Vundo.JD and Google hijacker

B

briangoesindie

New member
I have been having problems with Firefox mainly since right before christmas when I was looking for a coupon code for a christmas present on google. now when I use google, it often redirects to other sites. I thought I fixed it by scanning with Spybot and Malwarebytes over the past few months and would periodically think it was covered. I also used AVG and thought it took care of it. The problems have become more apparent lately and I thought it was time to ask for help. I have been usig Spybot, Malwarebytes, AdvancedSystemCare free(a registry fixer, etc) and AVG. I have gotten no problems from recent scans but from notes I have kept, the only thing that has popped up, and it was only once, was Vundo.JD as was found by AVG a while back. I have turned off Tea Timer, made sure system restore is still on, and used ERUNT to back up my registry as per the procedure thread. Would love any help possible. Thank you!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:38:05 PM, on 2/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\El Conquistador\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6893 bytes
 
Hi there,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt
  • Save both reports to your desktop. Post them back to your topic.


Download GMER here by clicking download exe -button and then saving it your desktop:
  • Double-click .exe that you downloaded
  • Click rootkit-tab and then scan.
  • Don't check
    Show All
    box while scanning in progress!
  • When scanning is ready, click Copy.
  • This copies log to clipboard
  • Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply.
 
Dds

DDS (Ver_09-09-29.01) - NTFSx86
Run by El Conquistador at 14:07:39.29 on Fri 02/26/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.1963 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\El Conquistador\Desktop\dds.com

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [MPlayer2_FixUp] c:\windows\inf\unregmp2.exe /Fixups
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [Alcmtr] ALCMTR.EXE
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [36X Raid Configurer] c:\windows\system32\xRaidSetup.exe boot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\elconq~1\applic~1\mozilla\firefox\profiles\dmu9215x.default\
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\el conquistador\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\el conquistador\application data\move networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\el conquistador\application data\mozilla\firefox\profiles\dmu9215x.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-11-28 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-12-30 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-12-30 28424]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-12-30 360584]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-12-21 486280]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-12-30 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-12-30 285392]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2008-9-19 935208]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

=============== Created Last 30 ================

2010-02-25 21:28 <DIR> --d----- c:\docume~1\elconq~1\applic~1\Free Audio Editor
2010-02-25 21:27 <DIR> --d----- c:\program files\Free Audio Editor
2010-02-21 23:29 552 a------- c:\windows\system32\d3d8caps.dat
2010-02-21 15:17 <DIR> --dsh--- c:\documents and settings\el conquistador\IETldCache
2010-02-21 15:12 <DIR> -cd-h--- c:\windows\ie8
2010-02-20 22:06 <DIR> --d----- c:\program files\common files\DivX Shared
2010-02-18 21:09 3,272 a------- C:\london.rtf
2010-01-30 21:29 9,302 a------- C:\DB5.jpeg

==================== Find3M ====================

2010-02-26 11:26 96,512 a------- c:\windows\system32\drivers\atapi.sys
2010-01-29 03:20 15,880 a------- c:\windows\system32\lsdelete.exe
2010-01-07 16:07 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-12-31 11:50 353,792 a------- c:\windows\system32\drivers\srv.sys
2009-12-30 12:01 12,464 a------- c:\windows\system32\avgrsstx.dll
2009-12-30 12:01 360,584 a------- c:\windows\system32\drivers\avgtdix.sys
2009-12-30 12:01 333,192 a------- c:\windows\system32\drivers\avgldx86.sys
2009-12-21 23:32 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 23:03 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-12-16 13:43 343,040 a------- c:\windows\system32\mspaint.exe
2009-12-14 02:08 33,280 a------- c:\windows\system32\csrsrv.dll

============= FINISH: 14:11:07.78 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-09-29.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 1/19/2009 12:18:52 PM
System Uptime: 2/22/2010 8:58:19 PM (90 hours ago)

Motherboard: XFX | | MB-750I-72P9
Processor: Intel Pentium III Xeon processor | CPU 1 | 3000/333mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 46.955 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 52.906 GiB free.
E: is CDROM ()
F: is CDROM ()
H: is FIXED (FAT32) - 466 GiB total, 28.158 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3080
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3080
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8801&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3180
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8801&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3180
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8802&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3280
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8802&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3280
Service:

==== System Restore Points ===================

RP28: 1/28/2010 7:43:28 PM - System Checkpoint
RP29: 1/29/2010 9:32:11 PM - System Checkpoint
RP30: 1/30/2010 10:53:15 PM - System Checkpoint
RP31: 1/31/2010 11:17:31 PM - System Checkpoint
RP32: 2/2/2010 12:43:53 AM - System Checkpoint
RP33: 2/3/2010 1:35:04 AM - System Checkpoint
RP34: 2/4/2010 7:08:05 AM - System Checkpoint
RP35: 2/5/2010 9:59:56 AM - System Checkpoint
RP36: 2/6/2010 10:38:21 AM - System Checkpoint
RP37: 2/7/2010 12:08:08 PM - System Checkpoint
RP38: 2/8/2010 1:29:20 PM - System Checkpoint
RP39: 2/9/2010 5:45:58 PM - System Checkpoint
RP40: 2/10/2010 6:48:49 PM - System Checkpoint
RP41: 2/11/2010 9:07:58 PM - System Checkpoint
RP42: 2/12/2010 11:41:42 PM - System Checkpoint
RP43: 2/14/2010 11:23:20 AM - System Checkpoint
RP44: 2/15/2010 11:39:17 AM - System Checkpoint
RP45: 2/16/2010 8:07:05 PM - System Checkpoint
RP46: 2/17/2010 10:11:55 PM - System Checkpoint
RP47: 2/19/2010 12:00:02 AM - System Checkpoint
RP48: 2/19/2010 3:00:18 AM - Software Distribution Service 3.0
RP49: 2/20/2010 10:19:14 PM - Software Distribution Service 3.0
RP50: 2/21/2010 3:11:05 PM - Software Distribution Service 3.0
RP51: 2/22/2010 11:43:49 PM - System Checkpoint
RP52: 2/24/2010 12:18:44 AM - System Checkpoint
RP53: 2/25/2010 6:42:28 PM - System Checkpoint
RP54: 2/25/2010 9:27:57 PM - Installed Windows Media Format 9 Series Runtime Setup

==== Installed Programs ======================

"Nero SoundTrax Help
AAC Decoder
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Adobe Shockwave Player 11.5
Advanced SystemCare 3
Advertising Center
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVG Free 9.0
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DivX Version Checker
DolbyFiles
ERUNT 1.1j
Free Audio Editor
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
hp print screen utility
ImagXpress
iTunes
Java(TM) 6 Update 17
JMB36X Raid Configurer
LightScribe System Software 1.14.17.1
Malwarebytes' Anti-Malware
MATLAB Family of Products Release 14
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
Move Media Player
Movie Templates - Starter Kit
Mozilla Firefox (3.5.8)
MPlayer for Windows (Full Package)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
Nero 9
Nero BurningROM
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express
Nero InfoTool
Nero Live
Nero Live Help
Nero PhotoSnap
Nero PhotoSnap Help
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
NVIDIA Drivers
NVIDIA PhysX
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
SoundTrax
Spybot - Search & Destroy
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
VC80CRTRedist - 8.0.50727.4053
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Presentation Foundation
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
Xvid 1.1.3 final uninstall
ZoneAlarm

==== Event Viewer Messages From Past Week ========

2/25/2010 8:59:34 PM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/22/2010 12:50:48 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
2/20/2010 10:25:00 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
2/20/2010 10:17:04 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor service to connect.
2/20/2010 10:17:04 PM, error: Service Control Manager [7000] - The TrueVector Internet Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/19/2010 9:56:12 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'BACKUP.RDB' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
2/19/2010 9:13:13 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer MOMSLAPPY that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D5B88F0E-3E31-4EA7. The master browser is stopping or an election is being forced.
2/19/2010 11:29:33 AM, error: Service Control Manager [7034] - The MATLAB Server service terminated unexpectedly. It has done this 1 time(s).
2/19/2010 11:26:40 AM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

==== End Of File ===========================
 
I am attempting to run GMER right now on the infected computer. I ran it once and when i stepped away for a few minutes, the pc restarted. don't know if this is a problem. So I restarted GMER and it has been running for about 40 minutes now. not sure how long it should take but I can post what it has if you want me to.
 
