2011-05-16 01:49:52 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    ==================== Find3M ====================
    .
    2011-04-18 10:23:39 16432 ---ha-w- c:\windows\system32\lsdelete.exe
    2011-03-07 05:33:50 692736 ---ha-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:37:06 420864 ---ha-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:21:11 1857920 ---ha-w- c:\windows\system32\win32k.sys
    2011-02-11 01:29:07 1886800 ---ha-w- c:\program files\Install_Flash_Player_10_ActiveX.exe
    2005-11-30 01:33:00 2217472 ---ha-w- c:\program files\dcut.msi
    2005-11-25 10:15:56 1316026 ---ha-w- c:\program files\DVDFabDecrypter29.exe
    .
    ============= FINISH: 16:56:54.53 ===============

  2. #2
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,296

    Default

    Hi,

    Download GMER here by clicking download exe -button and then saving it your desktop:
    • Double-click .exe that you downloaded
    • Click rootkit-tab, uncheck files option and then click scan.
    • Don't check
      Show All
      box while scanning in progress!
    • When scanning is ready, click Copy.
    • This copies log to clipboard
    • Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply. Post fresh dds logs too.
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    Hi Blade81,

    I am not able to zip files.

    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-06-04 08:31:15
    Windows 5.1.2600 Service Pack 3
    Running: bnev5b9h.exe; Driver: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\kwwcypod.sys


    ---- System - GMER 1.0.15 ----

    SSDT A5C82C4E ZwCreateKey
    SSDT A5C82C44 ZwCreateThread
    SSDT A5C82C53 ZwDeleteKey
    SSDT A5C82C5D ZwDeleteValueKey
    SSDT A5C82C62 ZwLoadKey
    SSDT A5C82C30 ZwOpenProcess
    SSDT A5C82C35 ZwOpenThread
    SSDT A5C82C6C ZwReplaceKey
    SSDT A5C82C67 ZwRestoreKey
    SSDT A5C82C58 ZwSetValueKey
    SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xA2E92620]

    ---- Kernel code sections - GMER 1.0.15 ----

    ? pdmy.sys The system cannot find the file specified. !
    INITc VolSnap.sys BA0E3BD0 4 Bytes [B0, A5, 53, 80]
    INITc VolSnap.sys BA0E3BF8 4 Bytes [B8, A1, 4F, 80]
    INITc VolSnap.sys BA0E3C20 4 Bytes [B6, AE, 4F, 80]
    INITc VolSnap.sys BA0E3C48 4 Bytes [30, FF, 4F, 80]
    INITc VolSnap.sys BA0E3C70 4 Bytes [7A, A8, 4F, 80]
    INITc ...

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[608] WININET.dll!HttpAddRequestHeadersA 3D94CF4E 5 Bytes JMP 00E46B70
    .text C:\Program Files\internet explorer\iexplore.exe[608] WININET.dll!HttpAddRequestHeadersW 3D94FE49 5 Bytes JMP 00E46D70
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00D8000A
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D5000A
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00D4000A
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D6000A
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00D7000A
    .text C:\Program Files\internet explorer\iexplore.exe[608] WS2_32.dll!recv 71AB676F 5 Bytes JMP 0059000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WININET.dll!HttpAddRequestHeadersA 3D94CF4E 5 Bytes JMP 00E46B70
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WININET.dll!HttpAddRequestHeadersW 3D94FE49 5 Bytes JMP 00E46D70
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00D9000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D6000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00D5000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D7000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00D8000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3020] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D4000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 01D1000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01CE000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 01A0000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!send 71AB4C27 5 Bytes JMP 01CF000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 01D0000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WS2_32.dll!recv 71AB676F 5 Bytes JMP 019F000A
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WININET.dll!HttpAddRequestHeadersA 3D94CF4E 5 Bytes JMP 00E46B70
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] WININET.dll!HttpAddRequestHeadersW 3D94FE49 5 Bytes JMP 00E46D70
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E5049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E50B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00D9000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D6000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!connect 71AB4A07 5 Bytes JMP 00D5000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D7000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 00D8000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D4000A
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WININET.dll!HttpAddRequestHeadersA 3D94CF4E 5 Bytes JMP 00E46B70
    .text C:\Program Files\internet explorer\iexplore.exe[3580] WININET.dll!HttpAddRequestHeadersW 3D94FE49 5 Bytes JMP 00E46D70

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[3056] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
    IAT C:\Program Files\internet explorer\iexplore.exe[3580] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs LF30XP.sys

    AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)

    Device \FileSystem\Fastfat \FatCdrom LF30XP.sys
    Device \FileSystem\Mup \Dfs LF30XP.sys

    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)

    Device \Driver\AgereSoftModem \Device\AgereModem5 LF30XP.sys
    Device \FileSystem\RAW \Device\RawTape LF30XP.sys
    Device \FileSystem\MRxDAV \Device\WebDavRedirector LF30XP.sys
    Device \Driver\rdpdr \Device\RdpDrPort LF30XP.sys
    Device \Driver\Parport \Device\ParallelPort0 LF30XP.sys
    Device \Driver\rdpdr \Device\RdpDr LF30XP.sys
    Device \FileSystem\Rdbss \Device\FsWrap LF30XP.sys
    Device \Driver\Parport \Device\Parallel0 LF30XP.sys
    Device \FileSystem\Mup \Device\Mup LF30XP.sys
    Device \FileSystem\RAW \Device\RawDisk LF30XP.sys
    Device \Driver\Ptilink \Device\ParTechInc0 LF30XP.sys
    Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver LF30XP.sys
    Device \FileSystem\MRxSmb \Device\LanmanRedirector LF30XP.sys
    Device \FileSystem\Npfs \Device\NamedPipe LF30XP.sys
    Device \FileSystem\Msfs \Device\Mailslot LF30XP.sys
    Device \Driver\AFD \Device\Afd LF30XP.sys
    Device \Driver\AgereSoftModem \Device\AGRSM_xface LF30XP.sys
    Device \FileSystem\RAW \Device\RawCdRom LF30XP.sys
    Device \FileSystem\Mup \Device\WinDfs\Root LF30XP.sys
    Device \FileSystem\Fastfat \Fat LF30XP.sys

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer LF30XP.sys
    Device \FileSystem\avgntflt \FileSystem\Filters\avgntflt LF30XP.sys
    Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer LF30XP.sys
    Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer LF30XP.sys
    Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer LF30XP.sys
    Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer LF30XP.sys
    Device \FileSystem\Cdfs \Cdfs LF30XP.sys

    ---- Threads - GMER 1.0.15 ----

    Thread System [4:132] 8B07EE7A
    Thread System [4:136] 8B081008

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32@ c:\Program Files\Common Files\HP\Memories Disc\2.0\hpodae.dll
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32@InprocServer32 uSiM*whG=?LDyEe5uzk1DocViewerExe>OhfvK{U{2A~2,G1RD0J(?h6w3$o}}19&o=.=l*Ww^GalleryExe>OhfvK{U{2A~2,G1RD0J(?
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ProgID@ hpodae.HPODEECrop.1
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\TypeLib@ {6FF279DD-740F-429D-990A-1BFAE3511B5B}
    Reg HKLM\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\VersionIndependentProgID@ hpodae.HPODEECrop
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x6B 0x65 0x49 0x6A ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
    Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...

    ---- EOF - GMER 1.0.15 ----

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1826 [GMT -4:00]
    .
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\AWS\WeatherBug\Weather.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    C:\WINDOWS\System32\svchost.exe -k Akamai
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Comodo\CBOClean\BOCORE.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Avira\AntiVir Desktop\avnotify.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\WINDOWS\system32\notepad.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.refdesk.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: CatcherBHO Class: {9b4df450-dcc7-4b07-935d-0cd757a64583} - c:\program files\moyea\youtube flv downloader\MoyeaCatcher.dll
    BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
    BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
    TB: {4064EA35-578D-4073-A834-C96D82CBCF40} - No File
    TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\hp_administrator\start menu\programs\imvu\Run IMVU.lnk
    IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: netflix.com\www
    Trusted Zone: turbotax.com
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/6/7/5/675d28f5-2a8e-4bac-bd9b-ee147f352714/OGAControl.cab
    DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab
    DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} - hxxp://o.aolcdn.com/pictures/ap/Resources/2.0.8.98/cab/aolpPlugins.10.6.0.6.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
    DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} - hxxp://rd1.surfernetwork.com/surferplugin.ocx
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160778582500
    DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
    DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} - hxxps://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab
    DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} - hxxp://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
    DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5205/mcfscan.cab
    DPF: {F55C25D3-D16A-11D3-81DF-00A0C91F5E7D} - hxxp://www.kiddonet.com/kiddonet/GtekPrt.ocx
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{A549487F-C10B-49BB-9EE4-246045435D88} : DhcpNameServer = 192.168.1.1
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-30 64288]
    R0 XMS1563K;XMS1563K;c:\windows\system32\drivers\XMS1563K.SYS [2005-11-12 49692]
    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-14 11608]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-10 14336]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-14 136360]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-14 269480]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-14 61960]
    R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-1-13 73472]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 2151128]
    R2 LF30FS;LF30FS;c:\program files\everstrike software\lock folder xp 3.6\LF30XP.sys [2004-11-19 101488]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-9-9 366640]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-1-26 50704]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-3 22712]
    S0 MFX;MFX; [x]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\common files\binarysense\disksvc.exe" --> c:\program files\common files\binarysense\disksvc.exe [?]
    S3 cpuz132;cpuz132;\??\c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15232]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
    S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]
    S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys --> c:\windows\system32\drivers\TMPassthru.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S3 XET1001Sp50;XET1001Sp50 NDIS Protocol Driver;c:\windows\system32\drivers\xet1001sp50.sys --> c:\windows\system32\drivers\XET1001Sp50.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-06-03 21:24:56 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-06-03 06:23:32 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{0cd3597e-60fb-4c58-bb22-29f034edfc0e}\mpengine.dll
    2011-05-16 01:49:52 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    ==================== Find3M ====================
    .
    2011-05-29 13:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-18 10:23:39 16432 ----a-w- c:\windows\system32\lsdelete.exe
    2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-02-11 01:29:07 1886800 ----a-w- c:\program files\Install_Flash_Player_10_ActiveX.exe
    2005-11-30 01:33:00 2217472 ----a-w- c:\program files\dcut.msi
    2005-11-25 10:15:56 1316026 ----a-w- c:\program files\DVDFabDecrypter29.exe
    .
    ============= FINISH: 8:36:05.83 ===============

