Google redirect.. security hacking?

laranal · Sep 28, 2008

At first I thought this started as a google redirect virus.
It also opens tabs in my firefox at random times and goes to random websites.
My windows explorer constantly shuts down and restarts, as does my firefox.
And today it told me that "Transitions Accessible technologies between desktops has stopped working"
Also a day or so ago when Vista would ask me for permission to run things it would freeze my computer
Then I see double information on websites, like the same page at the bottom. (but I heard this may just be a firefox problem)
Plus my computer has started running really slowly

HijackThis doesn't work sometimes, it tells me I have to run it as administrator which I try to do and it still doesn't (plus I am admin on my computer). I have to reinstall it every time I want to use it.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:48 PM, on 9/28/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\taskeng.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVW32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [12cedc90] rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\xipxjlbg.dll",b
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\hygbjijk.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: Contains -
O16 - DPF: DownloadInformation -
O16 - DPF: InstalledVersion -
O17 - HKLM\System\CCS\Services\Tcpip\..\{D056A29A-DF86-41F0-AF8F-63785D0C4538}: NameServer = 85.255.113.91,85.255.112.209
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdktk.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9793 bytes

Shaba · Sep 30, 2008

Hi laranal

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the "Perform Full Scan" option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Post:

- mbam log
- rsit logs (taken after mbam run)

laranal · Oct 1, 2008

Hey Shaba, thanks for helping me out
I also got these 2 prompts once I was logged onto my computer:

'Error loading C:\Users\Ariel\AppData\Local\Temp\nqswcdul.dll
The specified module could not be found.'

'Error loading C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll
The specified module could not be found.'

Here are the logs-

mbam log:

Malwarebytes' Anti-Malware 1.28
Database version: 1134
Windows 6.0.6001 Service Pack 1

9/30/2008 7:46:35 PM
mbam-log-2008-09-30 (19-46-35).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|)
Objects scanned: 186679
Time elapsed: 3 hour(s), 15 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm11fdef0c (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cedc90 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{d056a29a-df86-41f0-af8f-63785d0c4538}\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.91,85.255.112.209 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{d056a29a-df86-41f0-af8f-63785d0c4538}\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.91,85.255.112.209 -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{d056a29a-df86-41f0-af8f-63785d0c4538}\NameServer (Trojan.DNSChanger) -> Data: 85.255.113.91,85.255.112.209 -> Quarantined and deleted successfully.

Folders Infected:
C:\Users\Les\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WatchPorn (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\Users\Ariel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YH7LLNBV\leoob[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Windows\System32\adssite-remove.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\Ariel\AppData\Local\Temp\nqswcdul.dll (Trojan.Agent) -> Delete on reboot.
C:\Users\Ariel\AppData\Local\Temp\ywdsmrfr.dll (Trojan.Vundo) -> Delete on reboot.
C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll (Malware.Trace) -> Delete on reboot.

rsit logs:
Logfile of random's system information tool 1.04 (written by random/random)
Run by Ariel at 2008-09-30 19:54:05
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 248 GB (53%) free of 468 GB
Total RAM: 2942 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:54:48 PM, on 9/30/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\mspaint.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Ariel\Desktop\RSIT.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\Ariel.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Windows\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\nqswcdul.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: Contains -
O16 - DPF: DownloadInformation -
O16 - DPF: InstalledVersion -
O17 - HKLM\System\CCS\Services\Tcpip\..\{D056A29A-DF86-41F0-AF8F-63785D0C4538}: NameServer = 85.255.113.91,85.255.112.209
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdktk.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10276 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Norton Internet Security - Run Full System Scan - Les.job
C:\Windows\tasks\Norton SystemWorks One Button Checkup.job
C:\Windows\tasks\User_Feed_Synchronization-{3852C311-918F-48D7-BD17-B288FD318A20}.job
C:\Windows\tasks\User_Feed_Synchronization-{DA8460CA-F00B-478C-A87E-305F4C018B9D}.job
C:\Windows\tasks\WEEKLY CLEANUP SCAN.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll [2007-01-11 96936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]
Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2008-08-04 1947080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll [2007-01-11 607888]
{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2008-08-04 1947080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-01-15 4874240]
"KBD"=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-05-22 13539872]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-05-22 92704]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-08 289576]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-09-10 1253040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Aim6"=C:\Program Files\AIM6\aim6.exe [2008-08-06 50472]
"cmds"=C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll []
"BM11fdef0c"=C:\Users\Ariel\AppData\Local\Temp\nqswcdul.dll []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe [2008-08-06 50472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-09 115816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
c:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-02-17 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
c:\hp\support\hpsysdrv.exe [2006-09-28 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-09-08 289576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2008-05-22 13539872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\Windows\system32\NvMcTray.dll [2008-05-22 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
C:\Windows\system32\nvsvc.dll [2008-05-22 526880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2007-02-15 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2008-01-15 4874240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SnapfishMediaDetector]
C:\Program Files\Snapfish Media Detector\SnapfishMediaDetector.exe [2007-03-02 1441792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~3\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
C:\PROGRA~1\SNAPFI~1\SNAPFI~1.EXE [2007-03-02 1441792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Ariel^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
C:\PROGRA~1\MICROS~3\Office12\ONENOTEM.EXE [2007-12-07 101440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A982037A-5FA0-44BD-8BB8-BCE93EBBDFE8}"=C:\Users\Ariel\AppData\Local\Temp\fccDsroM.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{624b6434-dcab-11dc-8948-001bb980160c}]
shell\AutoRun\command - M:\LaunchU3.exe -a