Hi,

Better let it try to finish. If it still crashes, unselect sections and devices before hitting the scan button.
 
I have run GMER several times, and when it runs it crashes my computer and can't seem to finish. i will keep trying to get atleast a partial log, but i am unable to do that so far as i can't run any programs while gmer is open and have been unable to manage it.
 
this is the most complete GMER log I have been able to get before my computer crashes.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-26 20:47:34
Windows 5.1.2600 Service Pack 3
Running: n7598hlh.exe; Driver: C:\DOCUME~1\ELCONQ~1\LOCALS~1\Temp\uwrdrfoc.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xAE286630]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xAE27FD80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xAE2A4070]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xAE286E40]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xAE29DD30]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xAE29E150]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xAE2A8240]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xAE286FB0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xAE280C60]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xAE2A5780]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xAE2A5160]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xAE29CE70]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xAE2A6080]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xAE2A62B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xAE280750]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xAE2A0450]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xAE2A0020]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xAE2A7430]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xAE2A6A40]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xAE286180]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xAE2A70D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xAE286910]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xAE281080]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xAE2A78E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xAE2A4970]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xAE29ED20]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xAE29EA50]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwYieldExecution + 12E 804E4968 12 Bytes [40, 6E, 28, AE, 30, DD, 29, ...] {INC EAX; OUTSB ; SUB [ESI-0x51d622d0], CH; PUSH EAX; LOOPZ 0x34; SCASB }
.text ntoskrnl.exe!ZwYieldExecution + 47A 804E4CB4 4 Bytes JMP 38E7AE29
.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xF74B07A4]
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB85D1360, 0x35483F, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0099000A
.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 009A000A
.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0098000C
.text C:\WINDOWS\System32\svchost.exe[1120] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0504000A
.text C:\WINDOWS\Explorer.EXE[1968] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B6000A
.text C:\WINDOWS\Explorer.EXE[1968] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[1968] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B5000C

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [AE28A3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [AE28A3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [AE28A3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [AE28A3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [AE2AD480] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [AE28C080] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [AE28A3D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [AE28C7C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [AE28BE90] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [AE281DB0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [AE282170] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [AE2817B0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [AE281F40] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device -> \Driver\atapi \Device\Harddisk0\DR0 8A113369
 
Hi,

I think that's enough.

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.


Please continue as follows:

  1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
 
combofix log

ComboFix 10-02-27.04 - El Conquistador 02/27/2010 18:01:22.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2231 [GMT -5:00]
Running from: c:\documents and settings\El Conquistador\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2010-01-27 to 2010-02-27 )))))))))))))))))))))))))))))))
.

2010-02-27 00:20 . 2010-02-27 03:23 -------- d-----w- c:\documents and settings\El Conquistador\Tracing
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Microsoft
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live
2010-02-27 00:11 . 2010-02-27 00:11 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-26 02:28 . 2010-02-26 02:28 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Free Audio Editor
2010-02-26 02:27 . 2005-02-24 16:51 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2010-02-26 02:27 . 2005-05-18 16:52 1212416 ----a-w- c:\windows\system32\NCTAudioInformation2.dll
2010-02-26 02:27 . 2005-05-17 17:37 1986560 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-02-26 02:27 . 2005-04-15 17:08 880640 ----a-w- c:\windows\system32\NCTAudioEditor2.dll
2010-02-26 02:27 . 2005-04-04 22:21 602112 ----a-w- c:\windows\system32\NCTAudioTransform2.dll
2010-02-26 02:27 . 2005-03-28 20:54 479232 ----a-w- c:\windows\system32\NCTAudioVisualization2.dll
2010-02-26 02:27 . 2005-03-28 20:52 417792 ----a-w- c:\windows\system32\NCTTextToAudio2.dll
2010-02-26 02:27 . 2004-11-04 18:31 835584 ----a-w- c:\windows\system32\NCTAudioCDGrabber2.dll
2010-02-26 02:27 . 2010-02-26 02:28 -------- d-----w- c:\program files\Free Audio Editor
2010-02-26 02:27 . 2002-01-05 21:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-25 20:07 . 2010-02-25 20:07 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-23 02:04 . 2010-02-23 02:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-22 04:29 . 2010-02-22 04:29 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 22:36 . 2010-02-21 22:36 -------- d-----w- c:\program files\ERUNT
2010-02-21 21:05 . 2010-02-21 21:05 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-21 20:17 . 2010-02-21 20:17 -------- d-sh--w- c:\documents and settings\El Conquistador\IETldCache
2010-02-21 20:12 . 2010-02-21 20:13 -------- dc-h--w- c:\windows\ie8
2010-02-21 16:50 . 2010-02-21 16:50 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-02-21 14:13 . 2010-02-21 14:13 -------- d-sh--w- c:\documents and settings\NetworkService\UserData
2010-02-21 13:40 . 2010-02-21 13:41 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-21 03:06 . 2010-02-21 03:06 -------- d-----w- c:\program files\Common Files\DivX Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 09:48 . 2009-01-20 05:45 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 03:50 . 2008-04-14 12:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-02-27 02:16 . 2009-12-22 04:58 65950684 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-02-27 01:04 . 2008-12-21 00:45 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-27 00:16 . 2008-09-24 23:05 12912 ----a-w- c:\documents and settings\El Conquistador\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 21:47 . 2008-09-24 22:18 -------- d-----w- c:\program files\Vuze
2010-02-21 20:16 . 2008-11-11 04:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-21 19:28 . 2008-11-11 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-21 19:27 . 2008-09-24 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\SUPERAntiSpyware.com
2010-02-21 19:25 . 2009-01-20 05:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-21 03:14 . 2010-02-21 03:56 1703424 ----a-w- c:\windows\Internet Logs\xDBDD.tmp
2010-02-21 03:14 . 2010-02-21 03:56 4171776 ----a-w- c:\windows\Internet Logs\xDBDC.tmp
2010-02-21 03:07 . 2008-09-24 23:59 -------- d-----w- c:\program files\DivX
2010-02-21 03:05 . 2009-02-26 04:13 -------- d-----w- c:\program files\MPlayer for Windows
2010-02-21 03:04 . 2008-09-24 23:46 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Apple Computer
2010-02-21 03:03 . 2008-09-25 03:56 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Azureus
2010-02-18 22:53 . 2009-12-30 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-04 20:20 . 2009-11-28 20:20 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-04 20:20 . 2009-11-28 20:20 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-04 20:20 . 2009-11-28 20:20 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-04 20:20 . 2009-11-28 20:20 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-26 06:20 . 2010-01-26 06:48 1688064 ----a-w- c:\windows\Internet Logs\xDB83.tmp
2010-01-22 18:26 . 2010-01-22 18:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 22:18 . 2009-01-20 22:47 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Move Networks
2010-01-19 20:13 . 2010-01-19 20:13 144160 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\uninstall.exe
2010-01-19 20:13 . 2009-12-07 01:22 5603776 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
2010-01-10 12:07 . 2010-01-10 12:22 3694592 ----a-w- c:\windows\Internet Logs\xDB7F.tmp
2010-01-07 21:07 . 2010-01-22 18:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2010-01-22 18:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 14:29 . 2009-12-16 14:24 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2010-01-02 19:46 . 2008-09-29 22:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\IObit
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\program files\IObit
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 17:01 . 2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-30 17:01 . 2009-12-30 17:01 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-30 17:01 . 2009-12-30 17:01 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-30 17:01 . 2009-12-30 17:01 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-30 17:01 . 2009-12-30 17:01 -------- d-----w- c:\program files\AVG
2009-12-30 16:50 . 2009-12-30 16:50 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Uniblue
2009-12-30 16:43 . 2009-12-30 16:43 -------- d-----w- c:\documents and settings\LocalService\Application Data\MathWorks
2009-12-26 01:20 . 2009-12-30 05:11 8704 ----a-w- c:\windows\Internet Logs\xDB5.tmp
2009-12-22 04:32 . 2009-11-29 03:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-22 04:31 . 2009-12-22 04:31 152576 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-22 04:31 . 2009-12-22 04:31 79488 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-22 04:03 . 2009-12-22 04:03 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-12-16 18:43 . 2008-09-24 06:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-07 01:22 . 2009-12-07 01:22 97216 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-12-04 18:22 . 2008-04-14 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-12-26 2335952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-21 185896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-22 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\MATLAB701\\bin\\win32\\MATLAB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/28/2009 3:20 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/30/2009 12:01 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/30/2009 12:01 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [12/30/2009 12:01 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/30/2009 12:01 PM 285392]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1181328]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 15:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-02-27 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-02-27 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-02-27 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-02-27 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-02-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-02-27 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

Notify-AtiExtEvent - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 18:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A13A369]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74a0852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(684)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-02-27 18:13:56
ComboFix-quarantined-files.txt 2010-02-27 23:13

Pre-Run: 57,282,973,696 bytes free
Post-Run: 57,239,552,000 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 12816BC0DCBF8187BF0ABD30CD0D39BD
 
almost forgot the dds logs.


DDS (Ver_09-09-29.01) - NTFSx86
Run by El Conquistador at 18:47:31.02 on Sat 02/27/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2223 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\El Conquistador\Desktop\dds.com

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [36X Raid Configurer] c:\windows\system32\xRaidSetup.exe boot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\elconq~1\applic~1\mozilla\firefox\profiles\dmu9215x.default\
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\el conquistador\application data\move networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\el conquistador\application data\mozilla\firefox\profiles\dmu9215x.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-11-28 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-12-30 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-12-30 28424]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-12-30 360584]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-12-21 486280]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-12-30 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-12-30 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\NBService.exe [2008-9-19 935208]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

=============== Created Last 30 ================

2010-02-27 17:58 <DIR> a-dshr-- C:\cmdcons
2010-02-27 17:56 261,632 a------- c:\windows\PEV.exe
2010-02-27 17:56 161,792 a------- c:\windows\SWREG.exe
2010-02-27 17:56 98,816 a------- c:\windows\sed.exe
2010-02-27 17:56 77,312 a------- c:\windows\MBR.exe
2010-02-27 17:56 <DIR> --d----- C:\ComboFix
2010-02-26 19:20 <DIR> --d----- c:\documents and settings\el conquistador\Tracing
2010-02-26 19:15 <DIR> --d----- c:\program files\Microsoft
2010-02-26 19:15 <DIR> --d----- c:\program files\Windows Live SkyDrive
2010-02-26 19:11 <DIR> --d----- c:\program files\common files\Windows Live
2010-02-25 21:28 <DIR> --d----- c:\docume~1\elconq~1\applic~1\Free Audio Editor
2010-02-25 21:27 <DIR> --d----- c:\program files\Free Audio Editor
2010-02-21 23:29 552 a------- c:\windows\system32\d3d8caps.dat
2010-02-21 15:17 <DIR> --dsh--- c:\documents and settings\el conquistador\IETldCache
2010-02-21 15:12 <DIR> -cd-h--- c:\windows\ie8
2010-02-20 22:06 <DIR> --d----- c:\program files\common files\DivX Shared
2010-02-18 21:09 3,272 a------- C:\london.rtf
2010-01-30 21:29 9,302 a------- C:\DB5.jpeg

==================== Find3M ====================

2010-02-26 22:50 96,512 -------- c:\windows\system32\drivers\atapi.sys
2010-01-29 03:20 15,880 a------- c:\windows\system32\lsdelete.exe
2010-01-07 16:07 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-12-31 11:50 353,792 a------- c:\windows\system32\drivers\srv.sys
2009-12-30 12:01 12,464 a------- c:\windows\system32\avgrsstx.dll
2009-12-30 12:01 360,584 a------- c:\windows\system32\drivers\avgtdix.sys
2009-12-30 12:01 333,192 a------- c:\windows\system32\drivers\avgldx86.sys
2009-12-21 23:32 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 23:03 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-12-16 13:43 343,040 a------- c:\windows\system32\mspaint.exe
2009-12-14 02:08 33,280 a------- c:\windows\system32\csrsrv.dll

============= FINISH: 18:54:40.17 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-09-29.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 1/19/2009 12:18:52 PM
System Uptime: 2/27/2010 6:39:59 PM (0 hours ago)

Motherboard: XFX | | MB-750I-72P9
Processor: Intel Pentium III Xeon processor | CPU 1 | 3000/333mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 53.403 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 52.906 GiB free.
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3080
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3080
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8801&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3180
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8801&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3180
Service:

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: PCI\VEN_14F1&DEV_8802&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3280
Manufacturer:
Name:
PNP Device ID: PCI\VEN_14F1&DEV_8802&SUBSYS_005111BD&REV_05\4&2B17F62E&0&3280
Service:

==== System Restore Points ===================

RP28: 1/28/2010 7:43:28 PM - System Checkpoint
RP29: 1/29/2010 9:32:11 PM - System Checkpoint
RP30: 1/30/2010 10:53:15 PM - System Checkpoint
RP31: 1/31/2010 11:17:31 PM - System Checkpoint
RP32: 2/2/2010 12:43:53 AM - System Checkpoint
RP33: 2/3/2010 1:35:04 AM - System Checkpoint
RP34: 2/4/2010 7:08:05 AM - System Checkpoint
RP35: 2/5/2010 9:59:56 AM - System Checkpoint
RP36: 2/6/2010 10:38:21 AM - System Checkpoint
RP37: 2/7/2010 12:08:08 PM - System Checkpoint
RP38: 2/8/2010 1:29:20 PM - System Checkpoint
RP39: 2/9/2010 5:45:58 PM - System Checkpoint
RP40: 2/10/2010 6:48:49 PM - System Checkpoint
RP41: 2/11/2010 9:07:58 PM - System Checkpoint
RP42: 2/12/2010 11:41:42 PM - System Checkpoint
RP43: 2/14/2010 11:23:20 AM - System Checkpoint
RP44: 2/15/2010 11:39:17 AM - System Checkpoint
RP45: 2/16/2010 8:07:05 PM - System Checkpoint
RP46: 2/17/2010 10:11:55 PM - System Checkpoint
RP47: 2/19/2010 12:00:02 AM - System Checkpoint
RP48: 2/19/2010 3:00:18 AM - Software Distribution Service 3.0
RP49: 2/20/2010 10:19:14 PM - Software Distribution Service 3.0
RP50: 2/21/2010 3:11:05 PM - Software Distribution Service 3.0
RP51: 2/22/2010 11:43:49 PM - System Checkpoint
RP52: 2/24/2010 12:18:44 AM - System Checkpoint
RP53: 2/25/2010 6:42:28 PM - System Checkpoint
RP54: 2/25/2010 9:27:57 PM - Installed Windows Media Format 9 Series Runtime Setup
RP55: 2/26/2010 10:51:41 PM - System Checkpoint

==== Installed Programs ======================

"Nero SoundTrax Help
AAC Decoder
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Adobe Shockwave Player 11.5
Advanced SystemCare 3
Advertising Center
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVG Free 9.0
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DivX Version Checker
DolbyFiles
ERUNT 1.1j
Free Audio Editor
H.264 Decoder
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
hp print screen utility
ImagXpress
iTunes
Java(TM) 6 Update 17
JMB36X Raid Configurer
LightScribe System Software 1.14.17.1
Malwarebytes' Anti-Malware
MATLAB Family of Products Release 14
Menu Templates - Starter Kit
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
MKV Splitter
Move Media Player
Movie Templates - Starter Kit
Mozilla Firefox (3.5.8)
MPlayer for Windows (Full Package)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
Nero 9
Nero BurningROM
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express
Nero InfoTool
Nero Live
Nero Live Help
Nero PhotoSnap
Nero PhotoSnap Help
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
NVIDIA Drivers
NVIDIA PhysX
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Segoe UI
SoundTrax
Spybot - Search & Destroy
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
VC80CRTRedist - 8.0.50727.4053
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Presentation Foundation
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
Xvid 1.1.3 final uninstall
ZoneAlarm

==== Event Viewer Messages From Past Week ========

2/25/2010 9:02:22 PM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/25/2010 8:59:09 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer MOMSLAPPY that believes that it is the master browser for the domain on transport NetBT_Tcpip_{D5B88F0E-3E31-4EA7. The master browser is stopping or an election is being forced.
2/22/2010 9:02:38 PM, error: Service Control Manager [7034] - The MATLAB Server service terminated unexpectedly. It has done this 1 time(s).
2/22/2010 8:59:54 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor service to connect.
2/22/2010 8:59:54 PM, error: Service Control Manager [7000] - The TrueVector Internet Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/22/2010 8:59:54 PM, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
2/22/2010 12:50:48 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
2/20/2010 10:25:00 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

==== End Of File ===========================
 
Hi,

Print following instructions since you won't be able to access them in recovery console.

1. Restart your computer
2. Before Windows loads, you will be prompted to choose which Operating System to start
3. Use the up and down arrow key to select Microsoft Windows Recovery Console
4. You must enter which Windows installation to log onto. Type 1 and press enter.
5. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd system32\drivers

6. At the next prompt, type the following bolded text, and press Enter (you should see message "1 file(s) copied"):

copy atapi.sys atapi.sys.vir

7. At the next prompt, type the following bolded text, and press Enter:

exit

Windows will now begin loading. Upload c:\windows\system32\drivers\atapi.sys.vir file to http://www.virustotal.com and post back the results.
 
File atapi.sys.vir received on 2010.02.28 20:33:08 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 35/42 (83.34%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 42 and 60 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.02.28 Rootkit.Win32.TDSS!IK
AhnLab-V3 5.0.0.2 2010.02.28 -
AntiVir 8.2.1.176 2010.02.28 TR/Patched.Gen
Antiy-AVL 2.0.3.7 2010.02.26 -
Authentium 5.2.0.5 2010.02.28 W32/SYStroj.AB.gen!Eldorado
Avast 4.8.1351.0 2010.02.28 Win32:Alureon-EM
Avast5 5.0.332.0 2010.02.28 Win32:Alureon-EM
AVG 9.0.0.730 2010.02.28 Rootkit-Agent.EF
BitDefender 7.2 2010.02.28 Rootkit.Patched.TDSS.Gen
CAT-QuickHeal 10.00 2010.02.27 Rootkit.TDSS.y
ClamAV 0.96.0.0-git 2010.02.28 -
Comodo 4091 2010.02.28 Virus.Win32.Olmarik.RF0
DrWeb 5.0.1.12222 2010.02.28 BackDoor.Tdss.1365
eSafe 7.0.17.0 2010.02.28 -
eTrust-Vet 35.2.7331 2010.02.26 Win32/Alureon.AQH
F-Prot 4.5.1.85 2010.02.28 W32/SYStroj.AB.gen!Eldorado
F-Secure 9.0.15370.0 2010.02.28 Rootkit:W32/TDSS.gen!D
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.02.28 Rootkit.Patched.TDSS.Gen
Ikarus T3.1.1.80.0 2010.02.28 Rootkit.Win32.TDSS
Jiangmin 13.0.900 2010.02.28 Rootkit.TDSS.cwp
K7AntiVirus 7.10.984 2010.02.26 -
Kaspersky 7.0.0.125 2010.02.28 Rootkit.Win32.TDSS.y
McAfee 5906 2010.02.28 Patched-SYSFile.a
McAfee+Artemis 5906 2010.02.28 Patched-SYSFile.a
McAfee-GW-Edition 6.8.5 2010.02.28 Trojan.Patched.Gen
Microsoft 1.5502 2010.02.28 Virus:Win32/Alureon.F
NOD32 4903 2010.02.28 Win32/Olmarik.RF
Norman 6.04.08 2010.02.28 W32/TDSS.drv.gen1
nProtect 2009.1.8.0 2010.02.28 Trojan/W32.Rootkit.96512.D
Panda 10.0.2.2 2010.02.28 W32/Patched.N
PCTools 7.0.3.5 2010.02.28 Backdoor.Tidserv
Prevx 3.0 2010.02.28 Medium Risk Malware
Rising 22.36.06.04 2010.02.28 -
Sophos 4.50.0 2010.02.28 Mal/TDSSRt-A
Sunbelt 5711 2010.02.28 Rootkit.Win32.TDSS.y (v)
Symantec 20091.2.0.41 2010.02.28 Backdoor.Tidserv!inf
TheHacker 6.5.1.7.215 2010.02.28 Trojan/TDSS.y
TrendMicro 9.120.0.1004 2010.02.28 PE_TDSS.MTR
VBA32 3.12.12.2 2010.02.26 Rootkit.Win32.TDSL
ViRobot 2010.2.27.2206 2010.02.27 Trojan.Win32.R-Alureon.246784
VirusBuster 5.0.27.0 2010.02.28 Rootkit.Alureon.Gen!Pac.7
Additional information
File size: 96512 bytes
MD5...: 54b1d12cbed536653559dd1d1dd05d8f
SHA1..: 6638d18b204b19869f087e23f868a888711cf04c
SHA256: e8b352813e5c8500fcf40443fb8410e44801f85356c00ad339115ada1a3b569a
ssdeep: 1536:lwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb
DD0ut:lQ+N74vkEZIxMohjsimBoDTRMBwFktZ+
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x167a4
timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29
.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708
.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9
PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863
INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3
.rsrc 0x16780 0x3e0 0x400 6.11 fc959b2beac806071b0e8412f676d56d
.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45

( 3 imports )
> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=7EFDCA54002458B979D801FAFEE1BA00A0BAF36E' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=7EFDCA54002458B979D801FAFEE1BA00A0BAF36E</a>
 
Hi again,

Download and Run SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: 
    :filefind
atapi.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
 
SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 11:04 on 01/03/2010 by El Conquistador (Administrator - Elevation successful)

========== filefind ==========

Searching for "atapi.sys"
C:\WINDOWS\ERDNT\cache\atapi.sys --a--- 96512 bytes [23:09 27/02/2010] [03:50 27/02/2010] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\dllcache\atapi.sys --a--c 96512 bytes [12:00 14/04/2008] [03:50 27/02/2010] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\drivers\atapi.sys ------ 96512 bytes [12:00 14/04/2008] [03:50 27/02/2010] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys --a--- 96512 bytes [17:31 19/01/2009] [12:00 14/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys --a--- 96512 bytes [17:31 19/01/2009] [12:00 14/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674

-=End Of File=-
 
Hi,

Click start->run-> type cmd.exe and press enter. In command prompt type following command (you should see message "1 file(s) copied" if all went ok.):
Code: 
copy C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys C:\WINDOWS\system32\drivers\atapi.sys.bak


Then we need to enter recovery console again.

1. Restart your computer
2. Before Windows loads, you will be prompted to choose which Operating System to start
3. Use the up and down arrow key to select Microsoft Windows Recovery Console
4. You must enter which Windows installation to log onto. Type 1 and press enter.
5. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd system32\drivers

6. At the next prompt, type the following bolded text, and press Enter (allow overwrite):

copy atapi.sys.bak atapi.sys

7. At the next prompt, type the following bolded text, and press Enter:

exit


System should reboot back into normal mode. Run ComboFix again (let it update if asked for permission to do so) and post back its log.
 
ComboFix 10-02-28.04 - El Conquistador 03/01/2010 11:51:33.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2340 [GMT -5:00]
Running from: c:\documents and settings\El Conquistador\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2010-02-01 to 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-02-27 00:20 . 2010-03-01 16:45 -------- d-----w- c:\documents and settings\El Conquistador\Tracing
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Microsoft
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live
2010-02-27 00:11 . 2010-02-27 00:11 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-26 02:28 . 2010-02-26 02:28 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Free Audio Editor
2010-02-26 02:27 . 2005-02-24 16:51 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2010-02-26 02:27 . 2005-05-18 16:52 1212416 ----a-w- c:\windows\system32\NCTAudioInformation2.dll
2010-02-26 02:27 . 2005-05-17 17:37 1986560 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-02-26 02:27 . 2005-04-15 17:08 880640 ----a-w- c:\windows\system32\NCTAudioEditor2.dll
2010-02-26 02:27 . 2005-04-04 22:21 602112 ----a-w- c:\windows\system32\NCTAudioTransform2.dll
2010-02-26 02:27 . 2005-03-28 20:54 479232 ----a-w- c:\windows\system32\NCTAudioVisualization2.dll
2010-02-26 02:27 . 2005-03-28 20:52 417792 ----a-w- c:\windows\system32\NCTTextToAudio2.dll
2010-02-26 02:27 . 2004-11-04 18:31 835584 ----a-w- c:\windows\system32\NCTAudioCDGrabber2.dll
2010-02-26 02:27 . 2010-02-26 02:28 -------- d-----w- c:\program files\Free Audio Editor
2010-02-26 02:27 . 2002-01-05 21:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-25 20:07 . 2010-02-25 20:07 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-23 02:04 . 2010-02-23 02:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-22 04:29 . 2010-02-22 04:29 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 22:36 . 2010-02-21 22:36 -------- d-----w- c:\program files\ERUNT
2010-02-21 21:05 . 2010-02-21 21:05 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-21 20:17 . 2010-02-21 20:17 -------- d-sh--w- c:\documents and settings\El Conquistador\IETldCache
2010-02-21 20:12 . 2010-02-21 20:13 -------- dc-h--w- c:\windows\ie8
2010-02-21 16:50 . 2010-02-21 16:50 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-02-21 14:13 . 2010-02-21 14:13 -------- d-sh--w- c:\documents and settings\NetworkService\UserData
2010-02-21 13:40 . 2010-02-21 13:41 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-21 03:06 . 2010-02-21 03:06 -------- d-----w- c:\program files\Common Files\DivX Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 17:01 . 2009-12-22 04:58 14392006 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-03-01 05:58 . 2008-09-25 03:56 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Azureus
2010-02-28 20:26 . 2008-12-21 00:45 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-28 20:23 . 2010-02-28 20:36 1735168 ----a-w- c:\windows\Internet Logs\xDB7E.tmp
2010-02-28 20:23 . 2010-02-28 20:36 1594368 ----a-w- c:\windows\Internet Logs\xDB7D.tmp
2010-02-28 17:47 . 2009-02-26 04:13 -------- d-----w- c:\program files\MPlayer for Windows
2010-02-28 15:04 . 2008-09-24 22:18 -------- d-----w- c:\program files\Vuze
2010-02-27 09:48 . 2009-01-20 05:45 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 03:50 . 2008-04-14 12:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys.vir
2010-02-27 00:16 . 2008-09-24 23:05 12912 ----a-w- c:\documents and settings\El Conquistador\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 20:16 . 2008-11-11 04:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-21 19:28 . 2008-11-11 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-21 19:27 . 2008-09-24 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\SUPERAntiSpyware.com
2010-02-21 19:25 . 2009-01-20 05:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-21 03:14 . 2010-02-21 03:56 1703424 ----a-w- c:\windows\Internet Logs\xDBDD.tmp
2010-02-21 03:14 . 2010-02-21 03:56 4171776 ----a-w- c:\windows\Internet Logs\xDBDC.tmp
2010-02-21 03:07 . 2008-09-24 23:59 -------- d-----w- c:\program files\DivX
2010-02-21 03:04 . 2008-09-24 23:46 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Apple Computer
2010-02-18 22:53 . 2009-12-30 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-04 20:20 . 2009-11-28 20:20 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-04 20:20 . 2009-11-28 20:20 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-04 20:20 . 2009-11-28 20:20 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-04 20:20 . 2009-11-28 20:20 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-26 06:20 . 2010-01-26 06:48 1688064 ----a-w- c:\windows\Internet Logs\xDB83.tmp
2010-01-22 18:26 . 2010-01-22 18:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 22:18 . 2009-01-20 22:47 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Move Networks
2010-01-19 20:13 . 2010-01-19 20:13 144160 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\uninstall.exe
2010-01-19 20:13 . 2009-12-07 01:22 5603776 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
2010-01-10 12:07 . 2010-01-10 12:22 3694592 ----a-w- c:\windows\Internet Logs\xDB7F.tmp
2010-01-07 21:07 . 2010-01-22 18:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2010-01-22 18:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 14:29 . 2009-12-16 14:24 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2010-01-02 19:46 . 2008-09-29 22:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\IObit
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\program files\IObit
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 17:01 . 2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-30 17:01 . 2009-12-30 17:01 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-30 17:01 . 2009-12-30 17:01 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-30 17:01 . 2009-12-30 17:01 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-26 01:20 . 2009-12-30 05:11 8704 ----a-w- c:\windows\Internet Logs\xDB5.tmp
2009-12-22 04:32 . 2009-11-29 03:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-22 04:31 . 2009-12-22 04:31 152576 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-22 04:31 . 2009-12-22 04:31 79488 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-22 04:03 . 2009-12-22 04:03 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-12-16 18:43 . 2008-09-24 06:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-07 01:22 . 2009-12-07 01:22 97216 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-12-04 18:22 . 2008-04-14 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-27_23.08.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-01 16:43 . 2010-03-01 16:43 16384 c:\windows\Temp\Perflib_Perfdata_154.dat
+ 2010-03-01 16:38 . 2008-04-14 12:00 96512 c:\windows\system32\drivers\atapi.sys
- 2008-04-14 12:00 . 2010-02-27 03:50 96512 c:\windows\system32\drivers\atapi.sys
+ 2010-02-28 15:04 . 2010-02-28 15:04 2317312 c:\windows\Installer\34e4226.msi
+ 2010-02-28 15:05 . 2010-02-28 15:05 15709696 c:\windows\Installer\34e4235.msp
+ 2009-08-18 04:15 . 2009-08-18 04:15 10380800 c:\windows\Installer\34e422d.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-12-26 2335952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-21 185896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-22 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\MATLAB701\\bin\\win32\\MATLAB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/28/2009 3:20 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/30/2009 12:01 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/30/2009 12:01 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [12/30/2009 12:01 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/30/2009 12:01 PM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1181328]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 15:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Install_NSS.job
- c:\program files\Vuze\nssstub.exe [2010-02-28 15:04]

2010-03-01 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 12:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2872)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-03-01 12:04:12
ComboFix-quarantined-files.txt 2010-03-01 17:03
ComboFix2.txt 2010-02-27 23:13

Pre-Run: 55,466,295,296 bytes free
Post-Run: 57,550,012,416 bytes free

- - End Of File - - 77E1602037B20D1960D9A2240C555825
 
Hi again,


Open notepad and copy/paste the text in the quotebox below into it:

Code: 
http://forums.spybot.info/showthread.php?t=55690&page=2
Collect::
c:\windows\system32\drivers\atapi.sys.vir
File::
c:\windows\Tasks\Install_NSS.job
DDS::
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
Folder::
c:\program files\Vuze
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Vuze\\Azureus.exe"=-


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

CFScriptB-4.gif


Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Uninstall old Adobe Reader versions and get the latest one (9.3 + update 9.3.1) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

Check here to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here. Fresh version can be obtained here.


Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
 
combofix log

I should have told you i installed vuze/azureus this weekend and probably shouldn't have. Hope I haven't set you on a false path. my apologies if I have.

ComboFix 10-03-01.01 - El Conquistador 03/01/2010 17:16:00.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2375 [GMT -5:00]
Running from: c:\documents and settings\El Conquistador\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\El Conquistador\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::
"c:\windows\Tasks\Install_NSS.job"

file zipped: c:\windows\system32\drivers\atapi.sys.vir
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Vuze
c:\program files\Vuze\.install4j\_shfoldr.dll
c:\program files\Vuze\.install4j\autoUninstall.0
c:\program files\Vuze\.install4j\files.log
c:\program files\Vuze\.install4j\i4j_extf_0_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_1_5p83tu.properties
c:\program files\Vuze\.install4j\i4j_extf_10_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_11_5p83tu.properties
c:\program files\Vuze\.install4j\i4j_extf_12_5p83tu_1q2vg51.png
c:\program files\Vuze\.install4j\i4j_extf_13_5p83tu_1rjd818.png
c:\program files\Vuze\.install4j\i4j_extf_14_5p83tu_qin5kk.png
c:\program files\Vuze\.install4j\i4j_extf_15_5p83tu.exe
c:\program files\Vuze\.install4j\i4j_extf_16_5p83tu.exe
c:\program files\Vuze\.install4j\i4j_extf_17_5p83tu.exe
c:\program files\Vuze\.install4j\i4j_extf_18_5p83tu_xza4ha.png
c:\program files\Vuze\.install4j\i4j_extf_19_5p83tu_19c5po3.png
c:\program files\Vuze\.install4j\i4j_extf_2_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_20_5p83tu.html
c:\program files\Vuze\.install4j\i4j_extf_21_5p83tu_2zcusy.png
c:\program files\Vuze\.install4j\i4j_extf_22_5p83tu.html
c:\program files\Vuze\.install4j\i4j_extf_23_5p83tu_rz1c2y.png
c:\program files\Vuze\.install4j\i4j_extf_24_5p83tu_bm8amj.ico
c:\program files\Vuze\.install4j\i4j_extf_25_5p83tu.exe
c:\program files\Vuze\.install4j\i4j_extf_26_5p83tu.DLL
c:\program files\Vuze\.install4j\i4j_extf_27_5p83tu.exe
c:\program files\Vuze\.install4j\i4j_extf_28_5p83tu.dll
c:\program files\Vuze\.install4j\i4j_extf_29_5p83tu.dll
c:\program files\Vuze\.install4j\i4j_extf_3_5p83tu.properties
c:\program files\Vuze\.install4j\i4j_extf_30_5p83tu_117nkgl.png
c:\program files\Vuze\.install4j\i4j_extf_31_5p83tu_1eannr4.png
c:\program files\Vuze\.install4j\i4j_extf_32_5p83tu_1efhqvy.png
c:\program files\Vuze\.install4j\i4j_extf_33_5p83tu_10qu06u.png
c:\program files\Vuze\.install4j\i4j_extf_34_5p83tu.html
c:\program files\Vuze\.install4j\i4j_extf_35_5p83tu_z1x7tn.png
c:\program files\Vuze\.install4j\i4j_extf_4_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_5_5p83tu.properties
c:\program files\Vuze\.install4j\i4j_extf_6_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_7_5p83tu.properties
c:\program files\Vuze\.install4j\i4j_extf_8_5p83tu.utf8
c:\program files\Vuze\.install4j\i4j_extf_9_5p83tu.properties
c:\program files\Vuze\.install4j\i4jdel.exe
c:\program files\Vuze\.install4j\i4jinst.dll
c:\program files\Vuze\.install4j\i4jparams.conf
c:\program files\Vuze\.install4j\i4jruntime.jar
c:\program files\Vuze\.install4j\inst_jre.cfg
c:\program files\Vuze\.install4j\install.prop
c:\program files\Vuze\.install4j\installation.log
c:\program files\Vuze\.install4j\MessagesDefault
c:\program files\Vuze\.install4j\response.varfile
c:\program files\Vuze\.install4j\unicows.dll
c:\program files\Vuze\.install4j\user.jar
c:\program files\Vuze\aereg.dll
c:\program files\Vuze\Azureus.exe
c:\program files\Vuze\Azureus.exe.manifest
c:\program files\Vuze\Azureus.exe.vmoptions
c:\program files\Vuze\Azureus.properties
c:\program files\Vuze\Azureus2.jar
c:\program files\Vuze\AzureusUpdater.exe
c:\program files\Vuze\GPL.txt
c:\program files\Vuze\hs_err_pid1244.log
c:\program files\Vuze\hs_err_pid1256.log
c:\program files\Vuze\hs_err_pid1272.log
c:\program files\Vuze\hs_err_pid1468.log
c:\program files\Vuze\hs_err_pid1552.log
c:\program files\Vuze\hs_err_pid1744.log
c:\program files\Vuze\hs_err_pid1824.log
c:\program files\Vuze\hs_err_pid1852.log
c:\program files\Vuze\hs_err_pid2600.log
c:\program files\Vuze\hs_err_pid2604.log
c:\program files\Vuze\hs_err_pid2728.log
c:\program files\Vuze\hs_err_pid2800.log
c:\program files\Vuze\hs_err_pid2992.log
c:\program files\Vuze\hs_err_pid3080.log
c:\program files\Vuze\hs_err_pid3232.log
c:\program files\Vuze\hs_err_pid3244.log
c:\program files\Vuze\hs_err_pid3288.log
c:\program files\Vuze\hs_err_pid3364.log
c:\program files\Vuze\hs_err_pid3384.log
c:\program files\Vuze\hs_err_pid340.log
c:\program files\Vuze\hs_err_pid3504.log
c:\program files\Vuze\hs_err_pid3532.log
c:\program files\Vuze\hs_err_pid3636.log
c:\program files\Vuze\hs_err_pid3656.log
c:\program files\Vuze\hs_err_pid3744.log
c:\program files\Vuze\hs_err_pid3752.log
c:\program files\Vuze\hs_err_pid3792.log
c:\program files\Vuze\hs_err_pid3820.log
c:\program files\Vuze\hs_err_pid3968.log
c:\program files\Vuze\hs_err_pid3988.log
c:\program files\Vuze\hs_err_pid4060.log
c:\program files\Vuze\hs_err_pid420.log
c:\program files\Vuze\hs_err_pid440.log
c:\program files\Vuze\hs_err_pid5060.log
c:\program files\Vuze\hs_err_pid552.log
c:\program files\Vuze\hs_err_pid560.log
c:\program files\Vuze\hs_err_pid624.log
c:\program files\Vuze\hs_err_pid784.log
c:\program files\Vuze\installer.log
c:\program files\Vuze\nssstub.exe
c:\program files\Vuze\plugins\azemp\azemp_2.0.28.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.28.zip
c:\program files\Vuze\plugins\azemp\azemp_2.0.30.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.30.zip
c:\program files\Vuze\plugins\azemp\azemp_2.0.32.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.32.zip
c:\program files\Vuze\plugins\azemp\azemp_2.0.34.jar
c:\program files\Vuze\plugins\azemp\azemp_2.0.34.zip
c:\program files\Vuze\plugins\azemp\azemp_2.1.02.jar
c:\program files\Vuze\plugins\azemp\azemp_2.1.02.zip
c:\program files\Vuze\plugins\azemp\azemp_2.2.2.jar
c:\program files\Vuze\plugins\azemp\azemp_2.2.2.zip
c:\program files\Vuze\plugins\azemp\azmplay.exe.bak
c:\program files\Vuze\plugins\azemp\azureus.sig
c:\program files\Vuze\plugins\azemp\cp1250-a.raw
c:\program files\Vuze\plugins\azemp\cp1250-a.raw.bak
c:\program files\Vuze\plugins\azemp\cp1250-b.raw
c:\program files\Vuze\plugins\azemp\cp1250-b.raw.bak
c:\program files\Vuze\plugins\azemp\font.desc
c:\program files\Vuze\plugins\azemp\font.desc.bak
c:\program files\Vuze\plugins\azemp\mplayer\config
c:\program files\Vuze\plugins\azemp\osd-mplayer-a.raw
c:\program files\Vuze\plugins\azemp\osd-mplayer-a.raw.bak
c:\program files\Vuze\plugins\azemp\osd-mplayer-b.raw
c:\program files\Vuze\plugins\azemp\osd-mplayer-b.raw.bak
c:\program files\Vuze\plugins\azemp\plugin.properties
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.28
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.30
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.32
c:\program files\Vuze\plugins\azemp\plugin.properties_2.0.34
c:\program files\Vuze\plugins\azemp\plugin.properties_2.1.02
c:\program files\Vuze\plugins\azemp\plugin.properties_2.2.2
c:\program files\Vuze\plugins\azitunes\azitunes_0.2.3.jar
c:\program files\Vuze\plugins\azitunes\azureus.sig
c:\program files\Vuze\plugins\azitunes\jacob-1.14.3-x86.dll
c:\program files\Vuze\plugins\azitunes\jacob_1.14.3.jar
c:\program files\Vuze\plugins\azitunes\libProcessAccess.dll
c:\program files\Vuze\plugins\azitunes\libProcessAccess_0.1.2.jar
c:\program files\Vuze\plugins\azitunes\plugin.properties
c:\program files\Vuze\plugins\azplugins\azplugins_2.1.6.jar
c:\program files\Vuze\plugins\azrating\azrating_1.3.1.jar
c:\program files\Vuze\plugins\azupdater\azupdater_1.8.12.zip
c:\program files\Vuze\plugins\azupdater\azupdaterpatcher_1.8.12.jar
c:\program files\Vuze\plugins\azupdater\azupdaterpatcher_1.8.15.jar
c:\program files\Vuze\plugins\azupdater\azureus.sig
c:\program files\Vuze\plugins\azupdater\Azureus2_4.2.0.4_P4.pax
c:\program files\Vuze\plugins\azupdater\plugin.properties
c:\program files\Vuze\plugins\azupdater\plugin.properties_1.8.12
c:\program files\Vuze\plugins\azupdater\Updater.jar
c:\program files\Vuze\plugins\azupdater\Updater.jar.bak
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.17.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.17.zip
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.21.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.21.zip
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.23.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.23.zip
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.5.jar
c:\program files\Vuze\plugins\azupnpav\azupnpav_0.2.5.zip
c:\program files\Vuze\plugins\azupnpav\azureus.sig
c:\program files\Vuze\plugins\azupnpav\plugin.properties
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.17
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.21
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.23
c:\program files\Vuze\plugins\azupnpav\plugin.properties_0.2.5
c:\program files\Vuze\swt.jar
c:\program files\Vuze\uninstall.exe
c:\program files\Vuze\Vuze.ico
c:\windows\system32\drivers\atapi.sys.vir

.
((((((((((((((((((((((((( Files Created from 2010-02-01 to 2010-03-01 )))))))))))))))))))))))))))))))
.

2010-03-01 19:51 . 2010-03-01 22:13 -------- d-----w- c:\windows\LastGood
2010-03-01 16:38 . 2008-04-14 12:00 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-02-27 00:20 . 2010-03-01 16:45 -------- d-----w- c:\documents and settings\El Conquistador\Tracing
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Microsoft
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-27 00:15 . 2010-02-27 00:15 -------- d-----w- c:\program files\Windows Live
2010-02-27 00:11 . 2010-02-27 00:11 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-26 02:28 . 2010-02-26 02:28 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Free Audio Editor
2010-02-26 02:27 . 2005-02-24 16:51 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2010-02-26 02:27 . 2005-05-18 16:52 1212416 ----a-w- c:\windows\system32\NCTAudioInformation2.dll
2010-02-26 02:27 . 2005-05-17 17:37 1986560 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2010-02-26 02:27 . 2005-04-25 18:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-02-26 02:27 . 2005-04-15 17:08 880640 ----a-w- c:\windows\system32\NCTAudioEditor2.dll
2010-02-26 02:27 . 2005-04-04 22:21 602112 ----a-w- c:\windows\system32\NCTAudioTransform2.dll
2010-02-26 02:27 . 2005-03-28 20:54 479232 ----a-w- c:\windows\system32\NCTAudioVisualization2.dll
2010-02-26 02:27 . 2005-03-28 20:52 417792 ----a-w- c:\windows\system32\NCTTextToAudio2.dll
2010-02-26 02:27 . 2004-11-04 18:31 835584 ----a-w- c:\windows\system32\NCTAudioCDGrabber2.dll
2010-02-26 02:27 . 2010-02-26 02:28 -------- d-----w- c:\program files\Free Audio Editor
2010-02-26 02:27 . 2002-01-05 21:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-25 20:07 . 2010-02-25 20:07 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-02-23 02:04 . 2010-02-23 02:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-22 04:29 . 2010-02-22 04:29 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-02-21 22:36 . 2010-02-21 22:36 -------- d-----w- c:\program files\ERUNT
2010-02-21 21:05 . 2010-02-21 21:05 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-21 20:17 . 2010-02-21 20:17 -------- d-sh--w- c:\documents and settings\El Conquistador\IETldCache
2010-02-21 20:12 . 2010-02-21 20:13 -------- dc-h--w- c:\windows\ie8
2010-02-21 16:50 . 2010-02-21 16:50 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-02-21 14:13 . 2010-02-21 14:13 -------- d-sh--w- c:\documents and settings\NetworkService\UserData
2010-02-21 13:40 . 2010-02-21 13:41 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-21 03:06 . 2010-02-21 03:06 -------- d-----w- c:\program files\Common Files\DivX Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 17:01 . 2009-12-22 04:58 14392006 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-03-01 05:58 . 2008-09-25 03:56 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Azureus
2010-02-28 20:26 . 2008-12-21 00:45 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-28 20:23 . 2010-02-28 20:36 1735168 ----a-w- c:\windows\Internet Logs\xDB7E.tmp
2010-02-28 20:23 . 2010-02-28 20:36 1594368 ----a-w- c:\windows\Internet Logs\xDB7D.tmp
2010-02-28 17:47 . 2009-02-26 04:13 -------- d-----w- c:\program files\MPlayer for Windows
2010-02-27 09:48 . 2009-01-20 05:45 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 00:16 . 2008-09-24 23:05 12912 ----a-w- c:\documents and settings\El Conquistador\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-21 20:16 . 2008-11-11 04:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-21 19:28 . 2008-11-11 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-21 19:27 . 2008-09-24 21:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\SUPERAntiSpyware.com
2010-02-21 19:25 . 2009-01-20 05:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-21 19:25 . 2009-11-29 00:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-21 03:14 . 2010-02-21 03:56 1703424 ----a-w- c:\windows\Internet Logs\xDBDD.tmp
2010-02-21 03:14 . 2010-02-21 03:56 4171776 ----a-w- c:\windows\Internet Logs\xDBDC.tmp
2010-02-21 03:07 . 2008-09-24 23:59 -------- d-----w- c:\program files\DivX
2010-02-21 03:04 . 2008-09-24 23:46 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Apple Computer
2010-02-18 22:53 . 2009-12-30 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-04 20:20 . 2009-11-28 20:20 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-04 20:20 . 2009-11-28 20:20 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-04 20:20 . 2009-11-28 20:20 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-04 20:20 . 2009-11-28 20:20 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-26 06:20 . 2010-01-26 06:48 1688064 ----a-w- c:\windows\Internet Logs\xDB83.tmp
2010-01-22 18:26 . 2010-01-22 18:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 22:18 . 2009-01-20 22:47 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\Move Networks
2010-01-19 20:13 . 2010-01-19 20:13 144160 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\uninstall.exe
2010-01-19 20:13 . 2009-12-07 01:22 5603776 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
2010-01-10 12:07 . 2010-01-10 12:22 3694592 ----a-w- c:\windows\Internet Logs\xDB7F.tmp
2010-01-07 21:07 . 2010-01-22 18:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2010-01-22 18:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 14:29 . 2009-12-16 14:24 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2010-01-02 19:46 . 2008-09-29 22:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\documents and settings\El Conquistador\Application Data\IObit
2010-01-02 19:32 . 2010-01-02 19:32 -------- d-----w- c:\program files\IObit
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-30 17:01 . 2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-30 17:01 . 2009-12-30 17:01 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-30 17:01 . 2009-12-30 17:01 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-30 17:01 . 2009-12-30 17:01 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-26 01:20 . 2009-12-30 05:11 8704 ----a-w- c:\windows\Internet Logs\xDB5.tmp
2009-12-22 04:32 . 2009-11-29 03:07 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-22 04:31 . 2009-12-22 04:31 152576 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-22 04:31 . 2009-12-22 04:31 79488 ----a-w- c:\documents and settings\El Conquistador\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-22 04:03 . 2009-12-22 04:03 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-12-16 18:43 . 2008-09-24 06:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-07 01:22 . 2009-12-07 01:22 97216 ----a-w- c:\documents and settings\El Conquistador\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-12-04 18:22 . 2008-04-14 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-27_23.08.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-01 16:43 . 2010-03-01 16:43 16384 c:\windows\Temp\Perflib_Perfdata_154.dat
+ 2010-03-01 22:12 . 2010-03-01 22:13 3798 c:\windows\SoftwareDistribution\EventCache\{4EABDDC2-0B7E-49BE-8A5A-43567BD47D7E}.bin
+ 2008-12-21 17:57 . 2009-08-07 00:23 215920 c:\windows\system32\muweb.dll
+ 2008-12-21 17:57 . 2009-08-07 00:23 274288 c:\windows\system32\mucltui.dll
+ 2010-03-01 19:51 . 2008-10-16 19:06 208744 c:\windows\LastGood\system32\muweb.dll
+ 2010-03-01 19:51 . 2008-10-16 19:06 268648 c:\windows\LastGood\system32\mucltui.dll
+ 2010-02-28 15:04 . 2010-02-28 15:04 2317312 c:\windows\Installer\34e4226.msi
+ 2010-02-28 15:05 . 2010-02-28 15:05 15709696 c:\windows\Installer\34e4235.msp
+ 2009-08-18 04:15 . 2009-08-18 04:15 10380800 c:\windows\Installer\34e422d.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-12-26 2335952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-10 188416]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1970176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"nwiz"="nwiz.exe" [2009-02-18 1657376]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-21 185896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-22 149280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-30 17:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\MATLAB701\\bin\\win32\\MATLAB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/28/2009 3:20 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/30/2009 12:01 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/30/2009 12:01 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [12/30/2009 12:01 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/30/2009 12:01 PM 285392]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1181328]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 15:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 20:20]

2010-03-01 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Move Networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\El Conquistador\Application Data\Mozilla\Firefox\Profiles\dmu9215x.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-8461-7759-5462-8226 - c:\program files\Vuze\uninstall.exe



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
Completion time: 2010-03-01 17:19:57
ComboFix-quarantined-files.txt 2010-03-01 22:19
ComboFix2.txt 2010-03-01 17:04
ComboFix3.txt 2010-02-27 23:13

Pre-Run: 56,983,855,104 bytes free
Post-Run: 56,942,379,008 bytes free

- - End Of File - - 9DA4E98C6DED466F235E81FCC6EE878C
Upload was successful
 
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 1, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, March 01, 2010 18:08:38
Records in database: 3676148
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 149783
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 01:32:29


File name / Threat / Threats count
C:\Qoobox\Quarantine\[4]-Submit_2010-03-01_17.15.58.zip Infected: Rootkit.Win32.TDSS.y 1

Selected area has been scanned.
 
You must log in or register to reply here.
Back
Top