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-03.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 10/26/2005 7:16:28 PM
    System Uptime: 6/3/2011 2:18:04 AM (30 hours ago)
    .
    Motherboard: ASUSTek Computer INC. | | LITHIUM
    Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Socket 775 | 2800/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 225 GiB total, 94.373 GiB free.
    D: is FIXED (FAT32) - 8 GiB total, 0.857 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    G: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP209: 3/6/2011 11:09:41 AM - System Checkpoint
    RP210: 3/7/2011 12:09:41 PM - System Checkpoint
    RP211: 3/8/2011 1:09:42 PM - System Checkpoint
    RP212: 3/8/2011 2:15:59 PM - Software Distribution Service 3.0
    RP213: 3/8/2011 6:43:57 PM - Software Distribution Service 3.0
    RP214: 3/9/2011 7:01:03 PM - System Checkpoint
    RP215: 3/10/2011 7:37:33 PM - System Checkpoint
    RP216: 3/11/2011 7:00:42 PM - Software Distribution Service 3.0
    RP217: 3/12/2011 8:01:36 PM - System Checkpoint
    RP218: 3/13/2011 9:40:30 PM - System Checkpoint
    RP219: 3/14/2011 10:39:25 PM - System Checkpoint
    RP220: 3/15/2011 5:04:05 AM - Software Distribution Service 3.0
    RP221: 3/16/2011 5:10:59 AM - System Checkpoint
    RP222: 3/16/2011 9:00:20 PM - Software Distribution Service 3.0
    RP223: 3/17/2011 10:43:28 PM - System Checkpoint
    RP224: 3/18/2011 9:53:01 AM - Software Distribution Service 3.0
    RP225: 3/19/2011 10:41:01 AM - System Checkpoint
    RP226: 3/20/2011 12:33:38 PM - System Checkpoint
    RP227: 3/21/2011 12:59:05 PM - System Checkpoint
    RP228: 3/22/2011 1:01:24 PM - System Checkpoint
    RP229: 3/22/2011 1:33:58 PM - Software Distribution Service 3.0
    RP230: 3/23/2011 1:41:45 PM - System Checkpoint
    RP231: 3/23/2011 3:44:15 PM - Software Distribution Service 3.0
    RP232: 3/23/2011 5:02:37 PM - Software Distribution Service 3.0
    RP233: 3/23/2011 5:28:17 PM - Installed WeatherBug
    RP234: 3/24/2011 5:48:03 PM - System Checkpoint
    RP235: 3/25/2011 7:22:23 AM - Software Distribution Service 3.0
    RP236: 3/26/2011 9:30:50 AM - System Checkpoint
    RP237: 3/27/2011 10:03:58 AM - System Checkpoint
    RP238: 3/28/2011 10:17:08 AM - System Checkpoint
    RP239: 3/29/2011 9:34:29 AM - Software Distribution Service 3.0
    RP240: 3/30/2011 10:16:37 AM - System Checkpoint
    RP241: 3/31/2011 11:08:51 AM - System Checkpoint
    RP242: 4/1/2011 12:05:35 PM - System Checkpoint
    RP243: 4/1/2011 3:45:49 PM - Software Distribution Service 3.0
    RP244: 4/2/2011 3:57:47 PM - System Checkpoint
    RP245: 4/3/2011 4:56:35 PM - System Checkpoint
    RP246: 4/4/2011 5:45:59 PM - System Checkpoint
    RP247: 4/5/2011 5:59:48 PM - System Checkpoint
    RP248: 4/5/2011 6:05:16 PM - Software Distribution Service 3.0
    RP249: 4/6/2011 7:10:32 PM - System Checkpoint
    RP250: 4/7/2011 8:23:48 PM - System Checkpoint
    RP251: 4/8/2011 4:46:12 AM - Software Distribution Service 3.0
    RP252: 4/9/2011 5:30:13 AM - System Checkpoint
    RP253: 4/10/2011 6:24:03 AM - System Checkpoint
    RP254: 4/11/2011 7:17:54 AM - System Checkpoint
    RP255: 4/12/2011 6:30:01 AM - Software Distribution Service 3.0
    RP256: 4/13/2011 7:17:55 AM - System Checkpoint
    RP257: 4/14/2011 7:39:37 AM - System Checkpoint
    RP258: 4/14/2011 9:00:34 PM - Software Distribution Service 3.0
    RP259: 4/15/2011 2:11:44 PM - Software Distribution Service 3.0
    RP260: 4/16/2011 3:10:34 PM - System Checkpoint
    RP261: 4/17/2011 4:01:37 PM - System Checkpoint
    RP262: 4/18/2011 7:22:37 PM - System Checkpoint
    RP263: 4/19/2011 4:06:30 PM - Software Distribution Service 3.0
    RP264: 4/20/2011 5:22:37 PM - System Checkpoint
    RP265: 4/21/2011 5:35:10 PM - System Checkpoint
    RP266: 4/21/2011 9:00:19 PM - Software Distribution Service 3.0
    RP267: 4/22/2011 6:09:47 AM - Software Distribution Service 3.0
    RP268: 4/23/2011 7:58:01 AM - System Checkpoint
    RP269: 4/23/2011 7:46:37 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP270: 4/23/2011 8:00:42 PM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP271: 4/23/2011 8:01:19 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP272: 4/24/2011 10:11:17 AM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP273: 4/25/2011 4:47:15 AM - Removed WeatherBug
    RP274: 4/25/2011 4:47:33 AM - Installed WeatherBug
    RP275: 4/26/2011 5:03:12 AM - System Checkpoint
    RP276: 4/26/2011 8:13:03 AM - Software Distribution Service 3.0
    RP277: 4/26/2011 9:00:25 PM - Software Distribution Service 3.0
    RP278: 4/27/2011 9:00:20 PM - Software Distribution Service 3.0
    RP279: 4/28/2011 9:03:07 PM - System Checkpoint
    RP280: 4/29/2011 6:54:41 PM - Software Distribution Service 3.0
    RP281: 4/30/2011 7:51:58 PM - System Checkpoint
    RP282: 5/1/2011 8:42:21 PM - System Checkpoint
    RP283: 5/2/2011 9:49:22 PM - System Checkpoint
    RP284: 5/3/2011 8:55:27 PM - Software Distribution Service 3.0
    RP285: 5/4/2011 8:57:30 PM - System Checkpoint
    RP286: 5/5/2011 9:58:33 PM - System Checkpoint
    RP287: 5/6/2011 8:17:59 AM - Software Distribution Service 3.0
    RP288: 5/7/2011 9:05:01 AM - System Checkpoint
    RP289: 5/8/2011 9:45:25 AM - System Checkpoint
    RP290: 5/9/2011 9:59:36 AM - System Checkpoint
    RP291: 5/10/2011 8:28:30 AM - Software Distribution Service 3.0
    RP292: 5/11/2011 8:59:37 AM - System Checkpoint
    RP293: 5/11/2011 9:00:21 PM - Software Distribution Service 3.0
    RP294: 5/12/2011 9:01:17 PM - System Checkpoint
    RP295: 5/13/2011 7:00:40 PM - Software Distribution Service 3.0
    RP296: 5/14/2011 7:05:52 PM - System Checkpoint
    RP297: 5/15/2011 8:05:56 PM - System Checkpoint
    RP298: 5/16/2011 10:16:51 PM - System Checkpoint
    RP299: 5/17/2011 4:45:27 AM - Software Distribution Service 3.0
    RP300: 5/18/2011 4:58:11 AM - System Checkpoint
    RP301: 5/19/2011 4:58:51 AM - System Checkpoint
    RP302: 5/20/2011 5:00:38 AM - System Checkpoint
    RP303: 5/20/2011 11:12:55 AM - Software Distribution Service 3.0
    RP304: 5/21/2011 12:00:29 PM - System Checkpoint
    RP305: 5/22/2011 1:14:19 PM - System Checkpoint
    RP306: 5/23/2011 2:00:32 PM - System Checkpoint
    RP307: 5/24/2011 3:00:33 PM - System Checkpoint
    RP308: 5/24/2011 6:46:24 PM - Software Distribution Service 3.0
    RP309: 5/25/2011 9:40:43 PM - System Checkpoint
    RP310: 5/26/2011 10:24:17 PM - System Checkpoint
    RP311: 5/27/2011 3:08:39 AM - Software Distribution Service 3.0
    RP312: 5/28/2011 3:42:07 AM - System Checkpoint
    RP313: 5/28/2011 7:59:38 AM - Removed SUPERAntiSpyware Free Edition
    RP314: 5/29/2011 12:41:04 PM - System Checkpoint
    RP315: 5/30/2011 2:29:44 PM - System Checkpoint
    RP316: 5/31/2011 6:34:56 AM - Software Distribution Service 3.0
    RP317: 6/1/2011 11:21:42 AM - System Checkpoint
    RP318: 6/2/2011 11:45:10 AM - System Checkpoint
    RP319: 6/3/2011 2:23:21 AM - Software Distribution Service 3.0
    RP320: 6/4/2011 3:58:52 AM - System Checkpoint
    .
    ==== Installed Programs ======================
    .
    .
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Help Center 2.1
    Adobe Photoshop Elements 5.0
    Adobe Reader 9.4.4
    AIM 6.0
    AiO_Scan
    AiOSoftware
    Akamai NetSession Interface
    allTunes
    Any Sound Recorder 2.35
    AOL Pictures Tools (version 10.6.0.6)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft TotalMedia Backup