======List of files/folders created in the last 1 months======

2008-09-30 19:54:05 ----D---- C:\rsit
2008-09-30 19:48:20 ----D---- C:\Avenger
2008-09-30 19:48:20 ----A---- C:\avenger.txt
2008-09-30 16:57:57 ----A---- C:\Windows\MegaManager.INI
2008-09-30 16:36:22 ----D---- C:\Users\Ariel\AppData\Roaming\Megaupload
2008-09-30 16:35:43 ----D---- C:\Users\Ariel\AppData\Roaming\MegauploadToolbar
2008-09-30 16:27:51 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-28 12:50:13 ----D---- C:\Users\Ariel\AppData\Roaming\Apple Computer
2008-09-27 23:49:26 ----D---- C:\Program Files\Enigma Software Group
2008-09-27 18:58:20 ----D---- C:\Program Files\Panda Security
2008-09-26 21:43:33 ----D---- C:\Users\Ariel\AppData\Roaming\acccore
2008-09-26 21:22:53 ----D---- C:\Users\Ariel\AppData\Roaming\WinRAR
2008-09-26 20:42:07 ----D---- C:\Users\Ariel\AppData\Roaming\Macromedia
2008-09-26 20:42:07 ----D---- C:\Users\Ariel\AppData\Roaming\Adobe
2008-09-26 20:36:03 ----D---- C:\Users\Ariel\AppData\Roaming\Malwarebytes
2008-09-26 20:35:44 ----D---- C:\ProgramData\Malwarebytes
2008-09-26 20:18:46 ----D---- C:\Program Files\Trend Micro
2008-09-26 17:52:50 ----A---- C:\ProgramData\pskt.ini
2008-09-26 17:52:50 ----A---- C:\ProgramData\BM11fdef0c.txt
2008-09-26 15:13:49 ----D---- C:\Program Files\MilkShape 3D 1.8.4
2008-09-26 14:49:48 ----RSHD---- C:\resycled
2008-09-26 14:43:54 ----D---- C:\Users\Ariel\AppData\Roaming\MilkShape 3D 1.x.x
2008-09-18 19:02:29 ----D---- C:\Program Files\MegauploadToolbar
2008-09-09 22:33:30 ----A---- C:\Windows\system32\GEARAspi.dll
2008-09-09 22:33:29 ----DC---- C:\Windows\system32\DRVSTORE
2008-09-09 22:33:11 ----D---- C:\Program Files\iPod
2008-09-09 22:33:10 ----D---- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-09 22:33:10 ----D---- C:\Program Files\iTunes
2008-09-09 22:31:25 ----D---- C:\Program Files\Bonjour
2008-09-09 19:30:45 ----A---- C:\Windows\system32\Apphlpdm.dll
2008-09-09 19:30:44 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2008-09-09 19:30:40 ----A---- C:\Windows\system32\wmpeffects.dll
2008-09-09 19:29:17 ----A---- C:\Windows\system32\emdmgmt.dll
2008-09-09 19:29:17 ----A---- C:\Windows\system32\dataclen.dll
2008-09-09 19:29:17 ----A---- C:\Windows\system32\cdd.dll
2008-09-05 22:16:46 ----A---- C:\Windows\system32\usbaaplrc.dll
2008-09-01 20:19:11 ----D---- C:\ProgramData\WindowsSearch

======List of files/folders modified in the last 1 months======

2008-09-30 19:54:39 ----D---- C:\Windows\Temp
2008-09-30 19:54:29 ----D---- C:\Windows\System32
2008-09-30 19:54:29 ----D---- C:\Windows\inf
2008-09-30 19:54:29 ----A---- C:\Windows\system32\PerfStringBackup.INI
2008-09-30 19:48:28 ----D---- C:\Program Files
2008-09-30 19:48:20 ----D---- C:\Windows\system32\drivers
2008-09-30 19:48:20 ----D---- C:\Windows
2008-09-30 18:08:16 ----SHD---- C:\System Volume Information
2008-09-30 16:58:42 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-30 16:58:41 ----SHD---- C:\Windows\Installer
2008-09-30 16:35:21 ----D---- C:\Program Files\Mozilla Firefox
2008-09-30 16:27:29 ----D---- C:\Windows\Prefetch
2008-09-27 23:49:37 ----D---- C:\ProgramData\Symantec
2008-09-27 23:49:32 ----D---- C:\Windows\system32\Tasks
2008-09-27 02:26:51 ----D---- C:\Windows\system32\catroot2
2008-09-26 20:35:44 ----HD---- C:\ProgramData
2008-09-26 19:58:37 ----D---- C:\Program Files\Norton Security Scan
2008-09-26 18:57:38 ----D---- C:\ProgramData\Symantec Temporary Files
2008-09-21 18:13:08 ----D---- C:\Program Files\EA GAMES
2008-09-20 13:38:36 ----D---- C:\Windows\system32\Macromed
2008-09-19 21:14:26 ----SD---- C:\Windows\Downloaded Program Files
2008-09-12 17:33:26 ----D---- C:\Program Files\Norton SystemWorks Basic Edition
2008-09-10 15:14:34 ----D---- C:\Windows\winsxs
2008-09-10 14:54:45 ----D---- C:\Windows\AppPatch
2008-09-10 14:46:55 ----D---- C:\ProgramData\Microsoft Help
2008-09-10 14:42:40 ----D---- C:\Windows\system32\catroot
2008-09-10 14:39:08 ----D---- C:\Program Files\Microsoft Works
2008-09-09 22:30:25 ----D---- C:\Program Files\QuickTime
2008-09-09 22:29:39 ----D---- C:\Program Files\Common Files\Apple
2008-09-08 16:57:22 ----D---- C:\ProgramData\NVIDIA

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2008-09-02 371248]
R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080926.002\IDSvix86.sys [2008-09-12 270384]
R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2007-11-30 43696]
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2007-01-09 191544]
R2 MCSTRM;MCSTRM; C:\Windows\system32\drivers\MCSTRM.sys [2007-10-04 8413]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-18 8704]
R3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
R3 Dot4Scan;Scan Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Scan.sys [2008-01-19 10752]
R3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-02 99376]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hcw18bda;Hauppauge WinTV 418 Driver; C:\Windows\system32\drivers\hcw18bda.sys [2007-01-15 354432]
R3 HSF_DP;HSF_DP; C:\Windows\system32\DRIVERS\HSX_DP.sys [2008-05-08 980992]
R3 HSXHWBS2;HSXHWBS2; C:\Windows\system32\DRIVERS\HSXHWBS2.sys [2008-05-08 266752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-01-15 2047576]
R3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080930.003\NAVENG.SYS [2008-08-25 89104]
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080930.003\NAVEX15.SYS [2008-08-25 873552]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-05-04 1065384]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-05-22 7465312]
R3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072]
R3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2007-11-30 279088]
R3 StillCam;Still Serial Digital Camera Driver; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-19 9216]
R3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2007-01-09 12984]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2008-05-04 123952]
R3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2007-01-09 145976]
R3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2007-01-09 40120]
R3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2007-01-09 38200]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2007-01-09 27576]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-05-08 661504]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S2 npkcrypt;npkcrypt; \??\C:\Nexon\MapleStory\npkcrypt.sys []
S3 arwky3b9;arwky3b9; C:\Windows\system32\drivers\arwky3b9.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2007-04-14 418104]
S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2007-11-30 317616]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-09-05 36864]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-05 116040]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 ccEvtMgr;Symantec Event Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
R2 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
R2 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-01-09 108648]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-05-22 118784]
R2 SymAppCore;Symantec AppCore Service; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2007-01-04 47712]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-18 386560]
R3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
S2 Windows Tribute Service;Windows Tribute Service; C:\Windows\system32\kdktk.exe -srv []
S3 comHost;COM Host; c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-01-12 49248]
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-08 536872]
S3 ISPwdSvc;Symantec IS Password Validation; c:\Program Files\Norton Internet Security\isPwdSvc.exe [2007-01-13 80504]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-03-26 887544]
S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-03-08 74656]
S3 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-05-04 1251720]
S3 usprserv;User Privilege Service; C:\Windows\System32\svchost.exe [2008-01-19 21504]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.04 2008-09-30 19:54:50

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 8.1.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AIM 6-->C:\Program Files\AIM6\uninst.exe
AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Apple Mobile Device Support-->MsiExec.exe /I{C7C895CA-331B-4D7D-A0FB-D3BC637949F9}
Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
ATI RADEON 9700 Pipe Dream Demo v1.1-->MsiExec.exe /X{F8B6FBC3-C28F-49D9-A00A-16283E9A1180}
AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Azureus Vuze-->C:\Program Files\Azureus\uninstall.exe
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CEP - Color Enable Package-->"C:\PROGRA~1\EAGAME~1\zCEP_Uninstaller\unins001.exe"
CheckIt Diagnostics-->MsiExec.exe /X{4B9B1B84-FEC0-46D5-BDB9-832565779422}
Component Framework-->MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Drug Identifier-->MsiExec.exe /I{7911AA1E-9F4F-4399-8456-8A4EDF7730DD}
Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
exPressit S.E. 2.1-->"C:\Program Files\exPressit S.E. 2.1\UninstallerData\Uninstall exPressit S.E. 2.1.exe"
EZface ActiveX 209-->MsiExec.exe /X{087004CC-46B3-4016-96DF-73595706776C}
ffdshow [rev 1443] [2007-08-29]-->"C:\Program Files\ffdshow\unins000.exe"
Free Video Converter V 1.0-->"C:\Program Files\Free Video Converter\unins000.exe"
GTK+ 2.10.13 runtime environment-->"C:\Program Files\Common Files\GTK\2.0\setup\unins000.exe"
Hardware Diagnostic Tools-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9 -removeonly
HP Customer Feedback-->MsiExec.exe /I{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9 -removeonly
HP On-Screen Cap/Num/Scroll Lock Indicator-->C:\Windows\system32\OsdRemove.exe
HP Photosmart Essential 2.0-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Picasso Media Center Add-In-->MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
HP Total Care Advisor-->MsiExec.exe /X{2990BC81-3B19-4E53-A53E-30DE3F1BFFA8}
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{EA418519-2160-43A0-AABD-6608DDD8D87F}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Megaupload Toolbar-->C:\Program Files\MegauploadToolbar\uninstall.exe
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Office XP Professional with FrontPage-->MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
MilkShape 3D 1.8.4-->"C:\Program Files\MilkShape 3D 1.8.4\uninstall.exe"
MobileMe Control Panel-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSRedist-->MsiExec.exe /I{D1725BDB-BA2B-4503-A8CB-F5C835D743FA}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
muvee autoProducer 6.0-->C:\Program Files\InstallShield Installation Information\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}\setup.exe -runfromtemp -l0x0009 -removeonly
Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
Norton Cleanup-->MsiExec.exe /I{CA31120D-2101-484D-9FF1-195DE96FE346}
Norton Confidential Browser Component-->MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component-->MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_2_0_30\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}
Norton Internet Security-->MsiExec.exe /I{48185814-A224-447A-81DA-71BD20580E1B}
Norton Internet Security-->MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
Norton Security Scan-->MsiExec.exe /I{48B82226-75E3-4E90-92CC-D30F79EA6380}
Norton SystemWorks (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{707D28BF-E145-4a9b-B97E-94FA586D05F3}\{707D28BF-E145-4a9b-B97E-94FA586D05F3}.exe" /X
Norton SystemWorks 2007-->MsiExec.exe /I{FB55BB78-2BC2-43E9-80FF-517A8D1AE3AD}
Norton SystemWorks Basic Edition-->MsiExec.exe /I{707D28BF-E145-4a9b-B97E-94FA586D05F3}
Norton SystemWorks-->MsiExec.exe /I{9E23C48E-5483-4971-BA50-089F2FABCD66}
Norton Utilities-->MsiExec.exe /I{6A7867BA-B7CA-4CC9-ACAB-85BA46865EE5}
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
Python 2.4.3-->MsiExec.exe /I{75E71ADD-042C-4F30-BFAC-A9EC42351313}
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Rhapsody Player Engine-->MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
Rhapsody-->C:\PROGRA~1\Rhapsody\Unwise32.exe /A C:\PROGRA~1\Rhapsody\INSTALL.LOG
Roxio Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Roxio Creator Audio-->MsiExec.exe /X{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /X{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /X{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /X{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /X{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /X{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /X{938B1CD7-7C60-491E-AA90-1F1888168240}
Security Update for 2007 Microsoft Office System (KB951596)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {1AFF2298-CC00-4A3B-866A-C62B8373794E}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB951546)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7399DD71-8E24-4E60-B6A8-6CED89C0AC26}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
SimPE 0.68 (alpha)-->"C:\Program Files\EA GAMES\SimPE\unins000.exe"
Snapfish Media Detector-->MsiExec.exe /X{4EF6FDB0-3B11-4820-9860-8E08E9965195}
Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\UIU32m.exe -U -ITrx200Cz.INF
SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
The Sims 2 Nightlife-->C:\Program Files\EA GAMES\The Sims 2 Nightlife\EAUninstall.exe
The Sims 2 Open For Business-->C:\Program Files\EA GAMES\The Sims 2 Open For Business\EAUninstall.exe
The Sims 2 Pets-->C:\Program Files\EA GAMES\The Sims 2 Pets\EAUninstall.exe
The Sims 2 University-->C:\Program Files\EA GAMES\The Sims 2 University\EAUninstall.exe
The Sims 2-->C:\Program Files\EA GAMES\The Sims 2\EAUninstall.exe
The Sims™ 2 Bon Voyage-->C:\Program Files\EA GAMES\The Sims 2 Bon Voyage\EAUninstall.exe
The Sims™ 2 FreeTime-->C:\Program Files\EA GAMES\The Sims 2 FreeTime\EAUninstall.exe
The Sims™ 2 IKEA® Home Stuff-->C:\Program Files\EA GAMES\The Sims 2 IKEA® Home Stuff\EAUninstall.exe
The Sims™ 2 Seasons-->C:\Program Files\EA GAMES\The Sims 2 Seasons\EAUninstall.exe
The Sims™ 2 Teen Style Stuff-->C:\Program Files\EA GAMES\The Sims 2 Teen Style Stuff\EAUninstall.exe
Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

=====HijackThis Backups=====

O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\ajgcvyxi.dll",s
O4 - HKLM\..\Run: [619.tmp] C:\Windows\temp\619.tmp
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljJyvSMc.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\fccDsroM.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\fccDsroM.dll,#1
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\ajgcvyxi.dll",s
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\fccDsroM.dll,#1
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\ajgcvyxi.dll",s
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\gygseoop.dll",s
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\gygseoop.dll",s
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\gygseoop.dll",s
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c

======Security center information======

AV: Norton Internet Security
FW: Norton Internet Security
AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender
AS: Norton Internet Security

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\hp\bin\Python;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\Common Files\GTK\2.0\bin;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=4303
"NUMBER_OF_PROCESSORS"=2
"RoxioCentral"=c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"PLATFORM"=HPD
"PCBRAND"=Pavilion
"OnlineServices"=Online Services
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

-----------------EOF-----------------

Shaba · Oct 1, 2008

Did you let MBAM reboot computer and is RSIT log taken after reboot?

laranal · Oct 1, 2008

yes i did

Shaba · Oct 1, 2008

Thanks for information.

Open HijackThis, click do a system scan only and checkmark these:

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Ariel\AppData\Local\Temp\efcCtrqP.dll,c
O4 - HKCU\..\Run: [BM11fdef0c] Rundll32.exe "C:\Users\Ariel\AppData\Local\Temp\nqswcdul.dll",s
O16 - DPF: Contains -
O16 - DPF: DownloadInformation -
O16 - DPF: InstalledVersion -
O17 - HKLM\System\CCS\Services\Tcpip\..\{D056A29A-DF86-41F0-AF8F-63785D0C4538}: NameServer = 85.255.113.91,85.255.112.209
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdktk.exe

Close all windows including browser and press fix checked.

Reboot.

Post back a fresh HijackThis log.

NOTE: If you loose internet connection, restore 017 entry from HijackThis backups.

laranal · Oct 1, 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:18:22 PM, on 10/1/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Windows\RtHDVCpl.exe
C:\hp\KBD\KbdStub.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{D056A29A-DF86-41F0-AF8F-63785D0C4538}: NameServer = 85.255.113.91,85.255.112.209
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdktk.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9150 bytes

Shaba · Oct 2, 2008

* Download GMER from
here:
Unzip it and start GMER.exe
Click the rootkit-tab and click scan.

Once done, click the Copy button.
This will copy the results to clipboard.
Paste the results in your next reply.

laranal · Oct 3, 2008

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-10-02 21:56:41
Windows 6.0.6001 Service Pack 1

---- System - GMER 1.0.14 ----

SSDT 87C8CEE8 ZwConnectPort

Code 06100D5F IoReportHalResourceUsage

---- Kernel code sections - GMER 1.0.14 ----

? C:\Windows\System32\Drivers\sptd.sys The process cannot access the file because it is being used by another process.
.text USBPORT.SYS!DllUnload 89F7C46F 5 Bytes JMP 86DA11C8
.text al6wrx0v.SYS 8E521000 22 Bytes [ 26, B2, E0, 81, 10, B1, E0, ... ]
.text al6wrx0v.SYS 8E521017 181 Bytes [ 00, 32, 47, 70, 80, 3D, 45, ... ]
.text al6wrx0v.SYS 8E5210CE 73 Bytes [ 00, 00, 00, 00, 01, C2, 03, ... ]
.text al6wrx0v.SYS 8E521118 185 Bytes [ 3F, 48, 3E, 8A, 3C, CC, 3D, ... ]
.text al6wrx0v.SYS 8E5211D2 22 Bytes [ E0, C2, E2, 84, E3, 46, E6, ... ]
.text ...

---- User code sections - GMER 1.0.14 ----

.text C:\Program Files\iPod\bin\iPodService.exe[264] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Program Files\iPod\bin\iPodService.exe[264] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Program Files\iPod\bin\iPodService.exe[264] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Program Files\iPod\bin\iPodService.exe[264] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Windows\system32\wininit.exe[676] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00306992
.text C:\Windows\system32\wininit.exe[676] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00306AAF
.text C:\Windows\system32\wininit.exe[676] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00306751
.text C:\Windows\system32\wininit.exe[676] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00306894
.text C:\Windows\system32\services.exe[720] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00936992
.text C:\Windows\system32\services.exe[720] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00936AAF
.text C:\Windows\system32\services.exe[720] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00936751
.text C:\Windows\system32\services.exe[720] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00936894
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00246992
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00246AAF
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00246751
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00246894
.text C:\Windows\system32\lsm.exe[748] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 000D6992
.text C:\Windows\system32\lsm.exe[748] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 000D6AAF
.text C:\Windows\system32\lsm.exe[748] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 000D6751
.text C:\Windows\system32\lsm.exe[748] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 000D6894
.text c:\Program Files\Common Files\LightScribe\LSSrvc.exe[820] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 001C6992
.text c:\Program Files\Common Files\LightScribe\LSSrvc.exe[820] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 001C6AAF
.text c:\Program Files\Common Files\LightScribe\LSSrvc.exe[820] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 001C6751
.text c:\Program Files\Common Files\LightScribe\LSSrvc.exe[820] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 001C6894
.text C:\Windows\system32\winlogon.exe[844] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00206992
.text C:\Windows\system32\winlogon.exe[844] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00206AAF
.text C:\Windows\system32\winlogon.exe[844] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00206751
.text C:\Windows\system32\winlogon.exe[844] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00206894
.text C:\Windows\system32\svchost.exe[928] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00866992
.text C:\Windows\system32\svchost.exe[928] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00866AAF
.text C:\Windows\system32\svchost.exe[928] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00866751
.text C:\Windows\system32\svchost.exe[928] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00866894
.text C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE[960] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE[960] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE[960] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE[960] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Windows\system32\nvvsvc.exe[972] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 003D6992
.text C:\Windows\system32\nvvsvc.exe[972] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 003D6AAF
.text C:\Windows\system32\nvvsvc.exe[972] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 003D6751
.text C:\Windows\system32\nvvsvc.exe[972] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 003D6894
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 006B6992
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 006B6AAF
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 006B6751
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 006B6894
.text C:\Windows\System32\svchost.exe[1036] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 010E6992
.text C:\Windows\System32\svchost.exe[1036] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 010E6AAF
.text C:\Windows\System32\svchost.exe[1036] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 010E6751
.text C:\Windows\System32\svchost.exe[1036] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 010E6894
.text C:\Windows\System32\svchost.exe[1136] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00206992
.text C:\Windows\System32\svchost.exe[1136] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00206AAF
.text C:\Windows\System32\svchost.exe[1136] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00206751
.text C:\Windows\System32\svchost.exe[1136] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00206894
.text C:\Windows\System32\svchost.exe[1164] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00866992
.text C:\Windows\System32\svchost.exe[1164] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00866AAF
.text C:\Windows\System32\svchost.exe[1164] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00866751
.text C:\Windows\System32\svchost.exe[1164] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00866894
.text C:\Windows\system32\svchost.exe[1184] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00D46992
.text C:\Windows\system32\svchost.exe[1184] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00D46AAF
.text C:\Windows\system32\svchost.exe[1184] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00D46751
.text C:\Windows\system32\svchost.exe[1184] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00D46894
.text C:\Windows\system32\SLsvc.exe[1308] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 000A6992
.text C:\Windows\system32\SLsvc.exe[1308] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 000A6AAF
.text C:\Windows\system32\SLsvc.exe[1308] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 000A6751
.text C:\Windows\system32\SLsvc.exe[1308] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 000A6894
.text C:\Windows\system32\svchost.exe[1344] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00A66992
.text C:\Windows\system32\svchost.exe[1344] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00A66AAF
.text C:\Windows\system32\svchost.exe[1344] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00A66751
.text C:\Windows\system32\svchost.exe[1344] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00A66894
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1456] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00196992
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1456] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00196AAF
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1456] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00196751
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1456] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00196894
.text C:\Windows\system32\rundll32.exe[1464] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00306992
.text C:\Windows\system32\rundll32.exe[1464] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00306AAF
.text C:\Windows\system32\rundll32.exe[1464] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00306751
.text C:\Windows\system32\rundll32.exe[1464] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00306894
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 008D6992
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 008D6AAF
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 008D6751
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 008D6894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[1544] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[1544] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[1544] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[1544] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1584] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 002E6992
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1584] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 002E6AAF
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1584] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 002E6751
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1584] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 002E6894
.text C:\Windows\system32\taskeng.exe[1596] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Windows\system32\taskeng.exe[1596] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Windows\system32\taskeng.exe[1596] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Windows\system32\taskeng.exe[1596] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1644] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 013D6992
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1644] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 013D6AAF
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1644] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 013D6751
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1644] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 013D6894
.text C:\Program Files\Bonjour\mDNSResponder.exe[1676] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 003E6992
.text C:\Program Files\Bonjour\mDNSResponder.exe[1676] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 003E6AAF
.text C:\Program Files\Bonjour\mDNSResponder.exe[1676] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 003E6751
.text C:\Program Files\Bonjour\mDNSResponder.exe[1676] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 003E6894
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1724] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00B26992
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1724] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00B26AAF
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1724] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00B26751
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1724] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00B26894
.text C:\Windows\System32\spoolsv.exe[1860] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 000B6992
.text C:\Windows\System32\spoolsv.exe[1860] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 000B6AAF
.text C:\Windows\System32\spoolsv.exe[1860] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 000B6751
.text C:\Windows\System32\spoolsv.exe[1860] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 000B6894
.text C:\Windows\system32\svchost.exe[1884] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 007E6992
.text C:\Windows\system32\svchost.exe[1884] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 007E6AAF
.text C:\Windows\system32\svchost.exe[1884] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 007E6751
.text C:\Windows\system32\svchost.exe[1884] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 007E6894
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00BF6992
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00BF6AAF
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00BF6751
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00BF6894
.text C:\Windows\system32\svchost.exe[2220] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 009D6992
.text C:\Windows\system32\svchost.exe[2220] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 009D6AAF
.text C:\Windows\system32\svchost.exe[2220] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 009D6751
.text C:\Windows\system32\svchost.exe[2220] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 009D6894
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[2256] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00196992
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[2256] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00196AAF
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[2256] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00196751
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[2256] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00196894
.text C:\Windows\System32\svchost.exe[2296] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Windows\System32\svchost.exe[2296] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Windows\System32\svchost.exe[2296] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Windows\System32\svchost.exe[2296] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Windows\system32\SearchIndexer.exe[2352] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 05BA6992
.text C:\Windows\system32\SearchIndexer.exe[2352] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 05BA6AAF
.text C:\Windows\system32\SearchIndexer.exe[2352] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 05BA6751
.text C:\Windows\system32\SearchIndexer.exe[2352] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 05BA6894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2524] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2524] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2524] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2524] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\hp\kbd\kbd.exe[2568] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00146992
.text C:\hp\kbd\kbd.exe[2568] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00146AAF
.text C:\hp\kbd\kbd.exe[2568] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00146751
.text C:\hp\kbd\kbd.exe[2568] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00146894
.text C:\Program Files\AIM6\aolsoftware.exe[2604] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00156992
.text C:\Program Files\AIM6\aolsoftware.exe[2604] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00156AAF
.text C:\Program Files\AIM6\aolsoftware.exe[2604] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00156751
.text C:\Program Files\AIM6\aolsoftware.exe[2604] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00156894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2768] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2768] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2768] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[2768] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] WS2_32.dll!connect 76B040D9 5 Bytes JMP 0005D25F
.text C:\Program Files\Mozilla Firefox\firefox.exe[2984] WS2_32.dll!send 76B0659B 5 Bytes JMP 0005D364
.text C:\Windows\system32\taskeng.exe[3340] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Windows\system32\taskeng.exe[3340] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Windows\system32\taskeng.exe[3340] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Windows\system32\taskeng.exe[3340] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3388] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3388] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3388] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3388] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Windows\system32\Dwm.exe[3404] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Windows\system32\Dwm.exe[3404] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Windows\system32\Dwm.exe[3404] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Windows\system32\Dwm.exe[3404] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Windows\Explorer.EXE[3508] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00056992
.text C:\Windows\Explorer.EXE[3508] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00056AAF
.text C:\Windows\Explorer.EXE[3508] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00056751
.text C:\Windows\Explorer.EXE[3508] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00056894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3600] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3600] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3600] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[3600] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Windows\RtHDVCpl.exe[3900] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00156992
.text C:\Windows\RtHDVCpl.exe[3900] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00156AAF
.text C:\Windows\RtHDVCpl.exe[3900] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00156751
.text C:\Windows\RtHDVCpl.exe[3900] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00156894
.text C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE[3932] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE[3932] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE[3932] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE[3932] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894
.text C:\Windows\System32\rundll32.exe[3948] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00066992
.text C:\Windows\System32\rundll32.exe[3948] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00066AAF
.text C:\Windows\System32\rundll32.exe[3948] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00066751
.text C:\Windows\System32\rundll32.exe[3948] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00066894
.text C:\Program Files\iTunes\iTunesHelper.exe[3972] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00156992
.text C:\Program Files\iTunes\iTunesHelper.exe[3972] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00156AAF
.text C:\Program Files\iTunes\iTunesHelper.exe[3972] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00156751
.text C:\Program Files\iTunes\iTunesHelper.exe[3972] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00156894
.text C:\Program Files\AIM6\aim6.exe[3984] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00146992
.text C:\Program Files\AIM6\aim6.exe[3984] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00146AAF
.text C:\Program Files\AIM6\aim6.exe[3984] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00146751
.text C:\Program Files\AIM6\aim6.exe[3984] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00146894
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[4044] ntdll.dll!NtDeleteValueKey 76EB8428 5 Bytes JMP 00166992
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[4044] ntdll.dll!NtQueryDirectoryFile 76EB89E8 5 Bytes JMP 00166AAF
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[4044] ntdll.dll!NtResumeThread 76EB8DE8 5 Bytes JMP 00166751
.text C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe[4044] ntdll.dll!NtSetValueKey 76EB9088 5 Bytes JMP 00166894

laranal · Oct 3, 2008

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8061161E] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80610AD4] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [80611748] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [80610B9C] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [80610C1A] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8062629A] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortNotification] 000000DC
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortWritePortUchar] 000000A2
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortWritePortUlong] 00000333
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 000003D8
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 0000024D
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortGetScatterGatherList] 00000201
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortReadPortUchar] 000001EF
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortStallExecution] 0000031F
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortGetParentBusType] 000000A1
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortRequestCallback] 0000025C
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 000003BE
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 00000215
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortCompleteRequest] 000000DD
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortMoveMemory] 00000190
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 00000182
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 00000363
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 00000258
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortReadPortUshort] 0000030E
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 0000017E
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortInitialize] 00000254
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortGetDeviceBase] 0000019E
IAT \SystemRoot\System32\Drivers\al6wrx0v.SYS[ataport.SYS!AtaPortDeviceStateChange] 000000AB

---- User IAT/EAT - GMER 1.0.14 ----

IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aolsoftware.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74077BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [740B98C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7407D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7406F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74077599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7406E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [740AB33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7407D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7407012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74070095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [740671F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

laranal · Oct 3, 2008

IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [740FD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [740975E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7406DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7406668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [740666BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3508] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74071E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WININET.dll [ADVAPI32.dll!RegQueryValueExA] [028CE03A] c:\program files\aim6\services\imApp\ver6_8_12_4\imAppService.dll (imAppService EE Application Service/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\AIM6\aim6.exe[3984] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 842781E8

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0
1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDB 0xDA 0xEB 0x92 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x50 0x7A 0xAA 0x8A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x02 0x00 0x12 0x68 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xEB 0xB6 0x59 0x5D ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xDB 0xDA 0xEB 0x92 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x50 0x7A 0xAA 0x8A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x02 0x00 0x12 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xEB 0xB6 0x59 0x5D ...
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Program Files\EA GAMES\The Sims 2 IKEA\xae Home Stuff\eauninstall.exe 1

---- Disk sectors - GMER 1.0.14 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

---- Files - GMER 1.0.14 ----

File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A4D2448Cd01 19874 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A6DD2004d01 22212 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\5B9C0336d01 38465 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\5E1846DDd01 38141 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\5EE52026d01 46604 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\65201775d01 703777 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\6AB2D6DAd01 17474 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\E371A469d01 27765 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\E45CBD38d01 29008 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\E47A77BFd01 1939488 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\954D742Ed01 27844 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\333BB91Ad01 37244 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C9FA09EAd01 46938 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\CDF33D8Ad01 17750 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B9BAA145d01 20804 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BA312B22d01 18225 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BA6C41A0d01 22479 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BA911229d01 25233 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\490D46DDd01 146030 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\49800C46d01 28660 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\49A5E716d01 29045 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\1B58F6F2d01 30426 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\208BF56Bd01 23042 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\20C3A6FEd01 18952 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\7E8144E5d01 19233 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\84759315d01 21633 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\8755732Dd01 18183 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\389E213Cd01 38965 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\39263132d01 16431 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B58859B2d01 21474 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\24B2AB61d01 30225 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\25B27360d01 30225 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BF53FC54d01 26052 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C02A40FAd01 34365 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C1169916d01 225128 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C275341Cd01 22802 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\9C488034d01 18983 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\F650537Ed01 19953 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\F90B0C18d01 61300 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\F9AF21FBd01 20162 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\D34B747Bd01 27236 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B406A27Bd01 18100 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B4127027d01 23379 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B4170470d01 28189 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B42C7366d01 23517 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B7FE00FEd01 18734 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BBD742A3d01 26445 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BBF3E602d01 39692 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BBF3E666d01 39814 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\8BB5C899d01 91270 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\8D754672d01 16973 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3C51671Cd01 21208 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3D214613d01 18864 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3D43232Ed01 23991 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3D5B01EBd01 17509 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3573143Ad01 18900 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\362050AAd01 17332 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\4FB414C3d01 315459 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\507909D4d01 81489 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\54B24A6Bd01 30225 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\EE570E82d01 23703 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\F14312C3d01 25406 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A1C86254d01 40678 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A3B29320d01 19176 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\6BBC1146d01 19550 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\6BCD2076d01 174642 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\DA18393Ad01 33818 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\DC0F973Fd01 18769 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\DC55607Ad01 22893 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\09DB0993d01 28763 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\0A45F377d01 38927 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\0AAE7243d01 22103 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\0EF483A5d01 16477 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A7A52343d01 26360 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\232F3E7Ed01 21474 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\235817EFd01 28863 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\243D770Bd01 23750 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\28EC2509d01 48773 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C50EC50Ad01 37015 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\C707A242d01 40543 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\72682057d01 52771 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\BEC12572d01 29936 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B31E85FFd01 38071 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B36238E8d01 21923 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3EDA2137d01 145900 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3FCE740Cd01 24176 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\42111B07d01 17892 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\8E4B6916d01 34484 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\8EAE0827d01 300942 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\90722F05d01 22820 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\914FF6A8d01 24988 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\918B3774d01 18144 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\337CD11Ad01 39312 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A007B976d01 17977 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\A01241B3d01 31198 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\976B6E7Fd01 23849 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\9817C170d01 36351 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\FB360239d01 23326 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\FD663592d01 36617 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\CF6E191Bd01 26501 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\30DA2004d01 51544 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B5E5463Fd01 31977 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\36B43A3Ad01 36721 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\36BB174Fd01 24917 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\4D090D3Cd01 134736 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B87110E8d01 24859 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\D89878F2d01 41443 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B4777343d01 20111 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\E67E0232d01 25430 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\E90C3E48d01 18980 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\2747BDC8d01 28911 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3B7FD9C1d01 17346 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\3BB80817d01 38797 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\77AA0899d01 43403 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\78EC0D44d01 56151 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B1EA9F66d01 26069 bytes
File C:\Users\Ariel\AppData\Local\Mozilla\Firefox\Profiles\8u3pdeqq.default\Cache\B246A323d01 27784 bytes

---- EOF - GMER 1.0.14 ----

Shaba · Oct 3, 2008

Download mbr.exe to your Desktop.
Double-click mbr.exe and follow prompts.
When scan is ready, it will create a logfile. Please post contents of that file in your next reply.

laranal · Oct 4, 2008

no prompts or anything show up
a black box comes up for a second and then disappears

Shaba · Oct 4, 2008

Go to start - run

Type this and click ok

%userprofile%/Desktop/mbr.exe

Any difference?

laranal · Oct 4, 2008

it asks me to run it and i do and nothing happens and i get this log

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Shaba · Oct 4, 2008

That indicates a possible mbr rootkit.

Go to start - run

Type this and click ok

"%userprofile%/Desktop/mbr.exe" -f

Post back log it gives, please.

laranal · Oct 4, 2008

it gave me the same thing

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Shaba · Oct 5, 2008

Then we do this:

Follow these instructions how to install recovery console.

If you don't have windows cd, let me know and don't proceed.

Then perform step "How to start the Recovery Console"

When you are in Recovery Console, type fixmbr and press enter.

When that is done, type exit and press enter.

Reboot normally.

Go to start - run

Type this and click ok

%userprofile%/Desktop/mbr.exe

Post back mbr log, please.

laranal · Oct 5, 2008

that page doesn't work and i don't have my windows cd D:

Shaba · Oct 5, 2008

Yes, there is no recovery console in Vista, my bad.

Any specific reason for not having vista dvd?

Google redirect.. security hacking?

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus