Help Needed - several problems

**pmaxxx13** · 2011-12-27, 01:15

First of all, thanks for taking the time to assist. I had some bad issues a fews years back and this site / people were AMAZING!

Issues on son's PC with explorer redirect, missing exe, etc Additionally, cannot download the lastest windows explorer update

DDS text below and other file attached as requested (not sure that this matters, but it took 11 minutes to run).

Thanks

Patrick

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.6001.19088
Run by Owner at 17:09:22 on 2011-12-26
.
============== Running Processes ===============
.
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\ooVoo\ooVoo.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\Spyware Doctor\pctsTray.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe
C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
F:\dds.scr
C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.com/
uSearch Bar = Preserve
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [AdobeBridge]
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [ooVoo.exe] C:\Program Files (x86)\ooVoo\oovoo.exe /minimized
uRun: [Hyvovv] C:\Users\Connor Appleby\AppData\Roaming\Hyvovv.exe
uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
uRun: [hUtkqvriAukQ.exe] C:\ProgramData\hUtkqvriAukQ.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [5-Day Forecast] "C:\Program Files (x86)\5-Day Forecast\5-Day Forecast\5-Day Forecast.exe" /Startup
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [SwitchBoard] "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [ISTray] "C:\Program Files (x86)\Spyware Doctor\pctsTray.exe"
mRun: [BambooCore] "C:\Program Files (x86)\Bamboo Dock\BambooCore.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MI1933~1\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MI1933~1\Office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www1.snapfish.com/SnapfishActivia.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
DPF: {4ECE056F-E50F-4F9D-B069-EB342D21F26A} - hxxp://www1.snapfish.com/SnapfishActivia3.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 68.87.71.230 68.87.73.246
TCP: Interfaces\{0F6C1251-DE0E-4DF2-9EB9-7943A8261CD9} : DhcpNameServer = 68.87.71.230 68.87.73.246
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
BHO-X64: ooVoo Toolbar - No File
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO-X64: Search Helper - No File
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun-x64: [Adobe Reader Speed Launcher] "c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun-x64: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun-x64: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun-x64: [5-Day Forecast] "C:\Program Files (x86)\5-Day Forecast\5-Day Forecast\5-Day Forecast.exe" /Startup
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun-x64: [SwitchBoard] "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"
mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun-x64: [ISTray] "C:\Program Files (x86)\Spyware Doctor\pctsTray.exe"
mRun-x64: [BambooCore] "C:\Program Files (x86)\Bamboo Dock\BambooCore.exe"
.
============= SERVICES / DRIVERS ===============
.
R? Avgtdia;AVG TDI Driver
R? clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? McComponentHostService;McAfee Security Scan Component Host Service
R? McProxy;McAfee Proxy Service
R? mfebopk;McAfee Inc. mfebopk
R? mferkdk;McAfee Inc. mferkdk
R? PerfHost;Performance Counter DLL Host
R? SwitchBoard;Adobe SwitchBoard
R? USBAAPL64;Apple Mobile USB Driver
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
S? AERTFilters;Andrea RT Filters Service
S? AVGIDSAgent;AVGIDSAgent
S? AVGIDSDriver;AVGIDSDriver
S? AVGIDSEH;AVGIDSEH
S? AVGIDSFilter;AVGIDSFilter
S? Avgldx64;AVG AVI Loader Driver
S? Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield
S? Avgrkx64;AVG Anti-Rootkit Driver
S? avgwd;AVG WatchDog
S? DockLoginService;Dock Login Service
S? e1yexpress;Intel(R) Gigabit Network Connections Driver
S? FontCache;Windows Font Cache Service
S? McShield;McAfee Real-time Scanner
S? McSysmon;McAfee SystemGuards
S? mfeavfk;McAfee Inc. mfeavfk
S? mfehidk;McAfee Inc. mfehidk
S? mfesmfk;McAfee Inc. mfesmfk
S? NVHDA;Service for NVIDIA High Definition Audio Driver
S? OA002Afx;Provides a software interface to control audio effects of OA002 camera.
S? OA002Ufd;Creative Camera OA002 Upper Filter Driver
S? OA002Vid;Creative Camera OA002 Function Driver
S? PCTCore;PCTools KDS
S? PxHlpa64;PxHlpa64
S? SBSDWSCService;SBSD Security Center Service
S? sdAuxService;PC Tools Auxiliary Service
S? sdCoreService;PC Tools Security Service
S? TabletServicePen;TabletServicePen
S? TouchServicePen;Wacom Consumer Touch Service
.
=============== File Associations ===============
.
JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
2011-12-26 19:02:42 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\Autodesk
2011-12-26 18:55:39 -------- d-----w- C:\ProgramData\Alias
2011-12-26 18:53:35 -------- d-----w- C:\Program Files (x86)\Autodesk
2011-12-26 18:48:12 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
2011-12-26 18:47:55 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\Wacom
2011-12-26 18:47:44 -------- d-----w- C:\ProgramData\Wacom
2011-12-26 18:46:14 -------- d-----w- C:\Program Files (x86)\Bamboo Dock
2011-12-26 18:45:16 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\WTablet
2011-12-26 18:45:15 1107832 ----a-w- C:\Windows\SysWow64\Pen_Touch_Tablet.dll
2011-12-26 18:45:14 1326456 ----a-w- C:\Windows\System32\Pen_Touch_Tablet.dll
2011-12-26 18:45:09 -------- d-----w- C:\ProgramData\AppData
2011-12-26 18:44:48 -------- d-----w- C:\Program Files (x86)\TabletPlugins
2011-12-26 18:42:43 12848 ----a-w- C:\Windows\System32\drivers\wacommousefilter.sys
2011-12-26 18:41:28 16168 ----a-w- C:\Windows\System32\drivers\wacomvhid.sys
2011-12-26 18:41:25 1401208 ----a-w- C:\Windows\System32\Wintab32.dll
2011-12-26 18:41:25 1392504 ----a-w- C:\Windows\System32\WacomMT.dll
2011-12-26 18:41:25 1369464 ----a-w- C:\Windows\SysWow64\Pen_Tablet.dll
2011-12-26 18:41:25 1156472 ----a-w- C:\Windows\SysWow64\Wintab32.dll
2011-12-26 18:41:25 1152888 ----a-w- C:\Windows\SysWow64\WacomMT.dll
2011-12-26 18:41:24 1665400 ----a-w- C:\Windows\System32\Pen_Tablet.dll
2011-12-26 18:41:19 -------- d-----w- C:\Program Files\Tablet
2011-12-26 18:33:49 208896 ----a-w- C:\Windows\MBR.exe
2011-12-26 18:33:44 98816 ----a-w- C:\Windows\sed.exe
2011-12-26 18:33:44 518144 ----a-w- C:\Windows\SWREG.exe
2011-12-26 18:33:44 256000 ----a-w- C:\Windows\PEV.exe
2011-12-26 18:32:16 -------- d-s---w- C:\ComboFix-1
2011-12-26 02:42:08 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2011-12-26 01:25:53 -------- d-----w- C:\ProgramData\ALM
2011-12-26 00:59:50 -------- d-----w- C:\Program Files (x86)\Adobe Story
2011-12-26 00:56:20 -------- d-----w- C:\Program Files (x86)\My Company Name
2011-12-24 07:50:22 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\Wyga
2011-12-24 07:50:22 -------- d-----w- C:\Users\Connor Appleby\AppData\Roaming\Unefti
2011-12-15 02:49:47 85504 ----a-w- C:\Windows\System32\csrsrv.dll
2011-12-15 02:49:43 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-12-15 02:49:42 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-12-15 02:49:29 559616 ----a-w- C:\Windows\System32\EncDec.dll
2011-12-15 02:49:29 429056 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-12-15 02:49:15 2764800 ----a-w- C:\Windows\System32\win32k.sys
2011-12-15 02:49:13 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2011-12-15 02:49:13 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2011-12-01 00:08:37 -------- d-----w- C:\ProgramData\McAfee Security Scan
2011-12-01 00:08:30 -------- d-----w- C:\Program Files (x86)\McAfee Security Scan
2011-11-27 16:29:53 -------- d-----w- C:\Program Files (x86)\MALWAREBYTES ANTI-MALWARE
.
==================== Find3M ====================
.
2011-12-01 00:08:59 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-24 18:29:02 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2011-10-24 18:29:02 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
2011-10-07 11:23:46 283728 ----a-w- C:\Windows\System32\drivers\avgldx64.sys
.
============= FINISH: 17:20:48.87 ===============

**ken545** · 2012-01-03, 22:39

Please read Before You Post
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.

Running programs with Vista or Windows 7 , you need to Right Click on the program and select RUN AS ADMINISTATOR

Sorry for the delay, the holidays kind of put us behind

Your going to have to download this program to known clean computer and transfer it by disk to the infected one. Looks like you ran it before , if the old icon is still on your desktop drag it to trash and download a fresh new updated copy

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

**pmaxxx13** · 2012-01-06, 22:33

Sorry for the delayed response, was traveling

FYI - during combo-fix run I had an error message pop up twice:"PEV.exe stopped working"

Also, internet now works but re-directs

Thanks for your help!

ComboFix 12-01-06.01 - Connor Appleby 01/06/2012 15:00:07.2.8 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.8182.4940 [GMT -5:00]
Running from: c:\users\Connor Appleby\Desktop\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe
.
---- Previous Run -------
.
C:\DFREECB.tmp
c:\program files (x86)\LP
c:\program files (x86)\LP\7685\1303.tmp
c:\program files (x86)\LP\7685\871B.tmp
c:\program files (x86)\LP\7685\933.tmp
c:\programdata\054452l2d078j880h735m5rji6p4
c:\programdata\121518b2t827b281r656r4vbi8m1
c:\programdata\48286118k4k7
c:\users\Connor Appleby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore
c:\users\Connor Appleby\AppData\Roaming\Microsoft\Windows\Templates\054452l2d078j880h735m5rji6p4
c:\users\Connor Appleby\AppData\Roaming\Microsoft\Windows\Templates\121518b2t827b281r656r4vbi8m1
c:\users\Connor Appleby\Taskmgr.exe
c:\windows\system32\java.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-06 to 2012-01-06 )))))))))))))))))))))))))))))))
.
.
2012-01-06 20:49 . 2012-01-06 20:49 -------- d-----w- c:\users\Sarah\AppData\Local\temp
2012-01-06 20:49 . 2012-01-06 20:49 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2012-01-06 20:49 . 2012-01-06 20:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-30 14:27 . 2011-12-30 14:27 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\AVG2012
2011-12-28 22:42 . 2011-12-28 22:42 -------- d-----w- c:\users\Sarah\AppData\Roaming\Wacom
2011-12-28 22:41 . 2011-12-28 22:41 -------- d-----w- c:\users\Sarah\AppData\Roaming\WTablet
2011-12-26 21:07 . 2011-12-26 21:07 -------- d-----w- c:\program files (x86)\ERUNT
2011-12-26 19:02 . 2011-12-26 19:02 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\Autodesk
2011-12-26 18:55 . 2011-12-26 18:55 -------- d-----w- c:\programdata\Alias
2011-12-26 18:53 . 2011-12-26 18:53 -------- d-----w- c:\program files (x86)\Autodesk
2011-12-26 18:48 . 2011-12-26 18:48 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
2011-12-26 18:47 . 2011-12-26 18:47 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\Wacom
2011-12-26 18:47 . 2011-12-27 14:52 -------- d-----w- c:\programdata\Wacom
2011-12-26 18:46 . 2011-12-26 18:47 -------- d-----w- c:\program files (x86)\Bamboo Dock
2011-12-26 18:45 . 2011-12-26 18:45 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\WTablet
2011-12-26 18:32 . 2012-01-06 19:46 -------- d-----w- C:\ComboFix-1
2011-12-26 02:42 . 2011-12-26 02:42 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2011-12-26 01:25 . 2011-12-26 01:25 -------- d-----w- c:\programdata\ALM
2011-12-26 00:59 . 2011-12-26 00:59 -------- d-----w- c:\program files (x86)\Adobe Story
2011-12-26 00:56 . 2011-12-26 00:56 -------- d-----w- c:\program files (x86)\My Company Name
2011-12-24 07:50 . 2011-12-24 11:10 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\Wyga
2011-12-24 07:50 . 2011-12-24 07:50 -------- d-----w- c:\users\Connor Appleby\AppData\Roaming\Unefti
2011-12-15 02:49 . 2011-10-25 16:09 85504 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-15 02:49 . 2011-11-08 14:58 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-15 02:49 . 2011-11-08 14:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-15 02:49 . 2011-10-14 17:30 559616 ----a-w- c:\windows\system32\EncDec.dll
2011-12-15 02:49 . 2011-10-14 16:02 429056 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-15 02:49 . 2011-11-23 13:57 2764800 ----a-w- c:\windows\system32\win32k.sys
2011-12-15 02:49 . 2011-11-08 12:10 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-15 02:49 . 2011-11-08 12:10 2409784 ----a-w- c:\program files (x86)\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 00:08 . 2011-05-18 00:27 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-24 18:29 . 2011-10-24 18:29 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 18:29 . 2011-10-24 18:29 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2011-10-18 06:27 . 2011-11-11 07:00 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A82C839B-8539-4680-989B-B2FCC8B07A95}\mpengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{59c6f12b-f004-43e5-9997-08f2123119b6}]
2011-02-09 03:44 81920 ----a-w- c:\program files (x86)\oovootoolbar\oovootoolbarX.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{59c6f12b-f004-43e5-9997-08f2123119b6}"= "c:\program files (x86)\oovootoolbar\oovootoolbarX.dll" [2011-02-09 81920]
.
[HKEY_CLASSES_ROOT\clsid\{59c6f12b-f004-43e5-9997-08f2123119b6}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"ooVoo.exe"="c:\program files (x86)\ooVoo\oovoo.exe" [2011-05-18 22631608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-09-30 148888]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-07-07 1779952]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-04-24 250192]
"mcagent_exe"="c:\program files (x86)\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"5-Day Forecast"="c:\program files (x86)\5-Day Forecast\5-Day Forecast\5-Day Forecast.exe" [2010-06-15 876544]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2011-06-24 629848]
"ISTray"="c:\program files (x86)\Spyware Doctor\pctsTray.exe" [2010-01-18 1286608]
.
c:\users\Connor Appleby\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2009-9-30 53248]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-02-24 88576]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - PCTSDInjDriver64
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-13 20:35]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-13 20:35]
.
2012-01-06 c:\windows\Tasks\Norton Security Scan for Connor Appleby.job
- c:\progra~2\NORTON~2\Engine\313~1.7\Nss.exe [2011-06-26 04:47]
.
2012-01-06 c:\windows\Tasks\User_Feed_Synchronization-{53F3B42F-94F6-43E8-8F18-C7EF3438945E}.job
- c:\windows\system32\msfeedssync.exe [2011-06-15 04:32]
.
2012-01-06 c:\windows\Tasks\User_Feed_Synchronization-{F18474AD-0958-4E2A-ABFC-5E8E3C831E2D}.job
- c:\windows\system32\msfeedssync.exe [2011-06-15 04:32]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-02-24 6975520]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-17 16308768]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
DPF: {4ECE056F-E50F-4F9D-B069-EB342D21F26A} - hxxp://www1.snapfish.com/SnapfishActivia3.cab
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe
Wow6432Node-HKCU-Run-Hyvovv - c:\users\Connor Appleby\AppData\Roaming\Hyvovv.exe
Wow6432Node-HKCU-Run-hUtkqvriAukQ.exe - c:\programdata\hUtkqvriAukQ.exe
Wow6432Node-HKCU-Run-Bamboo Dock - c:\program files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe
HKLM-Run-Skytel - c:\program files\Realtek\Audio\HDA\Skytel.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Dell\DellDock\DockLogin.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe
c:\program files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
c:\progra~2\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files (x86)\McAfee\MPF\MPFSrv.exe
c:\program files (x86)\McAfee\MSK\MskSrver.exe
c:\program files (x86)\Spyware Doctor\pctsAuxs.exe
c:\program files (x86)\Spyware Doctor\pctsSvc.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe
c:\progra~2\McAfee\MSC\mcmscsvc.exe
c:\progra~2\mcafee.com\agent\mcagent.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\Dell Remote Access\ezi_ra.exe
c:\progra~2\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files (x86)\Common Files\mcafee\mna\mcnasvc.exe
c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Completion time: 2012-01-06 16:25:30 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-06 21:25
.
Pre-Run: 336,619,831,296 bytes free
Post-Run: 336,161,443,840 bytes free
.
- - End Of File - - 31D8CAAE3FECF46A83413F4119E35D79

**ken545** · 2012-01-06, 23:30

Hi,

Lets do a few things.

oovootoolbar <--This may not have any uninstall feature, you can check in Programs and Features in the Control Panel. This program will change your IE search setting and is not recommended, if there is no uninstall we can remove it during the fix.

When redirects are present most times there is a rootkit type of infection present, lets check.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

**pmaxxx13** · 2012-01-06, 23:48

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-06 17:46:52
-----------------------------
17:46:52.737 OS Version: Windows x64 6.0.6002 Service Pack 2
17:46:52.739 Number of processors: 8 586 0x1A05
17:46:52.741 ComputerName: CONNORAPPLEB-PC UserName: Connor Appleby
17:46:55.246 Initialize success
17:47:07.442 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:47:07.446 Disk 0 Vendor: ST3750528AS CC44 Size: 715404MB BusType: 3
17:47:07.468 Disk 0 MBR read successfully
17:47:07.472 Disk 0 MBR scan
17:47:07.475 Disk 0 TDL4@MBR code has been found
17:47:07.479 Disk 0 Windows VISTA default MBR code found via API
17:47:07.484 Disk 0 MBR hidden
17:47:07.489 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
17:47:07.517 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 15360 MB offset 129024
17:47:07.530 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 699980 MB offset 31586304
17:47:07.536 Disk 0 MBR [TDL4] **ROOTKIT**
17:47:07.543 Disk 0 trace - called modules:
17:47:07.549 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa8009379254]<<
17:47:07.555 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008d95790]
17:47:07.564 3 CLASSPNP.SYS[fffffa600100cc33] -> nt!IofCallDriver -> [0xfffffa8008c908c0]
17:47:07.572 \Driver\PCTCore[0xfffffa8007db3aa0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8009379254
17:47:07.581 Scan finished successfully
17:47:45.932 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
17:47:45.956 The log file has been saved successfully to "F:\aswMBRrun.txt"

**ken545** · 2012-01-07, 00:00

Hi,

Your computer is infected with the TDL4 version of the TDSS rootkit.

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

**pmaxxx13** · 2012-01-07, 00:21

1) i was able to uninstall oovootoolbar prior to running aswMBR (meant to tell you that in last post)
2) TDSKiller foumd and cured 1

18:07:40.0144 3048 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
18:07:41.0221 3048 ============================================================
18:07:41.0221 3048 Current date / time: 2012/01/06 18:07:41.0221
18:07:41.0221 3048 SystemInfo:
18:07:41.0221 3048
18:07:41.0221 3048 OS Version: 6.0.6002 ServicePack: 2.0
18:07:41.0221 3048 Product type: Workstation
18:07:41.0221 3048 ComputerName: CONNORAPPLEB-PC
18:07:41.0221 3048 UserName: Connor Appleby
18:07:41.0221 3048 Windows directory: C:\Windows
18:07:41.0221 3048 System windows directory: C:\Windows
18:07:41.0221 3048 Running under WOW64
18:07:41.0221 3048 Processor architecture: Intel x64
18:07:41.0221 3048 Number of processors: 8
18:07:41.0221 3048 Page size: 0x1000
18:07:41.0221 3048 Boot type: Normal boot
18:07:41.0221 3048 ============================================================
18:07:43.0452 3048 Initialize success
18:07:47.0632 4192 ============================================================
18:07:47.0632 4192 Scan started
18:07:47.0632 4192 Mode: Manual;
18:07:47.0632 4192 ============================================================
18:07:49.0270 4192 61883 (78e902fb660bd5003fe726b9bef300b6) C:\Windows\system32\DRIVERS\61883.sys
18:07:49.0302 4192 61883 - ok
18:07:49.0380 4192 ACPI (1965aaffab07e3fb03c77f81beba3547) C:\Windows\system32\drivers\acpi.sys
18:07:49.0426 4192 ACPI - ok
18:07:49.0489 4192 adp94xx (f14215e37cf124104575073f782111d2) C:\Windows\system32\drivers\adp94xx.sys
18:07:49.0520 4192 adp94xx - ok
18:07:49.0645 4192 adpahci (7d05a75e3066861a6610f7ee04ff085c) C:\Windows\system32\drivers\adpahci.sys
18:07:49.0676 4192 adpahci - ok
18:07:49.0707 4192 adpu160m (820a201fe08a0c345b3bedbc30e1a77c) C:\Windows\system32\drivers\adpu160m.sys
18:07:49.0738 4192 adpu160m - ok
18:07:49.0770 4192 adpu320 (9b4ab6854559dc168fbb4c24fc52e794) C:\Windows\system32\drivers\adpu320.sys
18:07:49.0816 4192 adpu320 - ok
18:07:50.0004 4192 AFD (0cc146c4addea45791b18b1e2659f4a9) C:\Windows\system32\drivers\afd.sys
18:07:50.0035 4192 AFD - ok
18:07:50.0097 4192 agp440 (f6f6793b7f17b550ecfdbd3b229173f7) C:\Windows\system32\drivers\agp440.sys
18:07:50.0128 4192 agp440 - ok
18:07:50.0300 4192 aic78xx (222cb641b4b8a1d1126f8033f9fd6a00) C:\Windows\system32\drivers\djsvs.sys
18:07:50.0331 4192 aic78xx - ok
18:07:50.0518 4192 aliide (9544c2c55541c0c6bfd7b489d0e7d430) C:\Windows\system32\drivers\aliide.sys
18:07:50.0550 4192 aliide - ok
18:07:50.0674 4192 amdide (970fa5059e61e30d25307b99903e991e) C:\Windows\system32\drivers\amdide.sys
18:07:50.0706 4192 amdide - ok
18:07:50.0737 4192 AmdK8 (cdc3632a3a5ea4dbb83e46076a3165a1) C:\Windows\system32\drivers\amdk8.sys
18:07:50.0768 4192 AmdK8 - ok
18:07:50.0830 4192 arc (ba8417d4765f3988ff921f30f630e303) C:\Windows\system32\drivers\arc.sys
18:07:50.0877 4192 arc - ok
18:07:50.0893 4192 arcsas (9d41c435619733b34cc16a511e644b11) C:\Windows\system32\drivers\arcsas.sys
18:07:50.0924 4192 arcsas - ok
18:07:50.0971 4192 AsyncMac (22d13ff3dafec2a80634752b1eaa2de6) C:\Windows\system32\DRIVERS\asyncmac.sys
18:07:51.0002 4192 AsyncMac - ok
18:07:51.0064 4192 atapi (e68d9b3a3905619732f7fe039466a623) C:\Windows\system32\drivers\atapi.sys
18:07:51.0064 4192 atapi - ok
18:07:51.0127 4192 Avc (295fa2878ff499c0edfa0ebcc8c6ec66) C:\Windows\system32\DRIVERS\avc.sys
18:07:51.0158 4192 Avc - ok
18:07:51.0189 4192 Beep - ok
18:07:51.0236 4192 blbdrive (79feeb40056683f8f61398d81dda65d2) C:\Windows\system32\drivers\blbdrive.sys
18:07:51.0267 4192 blbdrive - ok
18:07:51.0330 4192 bowser (2348447a80920b2493a9b582a23e81e1) C:\Windows\system32\DRIVERS\bowser.sys
18:07:51.0361 4192 bowser - ok
18:07:51.0423 4192 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\brfiltlo.sys
18:07:51.0454 4192 BrFiltLo - ok
18:07:51.0517 4192 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\brfiltup.sys
18:07:51.0532 4192 BrFiltUp - ok
18:07:51.0579 4192 Brserid (f0f0ba4d815be446aa6a4583ca3bca9b) C:\Windows\system32\drivers\brserid.sys
18:07:51.0610 4192 Brserid - ok
18:07:51.0642 4192 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\system32\drivers\brserwdm.sys
18:07:51.0673 4192 BrSerWdm - ok
18:07:51.0688 4192 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\system32\drivers\brusbmdm.sys
18:07:51.0720 4192 BrUsbMdm - ok
18:07:51.0751 4192 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\system32\drivers\brusbser.sys
18:07:51.0782 4192 BrUsbSer - ok
18:07:51.0813 4192 BTHMODEM (e0777b34e05f8a82a21856efc900c29f) C:\Windows\system32\drivers\bthmodem.sys
18:07:51.0844 4192 BTHMODEM - ok
18:07:52.0047 4192 catchme - ok
18:07:52.0078 4192 cdfs (b4d787db8d30793a4d4df9feed18f136) C:\Windows\system32\DRIVERS\cdfs.sys
18:07:52.0110 4192 cdfs - ok
18:07:52.0156 4192 cdrom (c025aa69be3d0d25c7a2e746ef6f94fc) C:\Windows\system32\DRIVERS\cdrom.sys
18:07:52.0188 4192 cdrom - ok
18:07:52.0234 4192 circlass (02ea568d498bbdd4ba55bf3fce34d456) C:\Windows\system32\drivers\circlass.sys
18:07:52.0266 4192 circlass - ok
18:07:52.0546 4192 CLFS (3dca9a18b204939cfb24bea53e31eb48) C:\Windows\system32\CLFS.sys
18:07:52.0593 4192 CLFS - ok
18:07:52.0812 4192 cmdide (e5d5499a1c50a54b5161296b6afe6192) C:\Windows\system32\drivers\cmdide.sys
18:07:52.0858 4192 cmdide - ok
18:07:52.0890 4192 Compbatt (34a6aa82aa36c87fc8816f2097efa345) C:\Windows\system32\drivers\compbatt.sys
18:07:52.0936 4192 Compbatt - ok
18:07:52.0936 4192 crcdisk (a8585b6412253803ce8efcbd6d6dc15c) C:\Windows\system32\drivers\crcdisk.sys
18:07:52.0983 4192 crcdisk - ok
18:07:53.0139 4192 DfsC (8b722ba35205c71e7951cdc4cdbade19) C:\Windows\system32\Drivers\dfsc.sys
18:07:53.0170 4192 DfsC - ok
18:07:53.0451 4192 disk (b0107e40ecdb5fa692ebf832f295d905) C:\Windows\system32\drivers\disk.sys
18:07:53.0482 4192 disk - ok
18:07:53.0623 4192 drmkaud (f1a78a98cfc2ee02144c6bec945447e6) C:\Windows\system32\drivers\drmkaud.sys
18:07:53.0654 4192 drmkaud - ok
18:07:53.0810 4192 DXGKrnl (b8e554e502d5123bc111f99d6a2181b4) C:\Windows\System32\drivers\dxgkrnl.sys
18:07:53.0872 4192 DXGKrnl - ok
18:07:53.0888 4192 e1express (17d40652ef3e55eeae187a89df40965a) C:\Windows\system32\DRIVERS\e1e6032e.sys
18:07:53.0919 4192 e1express - ok
18:07:53.0950 4192 E1G60 (264cee7b031a9d6c827f3d0cb031f2fe) C:\Windows\system32\DRIVERS\E1G6032E.sys
18:07:53.0982 4192 E1G60 - ok
18:07:54.0028 4192 e1yexpress (b37f6853d6e0c6f5f8efde33e831b5f8) C:\Windows\system32\DRIVERS\e1y60x64.sys
18:07:54.0075 4192 e1yexpress - ok
18:07:54.0138 4192 Ecache (5f94962be5a62db6e447ff6470c4f48a) C:\Windows\system32\drivers\ecache.sys
18:07:54.0184 4192 Ecache - ok
18:07:54.0216 4192 elxstor (c4636d6e10469404ab5308d9fd45ed07) C:\Windows\system32\drivers\elxstor.sys
18:07:54.0262 4192 elxstor - ok
18:07:54.0309 4192 ErrDev (991fab6aa066e1214efb5b496fb7959a) C:\Windows\system32\drivers\errdev.sys
18:07:54.0340 4192 ErrDev - ok
18:07:54.0496 4192 exfat (486844f47b6636044a42454614ed4523) C:\Windows\system32\drivers\exfat.sys
18:07:54.0528 4192 exfat - ok
18:07:54.0574 4192 fastfat (1a4bee34277784619ddaf0422c0c6e23) C:\Windows\system32\drivers\fastfat.sys
18:07:54.0606 4192 fastfat - ok
18:07:54.0652 4192 fdc (81b79b6df71fa1d2c6d688d830616e39) C:\Windows\system32\DRIVERS\fdc.sys
18:07:54.0684 4192 fdc - ok
18:07:54.0730 4192 FileInfo (457b7d1d533e4bd62a99aed9c7bb4c59) C:\Windows\system32\drivers\fileinfo.sys
18:07:54.0762 4192 FileInfo - ok
18:07:54.0808 4192 Filetrace (d421327fd6efccaf884a54c58e1b0d7f) C:\Windows\system32\drivers\filetrace.sys
18:07:54.0840 4192 Filetrace - ok
18:07:54.0871 4192 flpydisk (230923ea2b80f79b0f88d90f87b87ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
18:07:54.0918 4192 flpydisk - ok
18:07:54.0980 4192 FltMgr (e3041bc26d6930d61f42aedb79c91720) C:\Windows\system32\drivers\fltmgr.sys
18:07:55.0011 4192 FltMgr - ok
18:07:55.0027 4192 Fs_Rec (29d99e860a1ca0a03c6a733fdd0da703) C:\Windows\system32\drivers\Fs_Rec.sys
18:07:55.0058 4192 Fs_Rec - ok
18:07:55.0089 4192 gagp30kx (c8e416668d3dc2be3d4fe4c79224997f) C:\Windows\system32\drivers\gagp30kx.sys
18:07:55.0120 4192 gagp30kx - ok
18:07:55.0167 4192 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
18:07:55.0198 4192 GEARAspiWDM - ok
18:07:55.0292 4192 HDAudBus (f942c5820205f2fb453243edfec82a3d) C:\Windows\system32\DRIVERS\HDAudBus.sys
18:07:55.0323 4192 HDAudBus - ok
18:07:55.0354 4192 HidBth (b4881c84a180e75b8c25dc1d726c375f) C:\Windows\system32\drivers\hidbth.sys
18:07:55.0386 4192 HidBth - ok
18:07:55.0401 4192 HidIr (4e77a77e2c986e8f88f996bb3e1ad829) C:\Windows\system32\drivers\hidir.sys
18:07:55.0432 4192 HidIr - ok
18:07:55.0479 4192 HidUsb (443bdd2d30bb4f00795c797e2cf99edf) C:\Windows\system32\DRIVERS\hidusb.sys
18:07:55.0510 4192 HidUsb - ok
18:07:55.0588 4192 HpCISSs (d7109a1e6bd2dfdbcba72a6bc626a13b) C:\Windows\system32\drivers\hpcisss.sys
18:07:55.0620 4192 HpCISSs - ok
18:07:55.0698 4192 HTTP (098f1e4e5c9cb5b0063a959063631610) C:\Windows\system32\drivers\HTTP.sys
18:07:55.0744 4192 HTTP - ok
18:07:55.0776 4192 i2omp (da94c854cea5fac549d4e1f6e88349e8) C:\Windows\system32\drivers\i2omp.sys
18:07:55.0807 4192 i2omp - ok
18:07:55.0838 4192 i8042prt (cbb597659a2713ce0c9cc20c88c7591f) C:\Windows\system32\DRIVERS\i8042prt.sys
18:07:55.0869 4192 i8042prt - ok
18:07:55.0916 4192 iaStor (fc28e90f2204d8fd147fa9bfa8a51c01) C:\Windows\system32\drivers\iastor.sys
18:07:55.0963 4192 iaStor - ok
18:07:55.0994 4192 iaStorV (3e3bf3627d886736d0b4e90054f929f6) C:\Windows\system32\drivers\iastorv.sys
18:07:56.0041 4192 iaStorV - ok
18:07:56.0088 4192 iirsp (8c3951ad2fe886ef76c7b5027c3125d3) C:\Windows\system32\drivers\iirsp.sys
18:07:56.0119 4192 iirsp - ok
18:07:56.0337 4192 IntcAzAudAddService (e28edf74900e68184f44cfcdd66f1bc3) C:\Windows\system32\drivers\RTKVHD64.sys
18:07:56.0368 4192 IntcAzAudAddService - ok
18:07:56.0415 4192 intelide (df797a12176f11b2d301c5b234bb200e) C:\Windows\system32\DRIVERS\intelide.sys
18:07:56.0446 4192 intelide - ok
18:07:56.0462 4192 intelppm (bfd84af32fa1bad6231c4585cb469630) C:\Windows\system32\DRIVERS\intelppm.sys
18:07:56.0493 4192 intelppm - ok
18:07:56.0540 4192 IpFilterDriver (d8aabc341311e4780d6fce8c73c0ad81) C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:07:56.0587 4192 IpFilterDriver - ok
18:07:56.0587 4192 IpInIp - ok
18:07:56.0618 4192 IPMIDRV (9c2ee2e6e5a7203bfae15c299475ec67) C:\Windows\system32\drivers\ipmidrv.sys
18:07:56.0649 4192 IPMIDRV - ok
18:07:56.0727 4192 IPNAT (b7e6212f581ea5f6ab0c3a6ceeeb89be) C:\Windows\system32\DRIVERS\ipnat.sys
18:07:56.0774 4192 IPNAT - ok
18:07:56.0805 4192 IRENUM (8c42ca155343a2f11d29feca67faa88d) C:\Windows\system32\drivers\irenum.sys
18:07:56.0836 4192 IRENUM - ok
18:07:56.0868 4192 isapnp (0672bfcedc6fc468a2b0500d81437f4f) C:\Windows\system32\drivers\isapnp.sys
18:07:56.0899 4192 isapnp - ok
18:07:56.0961 4192 iScsiPrt (e4fdf99599f27ec25d2cf6d754243520) C:\Windows\system32\DRIVERS\msiscsi.sys
18:07:57.0008 4192 iScsiPrt - ok
18:07:57.0039 4192 iteatapi (63c766cdc609ff8206cb447a65abba4a) C:\Windows\system32\drivers\iteatapi.sys
18:07:57.0070 4192 iteatapi - ok
18:07:57.0164 4192 iteraid (1281fe73b17664631d12f643cbea3f59) C:\Windows\system32\drivers\iteraid.sys
18:07:57.0195 4192 iteraid - ok
18:07:57.0226 4192 kbdclass (423696f3ba6472dd17699209b933bc26) C:\Windows\system32\DRIVERS\kbdclass.sys
18:07:57.0258 4192 kbdclass - ok
18:07:57.0304 4192 kbdhid (dbdf75d51464fbc47d0104ec3d572c05) C:\Windows\system32\DRIVERS\kbdhid.sys
18:07:57.0336 4192 kbdhid - ok
18:07:57.0429 4192 KSecDD (476e2c1dcea45895994bef11c2a98715) C:\Windows\system32\Drivers\ksecdd.sys
18:07:57.0460 4192 KSecDD - ok
18:07:57.0476 4192 ksthunk (1d419cf43db29396ecd7113d129d94eb) C:\Windows\system32\drivers\ksthunk.sys
18:07:57.0507 4192 ksthunk - ok
18:07:57.0616 4192 lltdio (96ece2659b6654c10a0c310ae3a6d02c) C:\Windows\system32\DRIVERS\lltdio.sys
18:07:57.0648 4192 lltdio - ok
18:07:58.0053 4192 LSI_FC (acbe1af32d3123e330a07bfbc5ec4a9b) C:\Windows\system32\drivers\lsi_fc.sys
18:07:58.0084 4192 LSI_FC - ok
18:07:58.0225 4192 LSI_SAS (799ffb2fc4729fa46d2157c0065b3525) C:\Windows\system32\drivers\lsi_sas.sys
18:07:58.0272 4192 LSI_SAS - ok
18:07:58.0287 4192 LSI_SCSI (f445ff1daad8a226366bfaf42551226b) C:\Windows\system32\drivers\lsi_scsi.sys
18:07:58.0334 4192 LSI_SCSI - ok
18:07:58.0365 4192 luafv (52f87b9cc8932c2a7375c3b2a9be5e3e) C:\Windows\system32\drivers\luafv.sys
18:07:58.0396 4192 luafv - ok
18:07:58.0490 4192 megasas (5c5cd6aaced32fb26c3fb34b3dcf972f) C:\Windows\system32\drivers\megasas.sys
18:07:58.0521 4192 megasas - ok
18:07:58.0599 4192 MegaSR (859bc2436b076c77c159ed694acfe8f8) C:\Windows\system32\drivers\megasr.sys
18:07:58.0646 4192 MegaSR - ok
18:07:58.0724 4192 mfeavfk (088620da20b98578bfc4b97043f24042) C:\Windows\system32\drivers\mfeavfk.sys
18:07:58.0771 4192 mfeavfk - ok
18:07:58.0833 4192 mfebopk (dd7b52227da36f2718306c98e474b51b) C:\Windows\system32\drivers\mfebopk.sys
18:07:58.0880 4192 mfebopk - ok
18:07:58.0942 4192 mfehidk (239e677e3e9047550c18b30c26c3ba3e) C:\Windows\system32\drivers\mfehidk.sys
18:07:58.0989 4192 mfehidk - ok
18:07:59.0020 4192 mferkdk (bb6bdc9029ca71d652eadc40ff78f7cb) C:\Windows\system32\drivers\mferkdk.sys
18:07:59.0067 4192 mferkdk - ok
18:07:59.0098 4192 mfesmfk (1f56e31db436287581cbe9a5c4c70e0e) C:\Windows\system32\drivers\mfesmfk.sys
18:07:59.0130 4192 mfesmfk - ok
18:07:59.0145 4192 Modem (59848d5cc74606f0ee7557983bb73c2e) C:\Windows\system32\drivers\modem.sys
18:07:59.0176 4192 Modem - ok
18:07:59.0223 4192 monitor (c247cc2a57e0a0c8c6dccf7807b3e9e5) C:\Windows\system32\DRIVERS\monitor.sys
18:07:59.0254 4192 monitor - ok
18:07:59.0270 4192 mouclass (9367304e5e412b120cf5f4ea14e4e4f1) C:\Windows\system32\DRIVERS\mouclass.sys
18:07:59.0317 4192 mouclass - ok
18:07:59.0348 4192 mouhid (c2c2bd5c5ce5aaf786ddd74b75d2ac69) C:\Windows\system32\DRIVERS\mouhid.sys
18:07:59.0379 4192 mouhid - ok
18:07:59.0410 4192 MountMgr (11bc9b1e8801b01f7f6adb9ead30019b) C:\Windows\system32\drivers\mountmgr.sys
18:07:59.0457 4192 MountMgr - ok
18:07:59.0551 4192 MPFP (ae2e68527013eb4f761eccc630f7f1a3) C:\Windows\system32\Drivers\Mpfp.sys
18:07:59.0582 4192 MPFP - ok
18:07:59.0769 4192 mpio (f8276eb8698142884498a528dfea8478) C:\Windows\system32\drivers\mpio.sys
18:07:59.0800 4192 mpio - ok
18:07:59.0925 4192 mpsdrv (c92b9abdb65a5991e00c28f13491dba2) C:\Windows\system32\drivers\mpsdrv.sys
18:07:59.0956 4192 mpsdrv - ok
18:07:59.0988 4192 Mraid35x (3c200630a89ef2c0864d515b7a75802e) C:\Windows\system32\drivers\mraid35x.sys
18:08:00.0019 4192 Mraid35x - ok
18:08:00.0050 4192 MRxDAV (7c1de4aa96dc0c071611f9e7de02a68d) C:\Windows\system32\drivers\mrxdav.sys
18:08:00.0097 4192 MRxDAV - ok
18:08:00.0144 4192 mrxsmb (1485811b320ff8c7edad1caebb1c6c2b) C:\Windows\system32\DRIVERS\mrxsmb.sys
18:08:00.0175 4192 mrxsmb - ok
18:08:00.0222 4192 mrxsmb10 (3b929a60c833fc615fd97fba82bc7632) C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:08:00.0253 4192 mrxsmb10 - ok
18:08:00.0268 4192 mrxsmb20 (c64ab3e1f53b4f5b5bb6d796b2d7bec3) C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:08:00.0300 4192 mrxsmb20 - ok
18:08:00.0331 4192 msahci (730b784962d22d2c6481eae2370e7c8c) C:\Windows\system32\drivers\msahci.sys
18:08:00.0393 4192 msahci - ok
18:08:00.0409 4192 msdsm (264bbb4aaf312a485f0e44b65a6b7202) C:\Windows\system32\drivers\msdsm.sys
18:08:00.0456 4192 msdsm - ok
18:08:00.0518 4192 MSDV (df674ba7da5a4753d839a905b66d2fd9) C:\Windows\system32\DRIVERS\msdv.sys
18:08:00.0565 4192 MSDV - ok
18:08:00.0627 4192 Msfs (704f59bfc4512d2bb0146aec31b10a7c) C:\Windows\system32\drivers\Msfs.sys
18:08:00.0658 4192 Msfs - ok
18:08:00.0674 4192 msisadrv (00ebc952961664780d43dca157e79b27) C:\Windows\system32\drivers\msisadrv.sys
18:08:00.0705 4192 msisadrv - ok
18:08:00.0752 4192 MSKSSRV (0ea73e498f53b96d83dbfca074ad4cf8) C:\Windows\system32\drivers\MSKSSRV.sys
18:08:00.0783 4192 MSKSSRV - ok
18:08:00.0814 4192 MSPCLOCK (52e59b7e992a58e740aa63f57edbae8b) C:\Windows\system32\drivers\MSPCLOCK.sys
18:08:00.0846 4192 MSPCLOCK - ok
18:08:00.0892 4192 MSPQM (49084a75bae043ae02d5b44d02991bb2) C:\Windows\system32\drivers\MSPQM.sys
18:08:00.0924 4192 MSPQM - ok
18:08:01.0048 4192 MsRPC (dc6ccf440cdede4293db41c37a5060a5) C:\Windows\system32\drivers\MsRPC.sys
18:08:01.0080 4192 MsRPC - ok
18:08:01.0111 4192 mssmbios (855796e59df77ea93af46f20155bf55b) C:\Windows\system32\DRIVERS\mssmbios.sys
18:08:01.0142 4192 mssmbios - ok
18:08:01.0173 4192 MSTEE (86d632d75d05d5b7c7c043fa3564ae86) C:\Windows\system32\drivers\MSTEE.sys
18:08:01.0204 4192 MSTEE - ok
18:08:01.0220 4192 Mup (0cc49f78d8aca0877d885f149084e543) C:\Windows\system32\Drivers\mup.sys
18:08:01.0251 4192 Mup - ok
18:08:01.0329 4192 NativeWifiP (2007b826c4acd94ae32232b41f0842b9) C:\Windows\system32\DRIVERS\nwifi.sys
18:08:01.0360 4192 NativeWifiP - ok
18:08:01.0548 4192 NDIS (65950e07329fcee8e6516b17c8d0abb6) C:\Windows\system32\drivers\ndis.sys
18:08:01.0594 4192 NDIS - ok
18:08:01.0828 4192 NdisTapi (64df698a425478e321981431ac171334) C:\Windows\system32\DRIVERS\ndistapi.sys
18:08:01.0860 4192 NdisTapi - ok
18:08:01.0875 4192 Ndisuio (8baa43196d7b5bb972c9a6b2bbf61a19) C:\Windows\system32\DRIVERS\ndisuio.sys
18:08:01.0906 4192 Ndisuio - ok
18:08:01.0953 4192 NdisWan (f8158771905260982ce724076419ef19) C:\Windows\system32\DRIVERS\ndiswan.sys
18:08:01.0984 4192 NdisWan - ok
18:08:02.0016 4192 NDProxy (9cb77ed7cb72850253e973a2d6afdf49) C:\Windows\system32\drivers\NDProxy.sys
18:08:02.0047 4192 NDProxy - ok
18:08:02.0062 4192 NetBIOS (a499294f5029a7862adc115bda7371ce) C:\Windows\system32\DRIVERS\netbios.sys
18:08:02.0094 4192 NetBIOS - ok
18:08:02.0156 4192 netbt (fc2c792ebddc8e28df939d6a92c83d61) C:\Windows\system32\DRIVERS\netbt.sys
18:08:02.0187 4192 netbt - ok
18:08:02.0250 4192 nfrd960 (4ac08bd6af2df42e0c3196d826c8aea7) C:\Windows\system32\drivers\nfrd960.sys
18:08:02.0281 4192 nfrd960 - ok
18:08:02.0343 4192 Npfs (b298874f8e0ea93f06ec40aa8d146478) C:\Windows\system32\drivers\Npfs.sys
18:08:02.0374 4192 Npfs - ok
18:08:02.0421 4192 nsiproxy (1523af19ee8b030ba682f7a53537eaeb) C:\Windows\system32\drivers\nsiproxy.sys
18:08:02.0468 4192 nsiproxy - ok
18:08:02.0671 4192 Ntfs (bac869dfb98e499ba4d9bb1fb43270e1) C:\Windows\system32\drivers\Ntfs.sys
18:08:02.0702 4192 Ntfs - ok
18:08:02.0718 4192 Null (dd5d684975352b85b52e3fd5347c20cb) C:\Windows\system32\drivers\Null.sys
18:08:02.0749 4192 Null - ok
18:08:02.0796 4192 NVHDA (6574620a7d7549bb72ea26c162025909) C:\Windows\system32\drivers\nvhda64v.sys
18:08:02.0827 4192 NVHDA - ok
18:08:03.0451 4192 nvlddmkm (68fa1d402873cd7c06096584d8c3c403) C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:08:04.0200 4192 nvlddmkm - ok
18:08:04.0278 4192 nvraid (2c040b7ada5b06f6facadac8514aa034) C:\Windows\system32\drivers\nvraid.sys
18:08:04.0309 4192 nvraid - ok
18:08:04.0340 4192 nvstor (f7ea0fe82842d05eda3efdd376dbfdba) C:\Windows\system32\drivers\nvstor.sys
18:08:04.0371 4192 nvstor - ok
18:08:04.0402 4192 nv_agp (19067ca93075ef4823e3938a686f532f) C:\Windows\system32\drivers\nv_agp.sys
18:08:04.0434 4192 nv_agp - ok
18:08:04.0449 4192 NwlnkFlt - ok
18:08:04.0465 4192 NwlnkFwd - ok
18:08:04.0574 4192 OA002Afx (226d2c0e1aa9040646d6b158fd344046) C:\Windows\system32\Drivers\OA002Afx.sys
18:08:04.0605 4192 OA002Afx - ok
18:08:04.0668 4192 OA002Ufd (706f5504af9f28c8641dab5eddfde03b) C:\Windows\system32\DRIVERS\OA002Ufd.sys
18:08:04.0699 4192 OA002Ufd - ok
18:08:04.0746 4192 OA002Vid (2ce066adca145892715f1df163d879da) C:\Windows\system32\DRIVERS\OA002Vid.sys
18:08:04.0777 4192 OA002Vid - ok
18:08:04.0855 4192 ohci1394 (b5b1ce65ac15bbd11c0619e3ef7cfc28) C:\Windows\system32\DRIVERS\ohci1394.sys
18:08:04.0886 4192 ohci1394 - ok
18:08:04.0948 4192 Packet (99e6aa0ae2d05389ba7f7dff6866b569) C:\Windows\system32\DRIVERS\packet.sys
18:08:04.0995 4192 Packet - ok
18:08:05.0042 4192 Parport (aecd57f94c887f58919f307c35498ea0) C:\Windows\system32\drivers\parport.sys
18:08:05.0089 4192 Parport - ok
18:08:05.0136 4192 partmgr (f9b5eda4c17a2be7663f064dbf0fe254) C:\Windows\system32\drivers\partmgr.sys
18:08:05.0182 4192 partmgr - ok
18:08:05.0229 4192 pci (47ab1e0fc9d0e12bb53ba246e3a0906d) C:\Windows\system32\drivers\pci.sys
18:08:05.0276 4192 pci - ok
18:08:05.0323 4192 pciide (2657f6c0b78c36d95034be109336e382) C:\Windows\system32\drivers\pciide.sys
18:08:05.0354 4192 pciide - ok
18:08:05.0401 4192 pcmcia (037661f3d7c507c9993b7010ceee6288) C:\Windows\system32\drivers\pcmcia.sys
18:08:05.0448 4192 pcmcia - ok
18:08:05.0557 4192 PCTCore (3a68080572b81577791a7b19bb880da9) C:\Windows\system32\drivers\PCTCore64.sys
18:08:05.0588 4192 PCTCore - ok
18:08:05.0650 4192 PEAUTH (58865916f53592a61549b04941bfd80d) C:\Windows\system32\drivers\peauth.sys
18:08:05.0697 4192 PEAUTH - ok
18:08:05.0775 4192 PptpMiniport (23386e9952025f5f21c368971e2e7301) C:\Windows\system32\DRIVERS\raspptp.sys
18:08:05.0806 4192 PptpMiniport - ok
18:08:05.0838 4192 Processor (5080e59ecee0bc923f14018803aa7a01) C:\Windows\system32\drivers\processr.sys
18:08:05.0869 4192 Processor - ok
18:08:05.0931 4192 PSched (c5ab7f0809392d0da027f4a2a81bfa31) C:\Windows\system32\DRIVERS\pacer.sys
18:08:05.0962 4192 PSched - ok
18:08:06.0009 4192 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
18:08:06.0040 4192 PxHlpa64 - ok
18:08:06.0118 4192 ql2300 (0b83f4e681062f3839be2ec1d98fd94a) C:\Windows\system32\drivers\ql2300.sys
18:08:06.0165 4192 ql2300 - ok
18:08:06.0196 4192 ql40xx (e1c80f8d4d1e39ef9595809c1369bf2a) C:\Windows\system32\drivers\ql40xx.sys
18:08:06.0228 4192 ql40xx - ok
18:08:06.0259 4192 QWAVEdrv (e8d76edab77ec9c634c27b8eac33adc5) C:\Windows\system32\drivers\qwavedrv.sys
18:08:06.0290 4192 QWAVEdrv - ok
18:08:06.0664 4192 R300 (2a09a6b271d1f50adf5e33b37d460de6) C:\Windows\system32\DRIVERS\atikmdag.sys
18:08:06.0727 4192 R300 - ok
18:08:06.0914 4192 RasAcd (1013b3b663a56d3ddd784f581c1bd005) C:\Windows\system32\DRIVERS\rasacd.sys
18:08:06.0945 4192 RasAcd - ok
18:08:07.0054 4192 Rasl2tp (ac7bc4d42a7e558718dfdec599bbfc2c) C:\Windows\system32\DRIVERS\rasl2tp.sys
18:08:07.0086 4192 Rasl2tp - ok
18:08:07.0117 4192 RasPppoe (4517fbf8b42524afe4ede1de102aae3e) C:\Windows\system32\DRIVERS\raspppoe.sys
18:08:07.0148 4192 RasPppoe - ok
18:08:07.0179 4192 RasSstp (c6a593b51f34c33e5474539544072527) C:\Windows\system32\DRIVERS\rassstp.sys
18:08:07.0210 4192 RasSstp - ok
18:08:07.0242 4192 rdbss (322db5c6b55e8d8ee8d6f358b2aaabb1) C:\Windows\system32\DRIVERS\rdbss.sys
18:08:07.0288 4192 rdbss - ok
18:08:07.0304 4192 RDPCDD (603900cc05f6be65ccbf373800af3716) C:\Windows\system32\DRIVERS\RDPCDD.sys
18:08:07.0335 4192 RDPCDD - ok
18:08:07.0366 4192 rdpdr (c045d1fb111c28df0d1be8d4bda22c06) C:\Windows\system32\drivers\rdpdr.sys
18:08:07.0398 4192 rdpdr - ok
18:08:07.0413 4192 RDPENCDD (cab9421daf3d97b33d0d055858e2c3ab) C:\Windows\system32\drivers\rdpencdd.sys
18:08:07.0444 4192 RDPENCDD - ok
18:08:07.0491 4192 RDPWD (b1d741c87cea8d7282146366cc9c3f81) C:\Windows\system32\drivers\RDPWD.sys
18:08:07.0522 4192 RDPWD - ok
18:08:07.0600 4192 rspndr (22a9cb08b1a6707c1550c6bf099aae73) C:\Windows\system32\DRIVERS\rspndr.sys
18:08:07.0632 4192 rspndr - ok
18:08:07.0694 4192 sbp2port (cd9c693589c60ad59bbbcfb0e524e01b) C:\Windows\system32\drivers\sbp2port.sys
18:08:07.0725 4192 sbp2port - ok
18:08:07.0803 4192 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
18:08:07.0834 4192 secdrv - ok
18:08:07.0881 4192 Serenum (f71bfe7ac6c52273b7c82cbf1bb2a222) C:\Windows\system32\drivers\serenum.sys
18:08:07.0912 4192 Serenum - ok
18:08:07.0928 4192 Serial (e62fac91ee288db29a9696a9d279929c) C:\Windows\system32\drivers\serial.sys
18:08:07.0975 4192 Serial - ok
18:08:08.0006 4192 sermouse (a842f04833684bceea7336211be478df) C:\Windows\system32\drivers\sermouse.sys
18:08:08.0037 4192 sermouse - ok
18:08:08.0100 4192 sffdisk (14d4b4465193a87c127933978e8c4106) C:\Windows\system32\drivers\sffdisk.sys
18:08:08.0131 4192 sffdisk - ok
18:08:08.0162 4192 sffp_mmc (7073aee3f82f3d598e3825962aa98ab2) C:\Windows\system32\drivers\sffp_mmc.sys
18:08:08.0193 4192 sffp_mmc - ok
18:08:08.0224 4192 sffp_sd (35e59ebe4a01a0532ed67975161c7b82) C:\Windows\system32\drivers\sffp_sd.sys
18:08:08.0256 4192 sffp_sd - ok
18:08:08.0287 4192 sfloppy (6b7838c94135768bd455cbdc23e39e5f) C:\Windows\system32\drivers\sfloppy.sys
18:08:08.0318 4192 sfloppy - ok
18:08:08.0365 4192 SiSRaid2 (7a5de502aeb719d4594c6471060a78b3) C:\Windows\system32\drivers\sisraid2.sys
18:08:08.0412 4192 SiSRaid2 - ok
18:08:08.0427 4192 SiSRaid4 (3a2f769fab9582bc720e11ea1dfb184d) C:\Windows\system32\drivers\sisraid4.sys
18:08:08.0474 4192 SiSRaid4 - ok
18:08:08.0521 4192 Smb (290b6f6a0ec4fcdfc90f5cb6d7020473) C:\Windows\system32\DRIVERS\smb.sys
18:08:08.0552 4192 Smb - ok
18:08:08.0630 4192 spldr (386c3c63f00a7040c7ec5e384217e89d) C:\Windows\system32\drivers\spldr.sys
18:08:08.0661 4192 spldr - ok
18:08:08.0802 4192 srv (880a57fccb571ebd063d4dd50e93e46d) C:\Windows\system32\DRIVERS\srv.sys
18:08:08.0833 4192 srv - ok
18:08:09.0098 4192 srv2 (a1ad14a6d7a37891fffeca35ebbb0730) C:\Windows\system32\DRIVERS\srv2.sys
18:08:09.0129 4192 srv2 - ok
18:08:09.0301 4192 srvnet (4bed62f4fa4d8300973f1151f4c4d8a7) C:\Windows\system32\DRIVERS\srvnet.sys
18:08:09.0348 4192 srvnet - ok
18:08:09.0410 4192 swenum (8a851ca908b8b974f89c50d2e18d4f0c) C:\Windows\system32\DRIVERS\swenum.sys
18:08:09.0457 4192 swenum - ok
18:08:09.0535 4192 Symc8xx (2f26a2c6fc96b29beff5d8ed74e6625b) C:\Windows\system32\drivers\symc8xx.sys
18:08:09.0566 4192 Symc8xx - ok
18:08:09.0613 4192 Sym_hi (a909667976d3bccd1df813fed517d837) C:\Windows\system32\drivers\sym_hi.sys
18:08:09.0660 4192 Sym_hi - ok
18:08:09.0800 4192 Sym_u3 (36887b56ec2d98b9c362f6ae4de5b7b0) C:\Windows\system32\drivers\sym_u3.sys
18:08:09.0847 4192 Sym_u3 - ok
18:08:10.0190 4192 Tcpip (2cc45d932bd193cd4117321d469ad6b2) C:\Windows\system32\drivers\tcpip.sys
18:08:10.0221 4192 Tcpip - ok
18:08:10.0252 4192 Tcpip6 (2cc45d932bd193cd4117321d469ad6b2) C:\Windows\system32\DRIVERS\tcpip.sys
18:08:10.0268 4192 Tcpip6 - ok
18:08:10.0330 4192 tcpipreg (c7e72a4071ee0200e3c075dacfb2b334) C:\Windows\system32\drivers\tcpipreg.sys
18:08:10.0362 4192 tcpipreg - ok
18:08:10.0393 4192 TDPIPE (1d8bf4aaa5fb7a2761475781dc1195bc) C:\Windows\system32\drivers\tdpipe.sys
18:08:10.0424 4192 TDPIPE - ok
18:08:10.0440 4192 TDTCP (7f7e00cdf609df657f4cda02dd1c9bb1) C:\Windows\system32\drivers\tdtcp.sys
18:08:10.0471 4192 TDTCP - ok
18:08:10.0549 4192 tdx (458919c8c42e398dc4802178d5ffee27) C:\Windows\system32\DRIVERS\tdx.sys
18:08:10.0580 4192 tdx - ok
18:08:10.0674 4192 TermDD (8c19678d22649ec002ef2282eae92f98) C:\Windows\system32\DRIVERS\termdd.sys
18:08:10.0689 4192 TermDD - ok
18:08:10.0783 4192 TIEHDUSB (199c2e87d9a5ec58d0bcd94e893bf629) C:\Windows\system32\DRIVERS\tiehdusb.sys
18:08:10.0814 4192 TIEHDUSB - ok
18:08:10.0908 4192 Tpkd (e36c2b04b7eb90a7c3e29ebdfc3a8d30) C:\Windows\system32\drivers\Tpkd.sys
18:08:10.0923 4192 Tpkd - ok
18:08:11.0032 4192 tssecsrv (9e5409cd17c8bef193aad498f3bc2cb8) C:\Windows\system32\DRIVERS\tssecsrv.sys
18:08:11.0064 4192 tssecsrv - ok
18:08:11.0079 4192 tunmp (89ec74a9e602d16a75a4170511029b3c) C:\Windows\system32\DRIVERS\tunmp.sys
18:08:11.0110 4192 tunmp - ok
18:08:11.0173 4192 tunnel (30a9b3f45ad081bffc3bcaa9c812b609) C:\Windows\system32\DRIVERS\tunnel.sys
18:08:11.0204 4192 tunnel - ok
18:08:11.0220 4192 uagp35 (fec266ef401966311744bd0f359f7f56) C:\Windows\system32\drivers\uagp35.sys
18:08:11.0251 4192 uagp35 - ok
18:08:11.0376 4192 udfs (faf2640a2a76ed03d449e443194c4c34) C:\Windows\system32\DRIVERS\udfs.sys
18:08:11.0422 4192 udfs - ok
18:08:11.0485 4192 uliagpkx (4ec9447ac3ab462647f60e547208ca00) C:\Windows\system32\drivers\uliagpkx.sys
18:08:11.0516 4192 uliagpkx - ok
18:08:11.0563 4192 uliahci (697f0446134cdc8f99e69306184fbbb4) C:\Windows\system32\drivers\uliahci.sys
18:08:11.0610 4192 uliahci - ok
18:08:11.0656 4192 UlSata (31707f09846056651ea2c37858f5ddb0) C:\Windows\system32\drivers\ulsata.sys
18:08:11.0688 4192 UlSata - ok
18:08:11.0734 4192 ulsata2 (85e5e43ed5b48c8376281bab519271b7) C:\Windows\system32\drivers\ulsata2.sys
18:08:11.0781 4192 ulsata2 - ok
18:08:11.0812 4192 umbus (46e9a994c4fed537dd951f60b86ad3f4) C:\Windows\system32\DRIVERS\umbus.sys
18:08:11.0844 4192 umbus - ok
18:08:11.0875 4192 UMPass (01abe05c401e70795b43a8933b44831e) C:\Windows\system32\DRIVERS\umpass.sys
18:08:11.0906 4192 UMPass - ok
18:08:11.0968 4192 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
18:08:12.0000 4192 USBAAPL64 - ok
18:08:12.0046 4192 usbaudio (c6ba890de6e41857fbe84175519cae7d) C:\Windows\system32\drivers\usbaudio.sys
18:08:12.0093 4192 usbaudio - ok
18:08:12.0140 4192 usbccgp (07e3498fc60834219d2356293da0fecc) C:\Windows\system32\DRIVERS\usbccgp.sys
18:08:12.0171 4192 usbccgp - ok
18:08:12.0202 4192 usbcir (9247f7e0b65852c1f6631480984d6ed2) C:\Windows\system32\drivers\usbcir.sys
18:08:12.0234 4192 usbcir - ok
18:08:12.0265 4192 usbehci (b1c7edb07f61bdee587831b440fc7656) C:\Windows\system32\DRIVERS\usbehci.sys
18:08:12.0296 4192 usbehci - ok
18:08:12.0374 4192 usbhub (bb35cd80a2ececfadc73569b3d70c7d1) C:\Windows\system32\DRIVERS\usbhub.sys
18:08:12.0405 4192 usbhub - ok
18:08:12.0436 4192 usbohci (eba14ef0c07cec233f1529c698d0d154) C:\Windows\system32\drivers\usbohci.sys
18:08:12.0468 4192 usbohci - ok
18:08:12.0546 4192 usbprint (28b693b6d31e7b9332c1bdcefef228c1) C:\Windows\system32\DRIVERS\usbprint.sys
18:08:12.0577 4192 usbprint - ok
18:08:12.0608 4192 usbscan (ea0bf666868964fbe8cb10e50c97b9f1) C:\Windows\system32\DRIVERS\usbscan.sys
18:08:12.0639 4192 usbscan - ok
18:08:12.0717 4192 USBSTOR (b854c1558fca0c269a38663e8b59b581) C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:08:12.0717 4192 USBSTOR - ok
18:08:12.0764 4192 usbuhci (c8d88a2a3587a8424b4b17a6f7eb67fa) C:\Windows\system32\DRIVERS\usbuhci.sys
18:08:12.0795 4192 usbuhci - ok
18:08:12.0858 4192 usbvideo (fc33099877790d51b0927b7039059855) C:\Windows\system32\Drivers\usbvideo.sys
18:08:12.0889 4192 usbvideo - ok
18:08:12.0920 4192 vga (916b94bcf1e09873fff2d5fb11767bbc) C:\Windows\system32\DRIVERS\vgapnp.sys
18:08:12.0951 4192 vga - ok
18:08:12.0998 4192 VgaSave (b83ab16b51feda65dd81b8c59d114d63) C:\Windows\System32\drivers\vga.sys
18:08:13.0014 4192 VgaSave - ok
18:08:13.0045 4192 viaide (8294b6c3fdb6c33f24e150de647ecdaa) C:\Windows\system32\drivers\viaide.sys
18:08:13.0076 4192 viaide - ok
18:08:13.0107 4192 volmgr (2b7e885ed951519a12c450d24535dfca) C:\Windows\system32\drivers\volmgr.sys
18:08:13.0154 4192 volmgr - ok
18:08:13.0201 4192 volmgrx (cec5ac15277d75d9e5dec2e1c6eaf877) C:\Windows\system32\drivers\volmgrx.sys
18:08:13.0248 4192 volmgrx - ok
18:08:13.0294 4192 volsnap (5280aada24ab36b01a84a6424c475c8d) C:\Windows\system32\drivers\volsnap.sys
18:08:13.0341 4192 volsnap - ok
18:08:13.0388 4192 vsmraid (a68f455ed2673835209318dd61bfbb0e) C:\Windows\system32\drivers\vsmraid.sys
18:08:13.0419 4192 vsmraid - ok
18:08:13.0497 4192 wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys
18:08:13.0544 4192 wacommousefilter - ok
18:08:13.0560 4192 WacomPen (fef8fe5923fead2cee4dfabfce3393a7) C:\Windows\system32\drivers\wacompen.sys
18:08:13.0591 4192 WacomPen - ok
18:08:13.0669 4192 wacomvhid (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys
18:08:13.0700 4192 wacomvhid - ok
18:08:13.0762 4192 Wanarp (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys
18:08:13.0794 4192 Wanarp - ok
18:08:13.0794 4192 Wanarpv6 (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys
18:08:13.0794 4192 Wanarpv6 - ok
18:08:13.0872 4192 Wd (0c17a0816f65b89e362e682ad5e7266e) C:\Windows\system32\drivers\wd.sys
18:08:13.0903 4192 Wd - ok
18:08:13.0996 4192 Wdf01000 (d02e7e4567da1e7582fbf6a91144b0df) C:\Windows\system32\drivers\Wdf01000.sys
18:08:14.0043 4192 Wdf01000 - ok
18:08:14.0152 4192 WmiAcpi (7999dfb1c555efc0db69576f70027867) C:\Windows\system32\drivers\wmiacpi.sys
18:08:14.0184 4192 WmiAcpi - ok
18:08:14.0262 4192 WpdUsb (5e2401b3fc1089c90e081291357371a9) C:\Windows\system32\DRIVERS\wpdusb.sys
18:08:14.0293 4192 WpdUsb - ok
18:08:14.0480 4192 ws2ifsl (8a900348370e359b6bff6a550e4649e1) C:\Windows\system32\drivers\ws2ifsl.sys
18:08:14.0511 4192 ws2ifsl - ok
18:08:14.0574 4192 WUDFRd (501a65252617b495c0f1832f908d54d8) C:\Windows\system32\DRIVERS\WUDFRd.sys
18:08:14.0605 4192 WUDFRd - ok
18:08:14.0652 4192 MBR (0x1B8) (6f9a1d528242bc09104b85e0becf5554) \Device\Harddisk0\DR0
18:08:14.0683 4192 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.a ) - infected
18:08:14.0683 4192 \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.a (0)
18:08:14.0698 4192 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk1\DR7
18:08:14.0698 4192 \Device\Harddisk1\DR7 - ok
18:08:14.0730 4192 Boot (0x1200) (6e8a2cdf2fd41ad24e9b31d51dcbc778) \Device\Harddisk0\DR0\Partition0
18:08:14.0745 4192 \Device\Harddisk0\DR0\Partition0 - ok
18:08:14.0761 4192 Boot (0x1200) (ac4416963b521b473742284ae8515833) \Device\Harddisk0\DR0\Partition1
18:08:14.0761 4192 \Device\Harddisk0\DR0\Partition1 - ok
18:08:14.0761 4192 Boot (0x1200) (de736fb0c6c9fa6d8855d2dfa0118bab) \Device\Harddisk1\DR7\Partition0
18:08:14.0761 4192 \Device\Harddisk1\DR7\Partition0 - ok
18:08:14.0776 4192 ============================================================
18:08:14.0776 4192 Scan finished
18:08:14.0776 4192 ============================================================
18:08:14.0776 6680 Detected object count: 1
18:08:14.0776 6680 Actual detected object count: 1
18:08:28.0910 6680 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.a ) - will be cured on reboot
18:08:28.0910 6680 \Device\Harddisk0\DR0 - ok
18:08:28.0910 6680 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.a ) - User select action: Cure
18:08:34.0027 6944 Deinitialize success

**ken545** · 2012-01-07, 00:25

Make sure you reboot and then run aswMBR again and post the new log please.

Then run this program

Download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

**pmaxxx13** · 2012-01-07, 00:47

logs requested below

FYI - I got an error message when trying to shut down PC Tools Spyware Doctor

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-06 18:40:07
-----------------------------
18:40:07.270 OS Version: Windows x64 6.0.6002 Service Pack 2
18:40:07.271 Number of processors: 8 586 0x1A05
18:40:07.272 ComputerName: CONNORAPPLEB-PC UserName: Connor Appleby
18:40:09.113 Initialize success
18:40:16.372 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
18:40:16.375 Disk 0 Vendor: ST3750528AS CC44 Size: 715404MB BusType: 3
18:40:16.389 Disk 0 MBR read successfully
18:40:16.394 Disk 0 MBR scan
18:40:16.398 Disk 0 Windows VISTA default MBR code
18:40:16.404 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
18:40:16.447 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 15360 MB offset 129024
18:40:16.468 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 699980 MB offset 31586304
18:40:16.473 Service scanning
18:40:31.097 Modules scanning
18:40:31.103 Disk 0 trace - called modules:
18:40:31.130 ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys acpi.sys ataport.SYS pciide.sys
18:40:31.138 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009159300]
18:40:31.146 3 CLASSPNP.SYS[fffffa600100bc33] -> nt!IofCallDriver -> [0xfffffa8007c66320]
18:40:31.156 5 PCTCore64.sys[fffffa6000a665fc] -> nt!IofCallDriver -> [0xfffffa8007dd4760]
18:40:31.167 7 acpi.sys[fffffa6000947fde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8007db5060]
18:40:31.178 Scan finished successfully
18:40:58.979 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
18:40:58.995 The log file has been saved successfully to "F:\aswMBR.txt"
18:41:09.359 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
18:41:09.370 The log file has been saved successfully to "F:\aswMBR2.txt"

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 64-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Studio XPS 435MT
Logical Drives Mask: 0x000003fc

Kernel Drivers (total 155):
0x06C05000 \SystemRoot\system32\ntoskrnl.exe
0x0711D000 \SystemRoot\system32\hal.dll
0x0060C000 \SystemRoot\system32\kdcom.dll
0x00616000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00651000 \SystemRoot\system32\PSHED.dll
0x00665000 \SystemRoot\system32\CLFS.SYS
0x006C2000 \SystemRoot\system32\CI.dll
0x0080E000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008E8000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008F6000 \SystemRoot\system32\drivers\fltmgr.sys
0x0093D000 \SystemRoot\system32\drivers\acpi.sys
0x00993000 \SystemRoot\system32\drivers\WMILIB.SYS
0x0099C000 \SystemRoot\system32\drivers\msisadrv.sys
0x009A6000 \SystemRoot\system32\drivers\pci.sys
0x009D6000 \SystemRoot\System32\drivers\partmgr.sys
0x009EB000 \SystemRoot\system32\drivers\volmgr.sys
0x00774000 \SystemRoot\System32\drivers\volmgrx.sys
0x00800000 \SystemRoot\system32\DRIVERS\intelide.sys
0x007DA000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x007EA000 \SystemRoot\system32\drivers\pciide.sys
0x00A07000 \SystemRoot\System32\drivers\mountmgr.sys
0x00A1A000 \SystemRoot\system32\drivers\atapi.sys
0x00A22000 \SystemRoot\system32\drivers\ataport.SYS
0x00A46000 \SystemRoot\system32\drivers\fileinfo.sys
0x00A5A000 \SystemRoot\system32\drivers\PCTCore64.sys
0x00A92000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x00A9E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x00C0A000 \SystemRoot\system32\drivers\ndis.sys
0x00B25000 \SystemRoot\system32\drivers\msrpc.sys
0x00B75000 \SystemRoot\system32\drivers\NETIO.SYS
0x00E01000 \SystemRoot\System32\Drivers\Ntfs.sys
0x00F81000 \SystemRoot\system32\drivers\volsnap.sys
0x00FC5000 \SystemRoot\System32\Drivers\Tpkd.sys
0x00FE8000 \SystemRoot\System32\Drivers\spldr.sys
0x00DCD000 \SystemRoot\System32\Drivers\mup.sys
0x00BCE000 \SystemRoot\System32\drivers\ecache.sys
0x00DDF000 \SystemRoot\system32\drivers\disk.sys
0x0100A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x01036000 \SystemRoot\system32\drivers\crcdisk.sys
0x01062000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x0106F000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x01078000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x02808000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x03319000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x0331B000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x0108B000 \SystemRoot\System32\drivers\watchdog.sys
0x0109B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x01188000 \SystemRoot\system32\DRIVERS\e1y60x64.sys
0x011D8000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x03405000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x0344B000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x0345C000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x0346E000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x0347E000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0349A000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x034A7000 \SystemRoot\system32\DRIVERS\wacomvhid.sys
0x034AA000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x034BC000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x034C4000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x034FD000 \SystemRoot\system32\DRIVERS\storport.sys
0x0355A000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03567000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x0358A000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x03596000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x035C7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x035D7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x011E4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x03608000 \SystemRoot\system32\DRIVERS\termdd.sys
0x0361B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x03629000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x03635000 \SystemRoot\system32\DRIVERS\swenum.sys
0x03637000 \SystemRoot\system32\DRIVERS\ks.sys
0x0366B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x03676000 \SystemRoot\system32\DRIVERS\umbus.sys
0x03686000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x036CE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x036D9000 \SystemRoot\system32\DRIVERS\wacommousefilter.sys
0x036E1000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x036F5000 \SystemRoot\system32\drivers\nvhda64v.sys
0x0370C000 \SystemRoot\system32\drivers\portcls.sys
0x03747000 \SystemRoot\system32\drivers\drmk.sys
0x0376A000 \SystemRoot\system32\drivers\ksthunk.sys
0x0400B000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x041AA000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x041B4000 \SystemRoot\System32\Drivers\Null.SYS
0x041C8000 \SystemRoot\System32\drivers\vga.sys
0x041D6000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x04000000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x041BD000 \SystemRoot\system32\drivers\rdpencdd.sys
0x03770000 \SystemRoot\System32\Drivers\Msfs.SYS
0x0377B000 \SystemRoot\System32\Drivers\Npfs.SYS
0x0378C000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x04203000 \SystemRoot\System32\drivers\tcpip.sys
0x04378000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x043A4000 \SystemRoot\System32\Drivers\Mpfp.sys
0x043E1000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03795000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0x037B0000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x043FE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x037C8000 \SystemRoot\system32\DRIVERS\smb.sys
0x04409000 \SystemRoot\System32\DRIVERS\netbt.sys
0x0444D000 \SystemRoot\system32\drivers\afd.sys
0x044B8000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x044C3000 \SystemRoot\system32\DRIVERS\pacer.sys
0x044E1000 \SystemRoot\system32\DRIVERS\netbios.sys
0x044F0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0450B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04558000 \SystemRoot\system32\drivers\nsiproxy.sys
0x04564000 \SystemRoot\system32\drivers\mfehidk.sys
0x045AE000 \SystemRoot\System32\Drivers\dfsc.sys
0x045CB000 \SystemRoot\System32\Drivers\fastfat.SYS
0x037E3000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x01040000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x04603000 \SystemRoot\system32\DRIVERS\OA002Vid.sys
0x0464E000 \SystemRoot\system32\DRIVERS\OA002Ufd.sys
0x04678000 \SystemRoot\system32\drivers\usbaudio.sys
0x04691000 \??\C:\Windows\system32\Drivers\OA002Afx.sys
0x046C5000 \SystemRoot\System32\Drivers\crashdmp.sys
0x046D3000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x046DF000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x046E7000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x046F0000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x00040000 \SystemRoot\System32\win32k.sys
0x046FB000 \SystemRoot\System32\drivers\Dxapi.sys
0x04707000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00450000 \SystemRoot\System32\TSDDD.dll
0x00880000 \SystemRoot\System32\ATMFD.DLL
0x00690000 \SystemRoot\System32\cdd.dll
0x0471A000 \SystemRoot\system32\drivers\luafv.sys
0x0473C000 \SystemRoot\system32\drivers\spsys.sys
0x047D6000 \SystemRoot\system32\DRIVERS\packet.sys
0x047E3000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x08A03000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x08A1B000 \SystemRoot\system32\drivers\HTTP.sys
0x08ABE000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x08AE7000 \SystemRoot\system32\DRIVERS\bowser.sys
0x08B05000 \SystemRoot\system32\drivers\mrxdav.sys
0x08B2C000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x08B55000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x08B9E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x08BBD000 \SystemRoot\System32\DRIVERS\srv2.sys
0x09008000 \SystemRoot\System32\DRIVERS\srv.sys
0x0909B000 \SystemRoot\system32\drivers\peauth.sys
0x09151000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0915C000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0916C000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x0918C000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x091A2000 \??\C:\Program Files (x86)\Spyware Doctor\PCTSDInj64.sys
0x091AC000 \SystemRoot\system32\drivers\mfeavfk.sys
0x091C4000 \SystemRoot\system32\drivers\tdtcp.sys
0x091D1000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0x0AC0C000 \SystemRoot\System32\Drivers\RDPWD.SYS
0x0AC48000 \SystemRoot\system32\drivers\mfesmfk.sys
0x0AC53000 \??\C:\Users\CONNOR~1\AppData\Local\Temp\aswMBR.sys
0x771A0000 \Windows\System32\ntdll.dll

Processes (total 89):
0 System Idle Process
4 System
484 C:\Windows\System32\smss.exe
568 C:\Windows\System32\csrss.exe
636 C:\Windows\System32\wininit.exe
656 C:\Windows\System32\csrss.exe
692 C:\Windows\System32\services.exe
704 C:\Windows\System32\lsass.exe
712 C:\Windows\System32\lsm.exe
896 C:\Windows\System32\winlogon.exe
916 C:\Windows\System32\svchost.exe
964 C:\Windows\System32\nvvsvc.exe
992 C:\Windows\System32\svchost.exe
296 C:\Windows\System32\svchost.exe
400 C:\Windows\System32\svchost.exe
428 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\audiodg.exe
1064 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\SLsvc.exe
1148 C:\Windows\System32\svchost.exe
1216 C:\Windows\System32\nvvsvc.exe
1264 C:\Program Files\Dell\DellDock\DockLogin.exe
1340 C:\Program Files\Tablet\Pen\Pen_TouchService.exe
1348 C:\Windows\System32\wisptis.exe
1356 C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe
1436 C:\Windows\System32\svchost.exe
1784 C:\Windows\System32\spoolsv.exe
1808 C:\Windows\System32\svchost.exe
1276 C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
1864 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1856 C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
1964 C:\Program Files\Bonjour\mDNSResponder.exe
2080 C:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
2204 C:\PROGRA~2\COMMON~1\McAfee\McProxy\McProxy.exe
2284 C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
2336 C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe
2392 C:\Program Files (x86)\McAfee\MSK\msksrver.exe
2536 C:\Windows\System32\svchost.exe
2552 C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe
2588 C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
2736 C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
2764 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2864 C:\Windows\System32\svchost.exe
2904 C:\Program Files\Tablet\Pen\Pen_Tablet.exe
3028 C:\Windows\System32\svchost.exe
3068 C:\Windows\System32\SearchIndexer.exe
3016 C:\Windows\System32\WUDFHost.exe
3128 C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
3340 C:\Windows\System32\taskeng.exe
3908 C:\Windows\System32\wbem\WmiPrvSE.exe
3360 C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
4624 C:\PROGRA~2\McAfee.com\Agent\mcagent.exe
4636 C:\Windows\System32\taskeng.exe
4684 C:\Program Files (x86)\Spyware Doctor\pctsTray.exe
4700 C:\Windows\System32\wisptis.exe
4708 C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe
4716 C:\Windows\System32\dwm.exe
4848 C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
4896 C:\Windows\explorer.exe
4916 C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe
5032 C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
4744 C:\Program Files\Tablet\Pen\Pen_Tablet.exe
5196 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
5220 C:\Program Files\Windows Sidebar\sidebar.exe
5240 C:\Windows\ehome\ehtray.exe
5324 C:\Windows\ehome\ehmsas.exe
5460 C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe
5472 C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
5484 C:\Program Files (x86)\Java\jre6\bin\jusched.exe
5500 C:\Program Files\Dell\DellDock\DellDock.exe
5524 C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
5532 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
5560 C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
5632 C:\Program Files (x86)\iTunes\iTunesHelper.exe
5692 C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
5868 C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
5988 C:\Program Files\Windows Media Player\wmpnscfg.exe
976 C:\Program Files\Windows Media Player\wmpnetwk.exe
5380 C:\Program Files\iPod\bin\iPodService.exe
3148 C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
6536 C:\Windows\System32\svchost.exe
6576 C:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe
6756 C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
5300 C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
5436 C:\Windows\System32\wuauclt.exe
5924 C:\Windows\System32\wbem\WmiPrvSE.exe
832 C:\Program Files (x86)\Safari\Safari.exe
1176 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
5160 C:\Users\Connor Appleby\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`c3f00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`03f00000 (NTFS)

PhysicalDrive0 Model Number: ST3750528AS, Rev: CC44

Size Device Name MBR Status
--------------------------------------------
698 GB \\.\PhysicalDrive0 Windows Vista MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

**ken545** · 2012-01-07, 01:00

Wonderful, I was concerned that your Master Boot Record was infected but it looks fine.

How are the redirects ?

With this type of infection there may be more we cant see, so lets do this.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Thread: Help Needed - several problems

Thread Tools

Display

Help Needed - several problems

combo fix log

Posting Permissions