  4. #4
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,296

    Default

    Hi,

    Seems that the ending part of attach.txt log didn't get posted. Could you post complete log, please? Also, what are the current symptoms there?
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    Hi Blade81,

    I am being redirected from Google search. Also I seem to not to be able to play any music when on the internet. My program list was blank after the attack but I was able to restore some but not all by using unhide.exe.
    I used ATF Cleaner before running unhide so I probably won't be able to recover anything else.
    This was done when I lost all desktop icons and only had a black screen.
    I ran Spybot first and it found some issues. Not sure how to access that log.
    I then ran Malware.
    Subsequent scans aren't finding anything.
    I will post the the Maleware Log that found the virus:
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6707

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    5/28/2011 11:05:10 PM
    mbam-log-2011-05-28 (23-05-10).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 340881
    Time elapsed: 2 hour(s), 11 minute(s), 59 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 2

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\all users\application data\lobouyvvyw.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
    c:\documents and settings\all users\application data\21159716.exe (Trojan.Agent) -> Delete on reboot.

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-03.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 10/26/2005 7:16:28 PM
    System Uptime: 6/3/2011 2:18:04 AM (33 hours ago)
    .
    Motherboard: ASUSTek Computer INC. | | LITHIUM
    Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Socket 775 | 2800/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 225 GiB total, 94.301 GiB free.
    D: is FIXED (FAT32) - 8 GiB total, 0.857 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    G: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP209: 3/6/2011 11:09:41 AM - System Checkpoint
    RP210: 3/7/2011 12:09:41 PM - System Checkpoint
    RP211: 3/8/2011 1:09:42 PM - System Checkpoint
    RP212: 3/8/2011 2:15:59 PM - Software Distribution Service 3.0
    RP213: 3/8/2011 6:43:57 PM - Software Distribution Service 3.0
    RP214: 3/9/2011 7:01:03 PM - System Checkpoint
    RP215: 3/10/2011 7:37:33 PM - System Checkpoint
    RP216: 3/11/2011 7:00:42 PM - Software Distribution Service 3.0
    RP217: 3/12/2011 8:01:36 PM - System Checkpoint
    RP218: 3/13/2011 9:40:30 PM - System Checkpoint
    RP219: 3/14/2011 10:39:25 PM - System Checkpoint
    RP220: 3/15/2011 5:04:05 AM - Software Distribution Service 3.0
    RP221: 3/16/2011 5:10:59 AM - System Checkpoint
    RP222: 3/16/2011 9:00:20 PM - Software Distribution Service 3.0
    RP223: 3/17/2011 10:43:28 PM - System Checkpoint
    RP224: 3/18/2011 9:53:01 AM - Software Distribution Service 3.0
    RP225: 3/19/2011 10:41:01 AM - System Checkpoint
    RP226: 3/20/2011 12:33:38 PM - System Checkpoint
    RP227: 3/21/2011 12:59:05 PM - System Checkpoint
    RP228: 3/22/2011 1:01:24 PM - System Checkpoint
    RP229: 3/22/2011 1:33:58 PM - Software Distribution Service 3.0
    RP230: 3/23/2011 1:41:45 PM - System Checkpoint
    RP231: 3/23/2011 3:44:15 PM - Software Distribution Service 3.0
    RP232: 3/23/2011 5:02:37 PM - Software Distribution Service 3.0
    RP233: 3/23/2011 5:28:17 PM - Installed WeatherBug
    RP234: 3/24/2011 5:48:03 PM - System Checkpoint
    RP235: 3/25/2011 7:22:23 AM - Software Distribution Service 3.0
    RP236: 3/26/2011 9:30:50 AM - System Checkpoint
    RP237: 3/27/2011 10:03:58 AM - System Checkpoint
    RP238: 3/28/2011 10:17:08 AM - System Checkpoint
    RP239: 3/29/2011 9:34:29 AM - Software Distribution Service 3.0
    RP240: 3/30/2011 10:16:37 AM - System Checkpoint
    RP241: 3/31/2011 11:08:51 AM - System Checkpoint
    RP242: 4/1/2011 12:05:35 PM - System Checkpoint
    RP243: 4/1/2011 3:45:49 PM - Software Distribution Service 3.0
    RP244: 4/2/2011 3:57:47 PM - System Checkpoint
    RP245: 4/3/2011 4:56:35 PM - System Checkpoint
    RP246: 4/4/2011 5:45:59 PM - System Checkpoint
    RP247: 4/5/2011 5:59:48 PM - System Checkpoint
    RP248: 4/5/2011 6:05:16 PM - Software Distribution Service 3.0
    RP249: 4/6/2011 7:10:32 PM - System Checkpoint
    RP250: 4/7/2011 8:23:48 PM - System Checkpoint
    RP251: 4/8/2011 4:46:12 AM - Software Distribution Service 3.0
    RP252: 4/9/2011 5:30:13 AM - System Checkpoint
    RP253: 4/10/2011 6:24:03 AM - System Checkpoint
    RP254: 4/11/2011 7:17:54 AM - System Checkpoint
    RP255: 4/12/2011 6:30:01 AM - Software Distribution Service 3.0
    RP256: 4/13/2011 7:17:55 AM - System Checkpoint
    RP257: 4/14/2011 7:39:37 AM - System Checkpoint
    RP258: 4/14/2011 9:00:34 PM - Software Distribution Service 3.0
    RP259: 4/15/2011 2:11:44 PM - Software Distribution Service 3.0
    RP260: 4/16/2011 3:10:34 PM - System Checkpoint
    RP261: 4/17/2011 4:01:37 PM - System Checkpoint
    RP262: 4/18/2011 7:22:37 PM - System Checkpoint
    RP263: 4/19/2011 4:06:30 PM - Software Distribution Service 3.0
    RP264: 4/20/2011 5:22:37 PM - System Checkpoint
    RP265: 4/21/2011 5:35:10 PM - System Checkpoint
    RP266: 4/21/2011 9:00:19 PM - Software Distribution Service 3.0
    RP267: 4/22/2011 6:09:47 AM - Software Distribution Service 3.0
    RP268: 4/23/2011 7:58:01 AM - System Checkpoint
    RP269: 4/23/2011 7:46:37 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP270: 4/23/2011 8:00:42 PM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP271: 4/23/2011 8:01:19 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP272: 4/24/2011 10:11:17 AM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP273: 4/25/2011 4:47:15 AM - Removed WeatherBug
    RP274: 4/25/2011 4:47:33 AM - Installed WeatherBug
    RP275: 4/26/2011 5:03:12 AM - System Checkpoint
    RP276: 4/26/2011 8:13:03 AM - Software Distribution Service 3.0
    RP277: 4/26/2011 9:00:25 PM - Software Distribution Service 3.0
    RP278: 4/27/2011 9:00:20 PM - Software Distribution Service 3.0
    RP279: 4/28/2011 9:03:07 PM - System Checkpoint
    RP280: 4/29/2011 6:54:41 PM - Software Distribution Service 3.0
    RP281: 4/30/2011 7:51:58 PM - System Checkpoint
    RP282: 5/1/2011 8:42:21 PM - System Checkpoint
    RP283: 5/2/2011 9:49:22 PM - System Checkpoint
    RP284: 5/3/2011 8:55:27 PM - Software Distribution Service 3.0
    RP285: 5/4/2011 8:57:30 PM - System Checkpoint
    RP286: 5/5/2011 9:58:33 PM - System Checkpoint
    RP287: 5/6/2011 8:17:59 AM - Software Distribution Service 3.0
    RP288: 5/7/2011 9:05:01 AM - System Checkpoint
    RP289: 5/8/2011 9:45:25 AM - System Checkpoint
    RP290: 5/9/2011 9:59:36 AM - System Checkpoint
    RP291: 5/10/2011 8:28:30 AM - Software Distribution Service 3.0
    RP292: 5/11/2011 8:59:37 AM - System Checkpoint
    RP293: 5/11/2011 9:00:21 PM - Software Distribution Service 3.0
    RP294: 5/12/2011 9:01:17 PM - System Checkpoint
    RP295: 5/13/2011 7:00:40 PM - Software Distribution Service 3.0
    RP296: 5/14/2011 7:05:52 PM - System Checkpoint
    RP297: 5/15/2011 8:05:56 PM - System Checkpoint
    RP298: 5/16/2011 10:16:51 PM - System Checkpoint
    RP299: 5/17/2011 4:45:27 AM - Software Distribution Service 3.0
    RP300: 5/18/2011 4:58:11 AM - System Checkpoint
    RP301: 5/19/2011 4:58:51 AM - System Checkpoint
    RP302: 5/20/2011 5:00:38 AM - System Checkpoint
    RP303: 5/20/2011 11:12:55 AM - Software Distribution Service 3.0
    RP304: 5/21/2011 12:00:29 PM - System Checkpoint
    RP305: 5/22/2011 1:14:19 PM - System Checkpoint
    RP306: 5/23/2011 2:00:32 PM - System Checkpoint
    RP307: 5/24/2011 3:00:33 PM - System Checkpoint
    RP308: 5/24/2011 6:46:24 PM - Software Distribution Service 3.0
    RP309: 5/25/2011 9:40:43 PM - System Checkpoint
    RP310: 5/26/2011 10:24:17 PM - System Checkpoint
    RP311: 5/27/2011 3:08:39 AM - Software Distribution Service 3.0
    RP312: 5/28/2011 3:42:07 AM - System Checkpoint
    RP313: 5/28/2011 7:59:38 AM - Removed SUPERAntiSpyware Free Edition
    RP314: 5/29/2011 12:41:04 PM - System Checkpoint
    RP315: 5/30/2011 2:29:44 PM - System Checkpoint
    RP316: 5/31/2011 6:34:56 AM - Software Distribution Service 3.0
    RP317: 6/1/2011 11:21:42 AM - System Checkpoint
    RP318: 6/2/2011 11:45:10 AM - System Checkpoint
    RP319: 6/3/2011 2:23:21 AM - Software Distribution Service 3.0
    RP320: 6/4/2011 3:58:52 AM - System Checkpoint
    .
    ==== Installed Programs ======================
    .
    .
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Help Center 2.1
    Adobe Photoshop Elements 5.0
    Adobe Reader 9.4.4
    AIM 6.0
    AiO_Scan
    AiOSoftware
    Akamai NetSession Interface
    allTunes
    Any Sound Recorder 2.35
    AOL Pictures Tools (version 10.6.0.6)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft TotalMedia Backup
    ATI Catalyst Control Center
    ATI Display Driver
    Atomic Clock Sync
    Avira AntiVir Personal - Free Antivirus
    AviSynth 2.5
    Bandwidth Monitor
    Belarc Advisor 7.0
    BOClean
    Bonjour
    Bubble Shooter Premium
    BufferChm
    Button Manager of JMicron
    CCleaner
    Compatibility Pack for the 2007 Office system
    CompuPic
    Copy
    CP_AtenaShokunin1Config
    CP_CalendarTemplates1
    CP_Package_Basic1
    CP_Package_Variety1
    CP_Package_Variety2
    CP_Package_Variety3
    CP_Panorama1Config
    CreativeProjects
    CreativeProjectsTemplates
    CueTour
    dCut
    Desktop Doctor
    Destinations
    DeviceManagementQFolder
    DigitImg
    DiscAPI (Studio 10)
    DocProc
    DocumentViewer
    DocumentViewerQFolder
    DVD Decrypter (Remove Only)
    DVD Shrink 3.2
    DVDFab Decrypter 3.0.4.0
    Easy Internet Sign-up
    ERUNT 1.1j
    ESPN RunTime
    exPressit S.E. 2.1
    Fax
    File Type Assistant
    FLV Player
    FLV Player 2.0 (build 25)
    FREE Hi-Q Recorder 1.92
    Free Sound Recorder
    Free Sound Recorder 2010 v9.2.1
    Garmin Communicator Plugin
    Garmin USB Drivers
    GemMaster Mystic
    GMail Drive Shell Extension
    Google Earth
    Google Update Helper
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB954550-v5)
    HP Boot Optimizer
    HP Deskjet Printer Preload
    HP DigitalMedia Archive
    HP Document Viewer 5.3
    HP Image Zone 5.3
    HP Image Zone for Media Center PC
    HP Imaging Device Functions 5.3
    HP Memories Disc
    HP Multimedia Keyboard Software
    hp photosmart 7600 series
    HP Product Detection
    HP PSC & OfficeJet 5.3.B
    HP Scanjet 4070
    HP Software Update
    HP Solution Center & Imaging Support Tools 5.3
    HP Tunes
    hpg4070
    HPProductAssistant
    HpSdpAppCoreApp
    HPSystemDiagnostics
    HPTunesAddIn
    Image Grabber II
    InstantShare
    InstantShareDevices
    Intel(R) Network Connections Drivers
    IntelliMover Data Transfer Demo
    InterActual Player
    InterVideo WinDVD Player
    iSEEK AnswerWorks English Runtime
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 21
    Kaspersky Online Scanner
    LightScribe 1.4.42.1
    Lock Folder XP 3.6
    Malwarebytes' Anti-Malware version 1.51.0.1200
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Away Mode
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Default Manager
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Location Finder
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Media Content
    Microsoft Office XP Professional
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Windows XP Video Decoder Checkup Utility
    Microsoft Works
    Microsoft XML Parser
    Moyea YouTube FLV Downloader version: 3.1.2.26
    MSN Music Assistant
    MSXML 4.0 SP2 (KB925672)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 and SOAP Toolkit 3.0
    MSXML 4.0 SP2 Parser and SDK
    muvee autoProducer 4.0
    muvee autoProducer unPlugged 1.1 - HPD
    MySpaceIM
    Netflix Movie Viewer
    NewCopy
    Office 2003 Tour
    Otto
    Overland
    PanoStandAlone
    PC-Doctor 5 for Windows
    PhotoGallery
    Photosmart 140,240,7200,7600,7700,7900 Series
    Picture Package Music Transfer
    Pinnacle Instant DVD Recorder
    Pop-Up Stopper Free Edition
    PrintScreen
    proDAD Heroglyph 2.5
    PS2
    PS7600
    PSShortcuts
    PSUsage
    Python 2.2 pywin32 extensions (build 203)
    Python 2.2.3
    QFolder
    Quicken 2005
    QuickProjects
    QuickTime
    RAMRush 1.0.5.817
    RandMap
    RAPID (Studio 10)
    Readme
    RealPlayer
    Realtek High Definition Audio Driver
    RealUpgrade 1.0
    Recuva
    RipIt4Me
    Sandlot Games Client Services
    Scan
    ScannerCopy
    Secunia PSI
    Security Task Manager 1.7h
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2491683)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB923689)
    ShareIns
    SkinsHP1
    SmartSound Quicktracks Plugin
    SolutionCenter
    Sonic Encoders
    Sonic Express Labeler
    Sonic MyDVD Plus
    Sonic RecordNow Audio
    Sonic RecordNow Copy
    Sonic RecordNow Data
    Sonic Update Manager
    Sonic_PrimoSDK
    Sony Picture Utility
    Sony USB Driver
    Speccy
    Spybot - Search & Destroy
    SpywareBlaster 4.3
    Status
    Studio 10
    Studio 10 Bonus DVD
    Sun Download Manager 2.0 (web)
    SUPERAntiSpyware
    Symantec Technical Support Web Controls
    Tracking The Eye.NET
    TrayApp
    TurboTax 2008
    TurboTax 2008 WinPerFedFormset
    TurboTax 2008 WinPerProgramHelp
    TurboTax 2008 WinPerReleaseEngine
    TurboTax 2008 WinPerTaxSupport
    TurboTax 2008 WinPerUserEducation
    TurboTax 2008 wrapper
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wpaiper
    TurboTax 2009 wrapper
    TurboTax Basic 2005
    TurboTax Basic 2006
    TurboTax Deluxe 2007
    TurboTax ItsDeductible 2006
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 7 (KB976749)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Internet Explorer 8 (KB980302)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB971029)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    Updates from HP (remove only)
    URGE
    VC 9.0 Runtime
    Videora iPod Converter 3.05
    Videora iPod nano Converter 3.04
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Virtools 3D Life Player
    Virtual Earth 3D (Beta)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WeatherBug
    WebFldrs XP
    WebReg
    WexTech AnswerWorks
    Windows Defender
    Windows Defender Signatures
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live ID Sign-in Assistant
    Windows Live Local Add-in for Microsoft Office Outlook
    Windows Live OneCare safety scanner
    Windows Resource Kit Tools - SubInAcl.exe
    Windows XP Media Center Edition 2005 KB2502898
    Windows XP Service Pack 3
    WinPcap 4.1.1
    Wisdom-soft ScreenHunter 5.0 Free
    WOT for Internet Explorer
    .
    ==== Event Viewer Messages From Past Week ========
    .
    6/2/2011 8:25:40 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    6/2/2011 8:15:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    6/2/2011 8:13:16 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    6/2/2011 8:13:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    6/2/2011 8:12:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb BANTExt Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV ssmdrv Tcpip
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 7:51:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.
    6/2/2011 7:51:24 PM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/2/2011 7:40:45 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
    5/28/2011 8:00:09 AM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
    5/28/2011 3:44:11 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Intuit Update Service service to connect.
    5/28/2011 3:44:11 PM, error: Service Control Manager [7000] - The Intuit Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/28/2011 3:29:16 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: Access is denied.
    5/28/2011 3:29:16 PM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The specified module could not be found.
    5/28/2011 3:29:16 PM, error: Service Control Manager [7000] - The HDD & SSD access service service failed to start due to the following error: The system cannot find the path specified.
    5/28/2011 3:28:45 PM, error: SRService [104] - The System Restore initialization process failed.
    5/28/2011 3:23:00 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the COM+ System Application service to connect.
    5/28/2011 3:23:00 PM, error: Service Control Manager [7000] - The COM+ System Application service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/28/2011 3:21:54 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service COMSysApp with arguments "" in order to run the server: {ECABAFBC-7F19-11D2-978E-0000F8757E2A}
    5/28/2011 11:08:24 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: fasttx2k IntelIde ViaIde
    5/28/2011 11:08:11 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Live ID Sign-in Assistant service to connect.
    5/28/2011 11:08:11 PM, error: Service Control Manager [7000] - The Windows Live ID Sign-in Assistant service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/28/2011 11:06:54 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
    .
    ==== End Of File ===========================

  6. #6
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,296

    Default

    Hi,

    My program list was blank after the attack but I was able to restore some but not all by using unhide.exe.
    I used ATF Cleaner before running unhide so I probably won't be able to recover anything else.
    True. Two options are: 1) reformat and start from scratch or 2) add items to start menu manually (link).


    1. Download TDSSKiller and extract its contents into a folder in desired location (i.e. c:\tdsskiller).
    2. Execute the file TDSSKiller.exe.
    3. Click Start Scan. If threats are found, select cure and click Continue (tool may prompt for a reboot).
    4. Post back contents of log file in c: drive root (name should be in UtilityName.Version_Date_Time_log.txt format)
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    Hi Blade81,

    I tried running TDDSKiller in normal and then again in safe mode. It doesn't open. I tried on my sons computer and the program would have ran fine.
    I am not too worried about the start menu. I can add manually. My 2 concerns are the search redirect and the loss of sound from a web site.

  8. #8
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,296

    Default

    Hi again,

    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully first.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  9. #9
    Member
    Join Date
    Jan 2008
    Posts
    97

    Default

    Requested logs:
    DDS (Ver_2011-06-03.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702
    Run by HP_Administrator at 9:39:47 on 2011-06-05
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2324 [GMT -4:00]
    .
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    C:\WINDOWS\System32\svchost.exe -k Akamai
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Comodo\CBOClean\BOCORE.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\WINDOWS\System32\svchost.exe -k DComLaunch
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\AWS\WeatherBug\Weather.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.refdesk.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: CatcherBHO Class: {9b4df450-dcc7-4b07-935d-0cd757a64583} - c:\program files\moyea\youtube flv downloader\MoyeaCatcher.dll
    BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
    BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
    TB: {4064EA35-578D-4073-A834-C96D82CBCF40} - No File
    TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\hp_administrator\start menu\programs\imvu\Run IMVU.lnk
    IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: netflix.com\www
    Trusted Zone: turbotax.com
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/6/7/5/675d28f5-2a8e-4bac-bd9b-ee147f352714/OGAControl.cab
    DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/7/0/7/707a44ad-52ad-49af-b7ef-e21b6b0656e4/VirtualEarth3D.cab
    DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} - hxxp://o.aolcdn.com/pictures/ap/Resources/2.0.8.98/cab/aolpPlugins.10.6.0.6.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
    DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} - hxxp://rd1.surfernetwork.com/surferplugin.ocx
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160778582500
    DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
    DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} - hxxps://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab
    DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} - hxxp://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
    DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5205/mcfscan.cab
    DPF: {F55C25D3-D16A-11D3-81DF-00A0C91F5E7D} - hxxp://www.kiddonet.com/kiddonet/GtekPrt.ocx
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{A549487F-C10B-49BB-9EE4-246045435D88} : DhcpNameServer = 192.168.1.1
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-30 64288]
    R0 XMS1563K;XMS1563K;c:\windows\system32\drivers\XMS1563K.SYS [2005-11-12 49692]
    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-14 11608]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-10 14336]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-14 136360]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-14 269480]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-14 61960]
    R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-1-13 73472]
    R2 LF30FS;LF30FS;c:\program files\everstrike software\lock folder xp 3.6\LF30XP.sys [2004-11-19 101488]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-1-26 50704]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    S0 MFX;MFX; [x]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\common files\binarysense\disksvc.exe" --> c:\program files\common files\binarysense\disksvc.exe [?]
    S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-9-9 366640]
    S3 cpuz132;cpuz132;\??\c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\hp_adm~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-18 136176]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 2151128]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15232]
    S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
    S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]
    S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys --> c:\windows\system32\drivers\TMPassthru.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S3 XET1001Sp50;XET1001Sp50 NDIS Protocol Driver;c:\windows\system32\drivers\xet1001sp50.sys --> c:\windows\system32\drivers\XET1001Sp50.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-06-05 13:12:08 98816 ----a-w- c:\windows\sed.exe
    2011-06-05 13:12:08 518144 ----a-w- c:\windows\SWREG.exe
    2011-06-05 00:31:42 -------- d-----w- C:\tdsskiller
    2011-06-03 06:23:32 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{0cd3597e-60fb-4c58-bb22-29f034edfc0e}\mpengine.dll
    2011-05-16 01:49:52 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    ==================== Find3M ====================
    .
    2011-05-29 13:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-18 10:23:39 16432 ----a-w- c:\windows\system32\lsdelete.exe
    2011-02-11 01:29:07 1886800 ----a-w- c:\program files\Install_Flash_Player_10_ActiveX.exe
    2005-11-30 01:33:00 2217472 ----a-w- c:\program files\dcut.msi
    2005-11-25 10:15:56 1316026 ----a-w- c:\program files\DVDFabDecrypter29.exe
    .
    ============= FINISH: 9:40:38.46 ===============
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-03.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 10/26/2005 7:16:28 PM
    System Uptime: 6/5/2011 9:10:43 AM (0 hours ago)
    .
    Motherboard: ASUSTek Computer INC. | | LITHIUM
    Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Socket 775 | 2800/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 225 GiB total, 94.675 GiB free.
    D: is FIXED (FAT32) - 8 GiB total, 0.857 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    G: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP210: 3/7/2011 12:09:41 PM - System Checkpoint
    RP211: 3/8/2011 1:09:42 PM - System Checkpoint
    RP212: 3/8/2011 2:15:59 PM - Software Distribution Service 3.0
    RP213: 3/8/2011 6:43:57 PM - Software Distribution Service 3.0
    RP214: 3/9/2011 7:01:03 PM - System Checkpoint
    RP215: 3/10/2011 7:37:33 PM - System Checkpoint
    RP216: 3/11/2011 7:00:42 PM - Software Distribution Service 3.0
    RP217: 3/12/2011 8:01:36 PM - System Checkpoint
    RP218: 3/13/2011 9:40:30 PM - System Checkpoint
    RP219: 3/14/2011 10:39:25 PM - System Checkpoint
    RP220: 3/15/2011 5:04:05 AM - Software Distribution Service 3.0
    RP221: 3/16/2011 5:10:59 AM - System Checkpoint
    RP222: 3/16/2011 9:00:20 PM - Software Distribution Service 3.0
    RP223: 3/17/2011 10:43:28 PM - System Checkpoint
    RP224: 3/18/2011 9:53:01 AM - Software Distribution Service 3.0
    RP225: 3/19/2011 10:41:01 AM - System Checkpoint
    RP226: 3/20/2011 12:33:38 PM - System Checkpoint
    RP227: 3/21/2011 12:59:05 PM - System Checkpoint
    RP228: 3/22/2011 1:01:24 PM - System Checkpoint
    RP229: 3/22/2011 1:33:58 PM - Software Distribution Service 3.0
    RP230: 3/23/2011 1:41:45 PM - System Checkpoint
    RP231: 3/23/2011 3:44:15 PM - Software Distribution Service 3.0
    RP232: 3/23/2011 5:02:37 PM - Software Distribution Service 3.0
    RP233: 3/23/2011 5:28:17 PM - Installed WeatherBug
    RP234: 3/24/2011 5:48:03 PM - System Checkpoint
    RP235: 3/25/2011 7:22:23 AM - Software Distribution Service 3.0
    RP236: 3/26/2011 9:30:50 AM - System Checkpoint
    RP237: 3/27/2011 10:03:58 AM - System Checkpoint
    RP238: 3/28/2011 10:17:08 AM - System Checkpoint
    RP239: 3/29/2011 9:34:29 AM - Software Distribution Service 3.0
    RP240: 3/30/2011 10:16:37 AM - System Checkpoint
    RP241: 3/31/2011 11:08:51 AM - System Checkpoint
    RP242: 4/1/2011 12:05:35 PM - System Checkpoint
    RP243: 4/1/2011 3:45:49 PM - Software Distribution Service 3.0
    RP244: 4/2/2011 3:57:47 PM - System Checkpoint
    RP245: 4/3/2011 4:56:35 PM - System Checkpoint
    RP246: 4/4/2011 5:45:59 PM - System Checkpoint
    RP247: 4/5/2011 5:59:48 PM - System Checkpoint
    RP248: 4/5/2011 6:05:16 PM - Software Distribution Service 3.0
    RP249: 4/6/2011 7:10:32 PM - System Checkpoint
    RP250: 4/7/2011 8:23:48 PM - System Checkpoint
    RP251: 4/8/2011 4:46:12 AM - Software Distribution Service 3.0
    RP252: 4/9/2011 5:30:13 AM - System Checkpoint
    RP253: 4/10/2011 6:24:03 AM - System Checkpoint
    RP254: 4/11/2011 7:17:54 AM - System Checkpoint
    RP255: 4/12/2011 6:30:01 AM - Software Distribution Service 3.0
    RP256: 4/13/2011 7:17:55 AM - System Checkpoint
    RP257: 4/14/2011 7:39:37 AM - System Checkpoint
    RP258: 4/14/2011 9:00:34 PM - Software Distribution Service 3.0
    RP259: 4/15/2011 2:11:44 PM - Software Distribution Service 3.0
    RP260: 4/16/2011 3:10:34 PM - System Checkpoint
    RP261: 4/17/2011 4:01:37 PM - System Checkpoint
    RP262: 4/18/2011 7:22:37 PM - System Checkpoint
    RP263: 4/19/2011 4:06:30 PM - Software Distribution Service 3.0
    RP264: 4/20/2011 5:22:37 PM - System Checkpoint
    RP265: 4/21/2011 5:35:10 PM - System Checkpoint
    RP266: 4/21/2011 9:00:19 PM - Software Distribution Service 3.0
    RP267: 4/22/2011 6:09:47 AM - Software Distribution Service 3.0
    RP268: 4/23/2011 7:58:01 AM - System Checkpoint
    RP269: 4/23/2011 7:46:37 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP270: 4/23/2011 8:00:42 PM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP271: 4/23/2011 8:01:19 PM - Installed NETGEAR XET1001 Powerline Encryption Utility
    RP272: 4/24/2011 10:11:17 AM - Removed NETGEAR XET1001 Powerline Encryption Utility
    RP273: 4/25/2011 4:47:15 AM - Removed WeatherBug
    RP274: 4/25/2011 4:47:33 AM - Installed WeatherBug
    RP275: 4/26/2011 5:03:12 AM - System Checkpoint
    RP276: 4/26/2011 8:13:03 AM - Software Distribution Service 3.0
    RP277: 4/26/2011 9:00:25 PM - Software Distribution Service 3.0
    RP278: 4/27/2011 9:00:20 PM - Software Distribution Service 3.0
    RP279: 4/28/2011 9:03:07 PM - System Checkpoint
    RP280: 4/29/2011 6:54:41 PM - Software Distribution Service 3.0
    RP281: 4/30/2011 7:51:58 PM - System Checkpoint
    RP282: 5/1/2011 8:42:21 PM - System Checkpoint
    RP283: 5/2/2011 9:49:22 PM - System Checkpoint
    RP284: 5/3/2011 8:55:27 PM - Software Distribution Service 3.0
    RP285: 5/4/2011 8:57:30 PM - System Checkpoint
    RP286: 5/5/2011 9:58:33 PM - System Checkpoint
    RP287: 5/6/2011 8:17:59 AM - Software Distribution Service 3.0
    RP288: 5/7/2011 9:05:01 AM - System Checkpoint
    RP289: 5/8/2011 9:45:25 AM - System Checkpoint
    RP290: 5/9/2011 9:59:36 AM - System Checkpoint
    RP291: 5/10/2011 8:28:30 AM - Software Distribution Service 3.0
    RP292: 5/11/2011 8:59:37 AM - System Checkpoint
    RP293: 5/11/2011 9:00:21 PM - Software Distribution Service 3.0
    RP294: 5/12/2011 9:01:17 PM - System Checkpoint
    RP295: 5/13/2011 7:00:40 PM - Software Distribution Service 3.0
    RP296: 5/14/2011 7:05:52 PM - System Checkpoint
    RP297: 5/15/2011 8:05:56 PM - System Checkpoint
    RP298: 5/16/2011 10:16:51 PM - System Checkpoint
    RP299: 5/17/2011 4:45:27 AM - Software Distribution Service 3.0
    RP300: 5/18/2011 4:58:11 AM - System Checkpoint
    RP301: 5/19/2011 4:58:51 AM - System Checkpoint
    RP302: 5/20/2011 5:00:38 AM - System Checkpoint
    RP303: 5/20/2011 11:12:55 AM - Software Distribution Service 3.0
    RP304: 5/21/2011 12:00:29 PM - System Checkpoint
    RP305: 5/22/2011 1:14:19 PM - System Checkpoint
    RP306: 5/23/2011 2:00:32 PM - System Checkpoint
    RP307: 5/24/2011 3:00:33 PM - System Checkpoint
    RP308: 5/24/2011 6:46:24 PM - Software Distribution Service 3.0
    RP309: 5/25/2011 9:40:43 PM - System Checkpoint
    RP310: 5/26/2011 10:24:17 PM - System Checkpoint
    RP311: 5/27/2011 3:08:39 AM - Software Distribution Service 3.0
    RP312: 5/28/2011 3:42:07 AM - System Checkpoint
    RP313: 5/28/2011 7:59:38 AM - Removed SUPERAntiSpyware Free Edition
    RP314: 5/29/2011 12:41:04 PM - System Checkpoint
    RP315: 5/30/2011 2:29:44 PM - System Checkpoint
    RP316: 5/31/2011 6:34:56 AM - Software Distribution Service 3.0
    RP317: 6/1/2011 11:21:42 AM - System Checkpoint
    RP318: 6/2/2011 11:45:10 AM - System Checkpoint
    RP319: 6/3/2011 2:23:21 AM - Software Distribution Service 3.0
    RP320: 6/4/2011 3:58:52 AM - System Checkpoint
    .
    ==== Installed Programs ======================
    .
    .
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Help Center 2.1
    Adobe Photoshop Elements 5.0
    Adobe Reader 9.4.4
    AIM 6.0
    AiO_Scan
    AiOSoftware
    Akamai NetSession Interface
    allTunes
    Any Sound Recorder 2.35
    AOL Pictures Tools (version 10.6.0.6)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft TotalMedia Backup
    ATI Catalyst Control Center
    ATI Display Driver
    Atomic Clock Sync
    Avira AntiVir Personal - Free Antivirus
    AviSynth 2.5
    Bandwidth Monitor
    Belarc Advisor 7.0
    BOClean
    Bonjour
    Bubble Shooter Premium
    BufferChm
    Button Manager of JMicron
    CCleaner
    Compatibility Pack for the 2007 Office system
    CompuPic
    Copy
    CP_AtenaShokunin1Config
    CP_CalendarTemplates1
    CP_Package_Basic1
    CP_Package_Variety1
    CP_Package_Variety2
    CP_Package_Variety3
    CP_Panorama1Config
    CreativeProjects
    CreativeProjectsTemplates
    CueTour
    dCut
    Desktop Doctor
    Destinations
    DeviceManagementQFolder
    DigitImg
    DiscAPI (Studio 10)
    DocProc
    DocumentViewer
    DocumentViewerQFolder
    DVD Decrypter (Remove Only)
    DVD Shrink 3.2
    DVDFab Decrypter 3.0.4.0
    Easy Internet Sign-up
    ERUNT 1.1j
    ESPN RunTime
    exPressit S.E. 2.1
    Fax
    File Type Assistant
    FLV Player
    FLV Player 2.0 (build 25)
    FREE Hi-Q Recorder 1.92
    Free Sound Recorder
    Free Sound Recorder 2010 v9.2.1
    Garmin Communicator Plugin
    Garmin USB Drivers
    GemMaster Mystic
    GMail Drive Shell Extension
    Google Earth
    Google Update Helper
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB954550-v5)
    HP Boot Optimizer
    HP Deskjet Printer Preload
    HP DigitalMedia Archive
    HP Document Viewer 5.3
    HP Image Zone 5.3
    HP Image Zone for Media Center PC
    HP Imaging Device Functions 5.3
    HP Memories Disc
    HP Multimedia Keyboard Software
    hp photosmart 7600 series
    HP Product Detection
    HP PSC & OfficeJet 5.3.B
    HP Scanjet 4070
    HP Software Update
    HP Solution Center & Imaging Support Tools 5.3
    HP Tunes
    hpg4070
    HPProductAssistant
    HpSdpAppCoreApp
    HPSystemDiagnostics
    HPTunesAddIn
    Image Grabber II
    InstantShare
    InstantShareDevices
    Intel(R) Network Connections Drivers
    IntelliMover Data Transfer Demo
    InterActual Player
    InterVideo WinDVD Player
    iSEEK AnswerWorks English Runtime
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 21
    Kaspersky Online Scanner
    LightScribe 1.4.42.1
    Lock Folder XP 3.6
    Malwarebytes' Anti-Malware version 1.51.0.1200
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Away Mode
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Default Manager
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Location Finder
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Media Content
    Microsoft Office XP Professional
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Windows XP Video Decoder Checkup Utility
    Microsoft Works
    Microsoft XML Parser
    Moyea YouTube FLV Downloader version: 3.1.2.26
    MSN Music Assistant
    MSXML 4.0 SP2 (KB925672)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 and SOAP Toolkit 3.0
    MSXML 4.0 SP2 Parser and SDK
    muvee autoProducer 4.0
    muvee autoProducer unPlugged 1.1 - HPD
    MySpaceIM
    Netflix Movie Viewer
    NewCopy
    Office 2003 Tour
    Otto
    Overland
    PanoStandAlone
    PC-Doctor 5 for Windows
    PhotoGallery
    Photosmart 140,240,7200,7600,7700,7900 Series
    Picture Package Music Transfer
    Pinnacle Instant DVD Recorder
    Pop-Up Stopper Free Edition
    PrintScreen
    proDAD Heroglyph 2.5
    PS2
    PS7600
    PSShortcuts
    PSUsage
    Python 2.2 pywin32 extensions (build 203)
    Python 2.2.3
    QFolder
    Quicken 2005
    QuickProjects
    QuickTime
    RAMRush 1.0.5.817
    RandMap
    RAPID (Studio 10)
    Readme
    RealPlayer
    Realtek High Definition Audio Driver
    RealUpgrade 1.0
    Recuva
    RipIt4Me
    Sandlot Games Client Services
    Scan
    ScannerCopy
    Secunia PSI
    Security Task Manager 1.7h
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2491683)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB923689)
    ShareIns
    SkinsHP1
    SmartSound Quicktracks Plugin
    SolutionCenter
    Sonic Encoders
    Sonic Express Labeler
    Sonic MyDVD Plus
    Sonic RecordNow Audio
    Sonic RecordNow Copy
    Sonic RecordNow Data
    Sonic Update Manager
    Sonic_PrimoSDK
    Sony Picture Utility
    Sony USB Driver
    Speccy
    Spybot - Search & Destroy
    SpywareBlaster 4.3
    Status
    Studio 10
    Studio 10 Bonus DVD
    Sun Download Manager 2.0 (web)
    SUPERAntiSpyware
    Symantec Technical Support Web Controls
    Tracking The Eye.NET
    TrayApp
    TurboTax 2008
    TurboTax 2008 WinPerFedFormset
    TurboTax 2008 WinPerProgramHelp
    TurboTax 2008 WinPerReleaseEngine
    TurboTax 2008 WinPerTaxSupport
    TurboTax 2008 WinPerUserEducation
    TurboTax 2008 wrapper
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wpaiper
    TurboTax 2009 wrapper
    TurboTax Basic 2005
    TurboTax Basic 2006
    TurboTax Deluxe 2007
    TurboTax ItsDeductible 2006
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 7 (KB976749)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Internet Explorer 8 (KB980302)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB971029)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    Updates from HP (remove only)
    URGE
    VC 9.0 Runtime
    Videora iPod Converter 3.05
    Videora iPod nano Converter 3.04
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Virtools 3D Life Player
    Virtual Earth 3D (Beta)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WeatherBug
    WebFldrs XP
    WebReg
    WexTech AnswerWorks
    Windows Defender
    Windows Defender Signatures
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live ID Sign-in Assistant
    Windows Live Local Add-in for Microsoft Office Outlook
    Windows Live OneCare safety scanner
    Windows Resource Kit Tools - SubInAcl.exe
    Windows XP Media Center Edition 2005 KB2502898
    Windows XP Service Pack 3
    WinPcap 4.1.1
    Wisdom-soft ScreenHunter 5.0 Free
    WOT for Internet Explorer
    .
    ==== Event Viewer Messages From Past Week ========
    .
    6/5/2011 9:18:20 AM, error: Service Control Manager [7034] - The Adobe Active File Monitor V5 service terminated unexpectedly. It has done this 1 time(s).
    6/4/2011 8:50:27 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb BANTExt Fips intelppm PCLEPCI SASDIFSV SASKUTIL ssmdrv
    6/4/2011 8:22:49 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb BANTExt Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv Tcpip
    6/4/2011 3:06:43 PM, error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified.
    6/4/2011 3:06:43 PM, error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified.
    6/3/2011 2:20:06 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: fasttx2k IntelIde ViaIde
    6/3/2011 2:18:37 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
    6/2/2011 8:25:40 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    6/2/2011 8:15:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    6/2/2011 8:13:16 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    6/2/2011 8:13:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    6/2/2011 8:12:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb BANTExt Fips intelppm IPSec MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss SASDIFSV ssmdrv Tcpip
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 8:12:52 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/2/2011 7:51:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.
    6/2/2011 7:51:24 PM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/2/2011 7:40:45 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
    5/30/2011 11:02:22 AM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The specified module could not be found.
    5/30/2011 11:02:22 AM, error: Service Control Manager [7000] - The HDD & SSD access service service failed to start due to the following error: The system cannot find the path specified.
    .
    ==== End Of File ===========================
    omboFix 11-06-05.01 - HP_Administrator 06/05/2011 9:18.3.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2443 [GMT -4:00]
    Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Administrator\WINDOWS
    c:\documents and settings\Default User\WINDOWS
    c:\documents and settings\Guest\WINDOWS
    c:\documents and settings\HP_Administrator\Start Menu\Programs\Windows XP Recovery
    c:\documents and settings\HP_Administrator\Start Menu\Programs\Windows XP Recovery\Uninstall Windows XP Recovery.lnk
    c:\documents and settings\HP_Administrator\Start Menu\Programs\Windows XP Recovery\Windows XP Recovery.lnk
    c:\documents and settings\HP_Administrator\WINDOWS
    c:\tdsskiller\tdsskiller.exe
    c:\windows\system32\config\systemprofile\WINDOWS
    .
    Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
    Restored copy from - Kitty had a snack :p
    .
    ((((((((((((((((((((((((( Files Created from 2011-05-05 to 2011-06-05 )))))))))))))))))))))))))))))))
    .
    .
    2011-06-05 00:31 . 2011-06-05 13:28 -------- d-----w- C:\tdsskiller
    2011-06-03 06:23 . 2011-05-09 20:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0CD3597E-60FB-4C58-BB22-29F034EDFC0E}\mpengine.dll
    2011-05-16 01:49 . 2011-05-16 01:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-06-05 00:30 . 2011-06-05 00:30 1301452 ----a-w- C:\tdsskiller.zip
    2011-05-29 13:11 . 2009-09-10 01:25 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-05-09 20:46 . 2006-03-22 03:28 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2011-04-25 08:47 . 2011-04-25 08:47 18944 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}\IconBB6A16301.exe
    2011-04-25 08:47 . 2011-04-25 08:47 11264 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}\IconBB6A1630.exe
    2011-04-18 10:23 . 2010-10-01 11:07 16432 ----a-w- c:\windows\system32\lsdelete.exe
    2011-03-23 21:28 . 2011-03-23 21:28 18944 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe
    2011-03-16 22:05 . 2010-11-14 12:37 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-02-11 01:29 . 2011-02-11 01:29 1886800 ----a-w- c:\program files\Install_Flash_Player_10_ActiveX.exe
    2005-11-30 01:33 . 2005-11-10 00:47 2217472 ----a-w- c:\program files\dcut.msi
    2005-11-25 10:15 . 2005-11-25 10:15 1316026 ----a-w- c:\program files\DVDFabDecrypter29.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-13 281768]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk
    backup=c:\windows\pss\APC UPS Status.lnkCommon Startup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
    backup=c:\windows\pss\TotalMedia Backup Monitor.lnkCommon Startup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnkStartup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^dCut Service.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\dCut Service.lnk
    backup=c:\windows\pss\dCut Service.lnkStartup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^IMVU.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\IMVU.lnk
    backup=c:\windows\pss\IMVU.lnkStartup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^JMicron Button Manager.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\JMicron Button Manager.lnk
    backup=c:\windows\pss\JMicron Button Manager.lnkStartup
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Secunia PSI.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\Secunia PSI.lnk
    backup=c:\windows\pss\Secunia PSI.lnkStartup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dumprep 0 -k]
    c:\windows\system32\dumprep 0 -k [X]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dumprep 0 -u]
    c:\windows\system32\dumprep 0 -u [X]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDtemp4]
    c:\program files\BinarySense\HDDTemp4\\hddtemp4 [X]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
    c:\windows\system32\dumprep 0 -k [X]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
    c:\windows\system32\dumprep 0 -u [X]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2010-09-21 03:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    2006-11-07 15:29 50736 ----a-w- c:\program files\AIM6\aim6.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    2008-06-19 12:20 57344 ----a-w- c:\windows\ALCMTR.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
    2005-08-02 23:19 77312 ----a-w- c:\windows\arpwrmsg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ARPWRMSG]
    2005-08-02 23:19 77312 ----a-w- c:\windows\arpwrmsg.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
    2005-08-10 07:33 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bandmon]
    2008-06-01 22:05 1529856 ----a-w- c:\program files\Rokario\Bandwidth Monitor\bandmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cli]
    2005-08-10 07:33 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon]
    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
    2008-04-24 17:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGServices]
    2005-10-31 16:18 101888 ----a-w- c:\program files\ESPNRunTime\DIGServices.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGStream]
    2005-10-31 16:05 278528 ----a-w- c:\program files\DIGStream\digstream.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    2005-08-05 20:56 64512 ----a-w- c:\windows\ehome\ehtray.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLV Downloader]
    2010-05-12 18:56 5873872 ----a-w- c:\program files\Moyea\YouTube FLV Downloader\FLVDownloader.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLVDownloader]
    2010-05-12 18:56 5873872 ----a-w- c:\program files\Moyea\YouTube FLV Downloader\FLVDownloader.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
    2005-01-12 19:54 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
    2005-02-25 22:34 245760 ----a-w- c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpcmpmgr]
    2005-01-12 19:54 241664 ----a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2011-01-25 20:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
    2005-02-02 20:44 61440 ----a-w- c:\hp\KBD\kbd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LocationFinder]
    2006-05-15 19:24 101136 ----a-w- c:\program files\Microsoft Location Finder\LocationFinder.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsburnwatcher]
    2005-05-10 17:50 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
    2005-05-10 17:50 253952 ----a-w- c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
    2011-05-29 13:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
    2009-07-17 15:12 288080 ----a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Location Finder]
    2006-05-15 19:24 101136 ----a-w- c:\program files\Microsoft Location Finder\LocationFinder.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSASCui]
    2006-11-03 23:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLECoInst]
    2005-12-21 15:14 73728 ----a-w- c:\windows\system32\PCLECoInst.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
    2004-03-11 06:26 406016 ----a-w- c:\windows\system32\PSDrvCheck.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopUpStopperFreeEdition]
    2005-03-17 16:10 536576 ----a-w- c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
    2004-10-25 19:17 90112 ----a-w- c:\windows\system32\ps2.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSDrvCheck]
    2004-03-11 06:26 406016 ----a-w- c:\windows\system32\PSDrvCheck.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSFree]
    2005-03-17 16:10 536576 ----a-w- c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qttask]
    2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader_sl]
    2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\realsched]
    2010-09-10 23:46 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
    2009-02-03 13:32 18085888 ----a-w- c:\windows\RTHDCPL.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-03-05 20:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2010-05-14 15:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2011-05-23 15:00 2424192 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2010-09-10 23:46 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB2Check]
    2005-12-21 15:14 73728 ----a-w- c:\windows\system32\PCLECoInst.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBTip]
    2006-01-23 20:42 196608 ----a-w- c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
    2006-01-23 20:42 196608 ----a-w- c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2006-11-03 23:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YouTube FLV Downloader]
    2010-05-12 18:56 5873872 ----a-w- c:\program files\Moyea\YouTube FLV Downloader\FLVDownloader.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "McSysmon"=3 (0x3)
    "McShield"=2 (0x2)
    "McProxy"=2 (0x2)
    "McNASvc"=2 (0x2)
    "mcmscsvc"=2 (0x2)
    "McAfee SiteAdvisor Service"=2 (0x2)
    "svcWRSSSDK"=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Adobe\\Photoshop Elements 5.0\\AdobePhotoshopElementsMediaServer.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\dCut\\DCutService.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
    "c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1164:TCP"= 1164:TCP:Akamai NetSession Interface
    "5000:UDP"= 5000:UDP:Akamai NetSession Interface
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/30/2010 9:49 PM 64288]
    R0 XMS1563K;XMS1563K;c:\windows\system32\drivers\XMS1563K.SYS [11/12/2005 12:06 PM 49692]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
    R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/10/2004 1:00 AM 14336]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/14/2010 8:37 AM 136360]
    R2 BOCore;BOCore;c:\program files\Comodo\CBOClean\BOCore.exe [1/13/2008 6:57 AM 73472]
    R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [11/19/2004 7:07 PM 101488]
    R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/26/2010 10:09 PM 50704]
    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
    S0 MFX;MFX; [x]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/18/2010 5:17 PM 136176]
    S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\Common Files\BinarySense\disksvc.exe" --> c:\program files\Common Files\BinarySense\disksvc.exe [?]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/9/2009 9:25 PM 366640]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/18/2010 5:17 PM 136176]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/12/2010 8:15 AM 2151128]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/12/2010 8:15 AM 15232]
    S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\6.tmp --> c:\windows\system32\6.tmp [?]
    S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [7/7/2010 10:05 AM 14904]
    S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\DRIVERS\TMPassthru.sys --> c:\windows\system32\DRIVERS\TMPassthru.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
    S3 XET1001Sp50;XET1001Sp50 NDIS Protocol Driver;c:\windows\system32\Drivers\XET1001Sp50.sys --> c:\windows\system32\Drivers\XET1001Sp50.sys [?]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    Akamai REG_MULTI_SZ Akamai
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-06-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 09:11]
    .
    2011-06-04 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 21:17]
    .
    2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 21:17]
    .
    2011-06-05 c:\windows\Tasks\HP Usg Daily.job
    - c:\program files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2005-10-28 13:03]
    .
    2011-06-05 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
    .
    2011-06-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3241921697-945589079-2639526779-1008.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
    .
    2011-06-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3241921697-945589079-2639526779-501.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
    .
    2011-06-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3241921697-945589079-2639526779-1008.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
    .
    2011-06-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3241921697-945589079-2639526779-501.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]
    .
    2011-06-05 c:\windows\Tasks\User_Feed_Synchronization-{42067EFD-962B-4169-8193-05B965D98D12}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.refdesk.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: netflix.com\www
    Trusted Zone: turbotax.com
    TCP: DhcpNameServer = 192.168.1.1
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Notify-NavLogon - (no file)
    MSConfigStartUp-DriverScanner - c:\program files\Uniblue\DriverScanner\launcher.exe
    MSConfigStartUp-LoBoUYvVYw - c:\documents and settings\All Users\Application Data\LoBoUYvVYw.exe
    MSConfigStartUp-MSN Toolbar - c:\program files\MSN Toolbar\Platform\4.0.0417.0\mswinext.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-06-05 09:30
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]
    "ImagePath"="\??\c:\windows\system32\6.tmp"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(864)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2011-06-05 09:34:22
    ComboFix-quarantined-files.txt 2011-06-05 13:34
    .
    Pre-Run: 101,298,835,456 bytes free
    Post-Run: 101,621,379,072 bytes free
    .
    - - End Of File - - 9A68626AFF8423EA5EC3A06604705116

  10. #10
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,296

    Default

    Hi again,

    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    DDS::
    BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No File
    TB: {4064EA35-578D-4073-A834-C96D82CBCF40} - No File
    TB: {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dumprep 0 -k]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dumprep 0 -u]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.

    You should re-enable PSI from msconfig. It helps you keep the system updated.


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 25.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u25-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



    Update MBAM and run a full scan with it. Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log. Any symptoms?
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •