Black_Cat

Help with Google Redirect and getting dds to run

30 posts in this topic

Hello,

I recently got hit with the ZeroAccess rootkit and it seems to be gone after running Malware/Avira/Spybot but I still have the Google Redirect issue along with audio ads playing in the background. I tried the methods used in the FAQ topic but no luck.

So here I am asking for help however I can't seem to get the dds.scr tool to run as mentioned in this topic. Any help would be greatly appreciated.

Share this post


Link to post
Share on other sites

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us


  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

    [*]Please do not attach logs or use code boxes, just copy and paste the text.

    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.

    [*]Please read every post completely before doing anything.

    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

    [*]Please provide feedback about your experience as we go.

    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

The next thing I would like you to do is run this for me - http://download.bleepingcomputer.com/grinler/unhide.exe after it is complete restart the computer and continue with these steps

Security Check

  • Download Security Check by screen317 from
here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Under the Custom Scan box paste this in

    %TEMP%\smtmp\*.* /s


  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened and the that I need posted back here
    • Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later

    [*]Please post the contents of OTListIt.txt in your next reply.

information and logs:

  • In your next post I need the following
  1. .logs from OTL
  2. let me know of any problems you may have had

Gringo

Share this post


Link to post
Share on other sites

The computer has a bit of a lag (few seconds of black screen before 'welcome' screen) when booting up Windows. Also got a random dialogue box pop-up from Internet Explorer despite not using the program.

Okay here we go, Security Check log:

Results of screen317's Security Check version 0.99.42

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Avira Free Antivirus

Avira successfully updated!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.61.0.1400

JavaFX 2.1.1

Java 7 Update 5

Adobe Flash Player 11.3.300.257

Adobe Reader 8 Adobe Reader out of Date!

Mozilla Firefox (9.0.1)

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Avira Antivir avgnt.exe

Avira Antivir avguard.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 11% Defragment your hard drive soon!

````````````````````End of Log``````````````````````

OTL log:

OTL logfile created on: 6/20/2012 12:56:49 AM - Run 1

OTL by OldTimer - Version 3.2.50.0 Folder = C:\Documents and Settings\Marcia\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.74% Memory free

3.84 Gb Paging File | 2.95 Gb Available in Paging File | 76.93% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 294.73 Gb Total Space | 211.30 Gb Free Space | 71.69% Space Free | Partition Type: NTFS

Computer Name: D97VW0G1 | User Name: Marcia | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Marcia\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()

PRC - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)

PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)

PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

PRC - C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe ()

PRC - C:\WINDOWS\system32\dlcxcoms.exe ( )

PRC - C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe (Corel, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()

MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\2516a49d10f4418f72e1c25f691815a8\System.ServiceProcess.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\54d61af44b1dedee6aea0d1bbc46b13a\System.Windows.Forms.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\4a668799513e369a54fdab8b3f74de92\System.Drawing.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\0f9d7198d2c0a3953fb59b1aca0d35f7\System.Runtime.Remoting.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\26ee061618887d629a9f7072970ffb85\System.EnterpriseServices.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\ce2aa3a5e89c326055ac8e2a309232f7\System.Transactions.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\9f5111b0b58258c3a4bbcfb8bf27374c\System.Data.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\0c8e950df17a0abec10888e8ad966cbe\System.Configuration.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\14ba6251d6ec84c9579ed3d3e10b30c1\System.Core.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\5ee8bf77e7b3e25cdbff6e1c299574fe\System.Xml.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\6f399163bb35597da7141ccdb7f39d16\System.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll ()

MOD - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe ()

MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\dlcxdrpp.dll ()

MOD - C:\Program Files\Dell PC Fax\dlctrstr.dll ()

MOD - C:\WINDOWS\system32\DLPRMON.DLL ()

MOD - C:\Program Files\Dell PC Fax\ipcmt.dll ()

MOD - C:\WINDOWS\system32\dlcxcaps.dll ()

MOD - C:\WINDOWS\system32\DLCXcfg.dll ()

MOD - C:\Program Files\Dell Photo AIO Printer 926\DLCXcfg.dll ()

MOD - C:\WINDOWS\system32\dlcxdrs.dll ()

MOD - C:\Program Files\Dell Photo AIO Printer 926\dlcxscw.dll ()

MOD - C:\WINDOWS\system32\dlcxcnv4.dll ()

MOD - C:\Program Files\Dell Photo AIO Printer 926\dlcxdrec.dll ()

========== Win32 Services (SafeList) ==========

SRV - (WinDefend) -- %ProgramFiles%\Windows Defender\mpsvc.dll File not found

SRV - (Viewpoint Manager Service) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe File not found

SRV - (TmPfw) -- C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe File not found

SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter File not found

SRV - (PcCtlCom) -- C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe File not found

SRV - (IntuitUpdateService) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe File not found

SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found

SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found

SRV - (AOL ACS) -- C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe File not found

SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (Web Assistant Updater) -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()

SRV - (JavaQuickStarterService) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe (Oracle Corporation)

SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (IntuitUpdateServiceV4) -- C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)

SRV - (dlcx_device) -- C:\WINDOWS\system32\dlcxcoms.exe ( )

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found

DRV - (PDRFRAME) -- File not found

DRV - (PDRELI) -- File not found

DRV - (PDFRAME) -- File not found

DRV - (PDCOMP) -- File not found

DRV - (PCIDump) -- File not found

DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys File not found

DRV - (lbrtfdc) -- File not found

DRV - (Lbd) -- system32\DRIVERS\Lbd.sys File not found

DRV - (Changer) -- File not found

DRV - (catchme) -- C:\ComboFix\catchme.sys File not found

DRV - (aec) -- system32\drivers\aec.sys File not found

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)

DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)

DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)

DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080409

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080409

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080409

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.viewpoint.com/landing/v38a.html

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080409

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.viewpoint.com/landing/v38a.html

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=LMW2&o=16046&src=crm&q={searchTerms}&locale=en_US

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes\{ABDB1A03-D606-4804-995F-809DE735D5A4}: "URL" = https://www.mypoints.com/emp/u/mysearch.vm?st=mypWeb&fctb.tb=1&q={searchTerms}

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes\{BBA5B323-B0F7-49D6-9D9D-A9CF8CE6F44C}: "URL" = http://www.ask.com/web?o=14120&l=dis&q={searchTerms}

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\SearchScopes\VWPT: "URL" = http://search.viewpoint.com/pl/search?tab=1&k={searchTerms}&addr=1&query=vb=1%26tn%3D0%26addr%3D1%26type%3Drel39%5fxp%26instid%3DViewpointV39%5fxp

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:home"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7

FF - prefs.js..extensions.enabledItems: {51ef49d2-624b-4194-8b97-1c468e9b0efe}:1.300.306

FF - prefs.js..extensions.enabledItems: {71724C97-9902-4A2B-A50F-9894800B7086}:1.9.1

FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590

FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb165/?loc=IB_DS&a=6R8vOK9bbx&&i=26&search="

FF - prefs.js..network.proxy.http: "localhost"

FF - prefs.js..network.proxy.http_port: 8095

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Marcia\Application Data\Move Networks\plugins\npqmp071503000010.dll (Move Networks)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\MozillaPlugins\@worldwinner.com/Launcher2,version=1.9.0.23: C:\Program Files\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll (WorldWinner.com, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Documents and Settings\Marcia\Application Data\Facebook\npfbplugin_1_0_1.dll ( )

FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Marcia\Application Data\Move Networks\plugins\npqmp071503000010.dll (Move Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/06/12 19:04:35 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/18 19:53:47 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/15 18:14:36 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Documents and Settings\Marcia\Application Data\Move Networks [2009/10/01 21:02:36 | 000,000,000 | ---D | M]

[2009/03/30 22:57:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Extensions

[2009/03/22 09:29:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Extensions\mozswing@mozswing.org

[2012/06/18 19:54:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\extensions

[2011/09/25 01:04:55 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

[2012/05/24 06:47:38 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\extensions\toolbar@ask.com

[2012/04/27 08:21:58 | 000,002,414 | ---- | M] () -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\searchplugins\askcom.xml

[2012/06/12 19:04:31 | 000,002,203 | ---- | M] () -- C:\Documents and Settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\searchplugins\MyStart Search.xml

[2012/01/11 03:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012/01/06 08:27:53 | 000,634,964 | ---- | M] () (No name found) -- C:\DOCUMENTS AND SETTINGS\MARCIA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\Z3KWVTO7.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012/06/12 19:04:35 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX

[2012/06/18 19:53:44 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011/09/24 20:35:20 | 000,611,224 | ---- | M] (Oracle Corporation) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2009/06/22 20:17:50 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\mozilla firefox\plugins\NPTURNMED.dll

[2007/04/16 13:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npViewpoint.dll

[2012/06/18 19:53:36 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/06/18 19:53:36 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

Hosts file not found

O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()

O2 - BHO: (Freecause Toolbar BHO) - {614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A} - C:\Program Files\MyPoints Toolbar 2.0\Toolbar.dll ()

O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - Reg Error: Value error. File not found

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)

O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File not found

O3 - HKLM\..\Toolbar: (MyPoints Toolbar 2.0) - {89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - C:\Program Files\MyPoints Toolbar 2.0\Toolbar.dll ()

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKLM\..\Toolbar: (Viewpoint Toolbar) - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll (Viewpoint Corporation)

O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - Reg Error: Value error. File not found

O3 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.

O3 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\Toolbar\WebBrowser: (MyPoints Toolbar 2.0) - {89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - C:\Program Files\MyPoints Toolbar 2.0\Toolbar.dll ()

O3 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (America Online, Inc)

O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe (Corel, Inc.)

O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [DLCXCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.DLL ()

O4 - HKLM..\Run: [dlcxmon.exe] C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe ()

O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )

O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Dell PC Fax\fm3032.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell Photo AIO Printer 926\memcard.exe ()

O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Bonjour\mdnsNSP.dll File not found

O15 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)

O15 - HKU\S-1-5-21-1832132436-1392349311-2145066133-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)

O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab (FunGamesLoader Object)

O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} http://www.worldwinner.com/games/v48/brickout/brickout.cab (Brickout Control)

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)

O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} http://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab (SpiderSolitaire Control)

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)

O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} http://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab (WorldWinner ActiveX Launcher Control)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} http://www.worldwinner.com/games/v57/cubis/cubis.cab (Cubis Control)

O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} http://www.worldwinner.com/games/v42/tilecity/tilecity.cab (Tilecity Control)

O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} http://www.worldwinner.com/games/v52/dinerdash/dinerdash.cab (DinerDash Control)

O16 - DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} http://www.worldwinner.com/games/v44/golfsol/golfsol.cab (GolfSol Control)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 167.206.254.2 167.206.254.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{12F80852-5DE4-43F9-8BC1-590548BDBC1C}: DhcpNameServer = 167.206.254.2 167.206.254.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\dell.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\dell.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/20 00:38:12 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcia\Desktop\OTL.exe

[2012/06/19 01:33:31 | 002,127,960 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marcia\Desktop\tdsskiller.exe

[2012/06/18 22:51:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012/06/18 19:54:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Mozilla

[2012/06/18 19:54:04 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service

[2012/06/17 18:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Application Data\Avira

[2012/06/17 18:18:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira

[2012/06/17 18:17:43 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2012/06/17 18:17:36 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2012/06/17 18:17:36 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2012/06/17 18:17:36 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys

[2012/06/17 18:17:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira

[2012/06/17 11:21:25 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Marcia\Desktop\dds.com

[2012/06/16 19:04:37 | 000,000,000 | --SD | C] -- C:\ComboFix

[2012/06/16 18:58:42 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Marcia\Desktop\dds.scr

[2012/06/16 15:51:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/06/16 15:51:34 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012/06/16 15:43:45 | 010,062,736 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Marcia\Desktop\mbam-consumer.exe

[2012/06/16 01:59:43 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Marcia\Desktop\mbam-setup-1.61.0.1400.exe

[2012/06/16 01:53:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Desktop\MM_Logo

[2012/06/15 18:19:01 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll

[2012/06/15 05:04:53 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle

[2012/06/15 05:04:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Application Data\Oracle

[2012/06/15 05:04:20 | 000,772,504 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll

[2012/06/15 05:04:20 | 000,227,720 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe

[2012/06/15 05:04:20 | 000,143,872 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl

[2012/06/15 05:04:03 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe

[2012/06/15 05:04:03 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe

[2012/06/15 02:29:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Start Menu\Programs\Roxio Creator DE

[2012/06/15 02:04:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\My Documents\Backup_Documents

[2012/06/15 01:36:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}

[2012/06/15 01:09:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Application Data\Uniblue

[2012/06/15 01:08:52 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue

[2012/06/15 01:08:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Local Settings\Application Data\PackageAware

[2012/06/14 04:08:17 | 004,140,192 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe

[2012/06/14 03:47:32 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2012/06/12 19:04:35 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant

[2012/06/10 20:27:21 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Marcia\Recent

[2012/06/10 01:16:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marcia\Desktop\Coby Music

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/20 01:08:16 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012/06/20 01:06:01 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

[2012/06/20 00:38:12 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcia\Desktop\OTL.exe

[2012/06/20 00:37:19 | 000,881,475 | ---- | M] () -- C:\Documents and Settings\Marcia\Desktop\SecurityCheck.exe

[2012/06/20 00:30:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/06/20 00:30:02 | 2136,129,536 | -HS- | M] () -- C:\hiberfil.sys

[2012/06/19 01:33:31 | 002,127,960 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marcia\Desktop\tdsskiller.exe

[2012/06/18 23:10:08 | 000,294,400 | ---- | M] () -- C:\Documents and Settings\Marcia\Desktop\exeHelper.com

[2012/06/18 19:18:15 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2012/06/18 19:18:15 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys

[2012/06/18 18:48:02 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2012/06/17 18:18:48 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk

[2012/06/17 16:15:52 | 000,073,216 | ---- | M] () -- C:\Documents and Settings\Marcia\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012/06/17 11:21:22 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Marcia\Desktop\dds.com

[2012/06/16 18:58:36 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Marcia\Desktop\dds.scr

[2012/06/16 16:00:04 | 000,030,845 | ---- | M] () -- C:\Documents and Settings\Marcia\My Documents\BKD-7362479384.pdf

[2012/06/16 15:51:47 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/16 15:43:52 | 010,062,736 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Marcia\Desktop\mbam-consumer.exe

[2012/06/16 02:00:01 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Marcia\Desktop\mbam-setup-1.61.0.1400.exe

[2012/06/16 01:55:54 | 001,012,656 | ---- | M] () -- C:\Documents and Settings\Marcia\Desktop\rkill.exe

[2012/06/15 22:02:38 | 000,190,592 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/06/15 22:00:16 | 000,484,684 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012/06/15 22:00:16 | 000,081,292 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012/06/15 21:35:30 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012/06/15 05:03:26 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe

[2012/06/15 05:03:26 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe

[2012/06/15 04:43:20 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2012/06/15 04:43:19 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2012/06/14 04:29:43 | 000,000,739 | ---- | M] () -- C:\WINDOWS\wininit.ini

[2012/06/14 04:08:19 | 004,140,192 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe

[2012/06/14 03:41:18 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2012/06/13 03:48:23 | 000,000,905 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100425-220829.backup

[2012/06/12 19:04:50 | 000,000,795 | ---- | M] () -- C:\user.js

[2012/06/07 21:45:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2012/05/31 17:37:48 | 000,009,036 | ---- | M] () -- C:\Documents and Settings\Marcia\Application Data\wklnhst.dat

[2012/05/31 09:22:09 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/20 00:37:19 | 000,881,475 | ---- | C] () -- C:\Documents and Settings\Marcia\Desktop\SecurityCheck.exe

[2012/06/19 21:03:45 | 2136,129,536 | -HS- | C] () -- C:\hiberfil.sys

[2012/06/18 23:10:10 | 000,294,400 | ---- | C] () -- C:\Documents and Settings\Marcia\Desktop\exeHelper.com

[2012/06/17 18:18:48 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk

[2012/06/16 16:00:04 | 000,030,845 | ---- | C] () -- C:\Documents and Settings\Marcia\My Documents\BKD-7362479384.pdf

[2012/06/16 15:51:47 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/16 01:56:04 | 001,012,656 | ---- | C] () -- C:\Documents and Settings\Marcia\Desktop\rkill.exe

[2012/06/14 03:47:39 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012/06/12 19:04:46 | 000,000,795 | ---- | C] () -- C:\user.js

[2012/06/10 21:07:10 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2012/02/15 08:09:48 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012/02/04 06:35:30 | 001,588,945 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1832132436-1392349311-2145066133-1006-0.dat

[2012/01/28 05:01:38 | 000,203,882 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat

[2012/01/27 12:51:35 | 000,000,590 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc

[2011/12/31 03:04:31 | 000,532,480 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcxcoms.exe

[2011/05/03 12:36:26 | 000,019,942 | -HS- | C] () -- C:\Documents and Settings\Marcia\Local Settings\Application Data\02dvu33p3g64bf31052bjgpyk03

[2011/05/03 12:36:26 | 000,019,942 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\02dvu33p3g64bf31052bjgpyk03

[2011/04/08 17:11:54 | 000,016,002 | -HS- | C] () -- C:\Documents and Settings\Marcia\Local Settings\Application Data\7n61qsjgrs7rjc3tv5ki58o

[2011/04/08 17:11:54 | 000,016,002 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\7n61qsjgrs7rjc3tv5ki58o

[2011/04/06 23:08:41 | 000,016,972 | -HS- | C] () -- C:\Documents and Settings\Marcia\Local Settings\Application Data\7t6x52h50cstg1toju2u5v6hy41tk1056886rx

[2011/04/06 23:08:41 | 000,016,972 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\7t6x52h50cstg1toju2u5v6hy41tk1056886rx

[2011/03/16 18:13:54 | 000,020,592 | -HS- | C] () -- C:\Documents and Settings\Marcia\Local Settings\Application Data\3373148944

[2011/03/16 18:13:54 | 000,020,592 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\3373148944

[2010/12/09 19:46:35 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2010/12/09 01:26:09 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\Effects

[2010/12/09 01:26:09 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\Marcia\Application Data\Drum Kits

[2010/12/09 01:26:09 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLck.DAT

[2010/12/09 01:26:07 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\All Users\Application Data\Electric Clav

[2010/12/09 01:26:07 | 000,000,268 | R--- | C] () -- C:\Documents and Settings\Marcia\Application Data\Drums

[2010/12/09 01:20:28 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLbx.DAT

[2010/09/04 05:47:34 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Uqumoh.dat

[2010/09/04 05:47:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Ubiciseyitegig.bin

[2010/09/04 01:18:31 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Marcia\Application Data\hngmfc.dat

[2010/09/03 20:04:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\qrudmppuf.sys

[2010/09/03 19:57:26 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\hngmfc.dat

[2009/02/03 09:08:46 | 000,002,048 | -HS- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\{b9e97c10-449e-db4d-030d-0026d5a6f3d6}\@

========== Custom Scans ==========

<

%TEMP%\smtmp\*.* /s

>

Invalid Switch: indent]

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\rundll32.exe:SummaryInformation

< End of report >

Share this post


Link to post
Share on other sites

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

Share this post


Link to post
Share on other sites

Alright, Combofix keeps freezing on me. It finds the rootkit ZeroAccess(first dialogue box) but stops a few minutes after the second dialogue box comes up saying that it'll "take some moments".

During the first attempt there was a random IE pop-up which would return if closed. It reads:"Would you like to leave this webpage. Are you shure?" And for some reason DDS popped up and was trying to run; don't know if that's just a serious delay from an earlier attempt or if I clicked it by accident.

Share this post


Link to post
Share on other sites

Also note there were no pop-ups during the second attempt (possibly because I disconnected the internet all together). And something I forgot to mention before is that the Welcome screen when windows starts kind of flashes by real quick. Which is odd, since I'm used to it loading for a few seconds at least. Don't know if that means anything.

Share this post


Link to post
Share on other sites

Hello

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

Share this post


Link to post
Share on other sites

I'm getting a warning from Combofix saying that Avira Desktop is running. Which is odd because it's not suppose to be running in Safe Mode. Should I proceed anyway?

Share this post


Link to post
Share on other sites

Unfortunately the same freezing problem occurs. Combofix mentions finding ZeroAccess and then says it may take some time. After a few minutes the cursor in Combofix window stops flashing, computer clock stops and while the mouse is movable nothing works when I click on things. Forcing me to manually reboot.

Share this post


Link to post
Share on other sites

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

  • Double click the aswMBR.exe icon to run it
  • it will ask to download extra definitions - ALLOW IT
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

Share this post


Link to post
Share on other sites

Tdsskiller will not run. Should I go ahead and run the aswMBR in the mean time?

Share this post


Link to post
Share on other sites

Hello

I would like you to run this tool for me - fixTDSS

download it to your desktop and start the program

Follow the prompts and Ok any security prompts

when it is complete it will say the infection was cleared or no infection was found - let me know what it says

after it is complete I want you to restart the computer and try to rerun TDSSKiller for me and send me the report

Gringo

Share this post


Link to post
Share on other sites

fixTDSS result said the MBR was infected. It's been repaired.

TDSS report:

21:34:22.0234 2296 TDSS rootkit removing tool 2.7.40.0 Jun 15 2012 15:13:31

21:34:22.0609 2296 ============================================================

21:34:22.0609 2296 Current date / time: 2012/06/20 21:34:22.0609

21:34:22.0609 2296 SystemInfo:

21:34:22.0609 2296

21:34:22.0609 2296 OS Version: 5.1.2600 ServicePack: 3.0

21:34:22.0609 2296 Product type: Workstation

21:34:22.0609 2296 ComputerName: D97VW0G1

21:34:22.0609 2296 UserName: Marcia

21:34:22.0609 2296 Windows directory: C:\WINDOWS

21:34:22.0609 2296 System windows directory: C:\WINDOWS

21:34:22.0625 2296 Processor architecture: Intel x86

21:34:22.0625 2296 Number of processors: 2

21:34:22.0625 2296 Page size: 0x1000

21:34:22.0625 2296 Boot type: Normal boot

21:34:22.0625 2296 ============================================================

21:34:29.0109 2296 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

21:34:29.0109 2296 ============================================================

21:34:29.0109 2296 \Device\Harddisk0\DR0:

21:34:29.0109 2296 MBR partitions:

21:34:29.0109 2296 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x17886, BlocksNum 0x24D7788B

21:34:29.0109 2296 ============================================================

21:34:29.0156 2296 C: <-> \Device\Harddisk0\DR0\Partition0

21:34:29.0296 2296 ============================================================

21:34:29.0296 2296 Initialize success

21:34:29.0296 2296 ============================================================

21:35:42.0640 2380 ============================================================

21:35:42.0640 2380 Scan started

21:35:42.0640 2380 Mode: Manual;

21:35:42.0640 2380 ============================================================

21:35:44.0468 2380 Abiosdsk - ok

21:35:44.0515 2380 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS

21:35:44.0531 2380 abp480n5 - ok

21:35:44.0625 2380 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

21:35:44.0671 2380 ACPI - ok

21:35:44.0828 2380 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

21:35:44.0828 2380 ACPIEC - ok

21:35:45.0015 2380 AdobeFlashPlayerUpdateSvc (f3cd7b20b27d1772c946df993ff3635c) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

21:35:45.0093 2380 AdobeFlashPlayerUpdateSvc - ok

21:35:45.0140 2380 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys

21:35:45.0187 2380 adpu160m - ok

21:35:45.0203 2380 aec - ok

21:35:45.0312 2380 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

21:35:45.0343 2380 AFD - ok

21:35:45.0375 2380 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

21:35:45.0390 2380 agp440 - ok

21:35:45.0421 2380 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys

21:35:45.0437 2380 agpCPQ - ok

21:35:45.0453 2380 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys

21:35:45.0453 2380 Aha154x - ok

21:35:45.0484 2380 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys

21:35:45.0500 2380 aic78u2 - ok

21:35:45.0531 2380 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys

21:35:45.0546 2380 aic78xx - ok

21:35:45.0578 2380 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

21:35:45.0593 2380 Alerter - ok

21:35:45.0640 2380 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

21:35:45.0656 2380 ALG - ok

21:35:45.0796 2380 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys

21:35:45.0796 2380 AliIde - ok

21:35:45.0843 2380 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys

21:35:45.0859 2380 alim1541 - ok

21:35:45.0875 2380 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys

21:35:45.0890 2380 amdagp - ok

21:35:45.0906 2380 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys

21:35:45.0906 2380 amsint - ok

21:35:46.0109 2380 AntiVirSchedulerService (0a1cc583e8147004e4ad4625d7fbf88c) C:\Program Files\Avira\AntiVir Desktop\sched.exe

21:35:46.0109 2380 AntiVirSchedulerService - ok

21:35:46.0156 2380 AntiVirService (c9a36ef935aced86aedf93e97e606911) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

21:35:46.0156 2380 AntiVirService - ok

21:35:46.0187 2380 AOL ACS - ok

21:35:46.0250 2380 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

21:35:46.0250 2380 Apple Mobile Device - ok

21:35:46.0250 2380 AppMgmt - ok

21:35:46.0265 2380 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys

21:35:46.0281 2380 asc - ok

21:35:46.0328 2380 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys

21:35:46.0328 2380 asc3350p - ok

21:35:46.0343 2380 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys

21:35:46.0343 2380 asc3550 - ok

21:35:46.0406 2380 ASCTRM (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys

21:35:46.0406 2380 ASCTRM - ok

21:35:46.0531 2380 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

21:35:46.0531 2380 aspnet_state - ok

21:35:46.0546 2380 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

21:35:46.0562 2380 AsyncMac - ok

21:35:46.0609 2380 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

21:35:46.0609 2380 atapi - ok

21:35:46.0640 2380 Atdisk - ok

21:35:46.0656 2380 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

21:35:46.0671 2380 Atmarpc - ok

21:35:46.0843 2380 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

21:35:46.0859 2380 AudioSrv - ok

21:35:46.0875 2380 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

21:35:46.0875 2380 audstub - ok

21:35:46.0921 2380 avgntflt (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

21:35:46.0921 2380 avgntflt - ok

21:35:46.0984 2380 avipbb (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys

21:35:46.0984 2380 avipbb - ok

21:35:47.0015 2380 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys

21:35:47.0015 2380 avkmgr - ok

21:35:47.0062 2380 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

21:35:47.0062 2380 Beep - ok

21:35:47.0203 2380 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

21:35:47.0234 2380 BITS - ok

21:35:47.0406 2380 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe

21:35:47.0406 2380 Bonjour Service - ok

21:35:47.0468 2380 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

21:35:47.0500 2380 Browser - ok

21:35:47.0593 2380 catchme - ok

21:35:47.0625 2380 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys

21:35:47.0625 2380 cbidf - ok

21:35:47.0625 2380 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

21:35:47.0625 2380 cbidf2k - ok

21:35:47.0671 2380 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

21:35:47.0796 2380 CCDECODE - ok

21:35:47.0812 2380 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys

21:35:47.0812 2380 cd20xrnt - ok

21:35:47.0859 2380 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

21:35:47.0875 2380 Cdaudio - ok

21:35:47.0906 2380 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

21:35:47.0921 2380 Cdfs - ok

21:35:47.0984 2380 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys

21:35:48.0000 2380 Cdrom - ok

21:35:48.0000 2380 Changer - ok

21:35:48.0031 2380 cisvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

21:35:48.0031 2380 cisvc - ok

21:35:48.0062 2380 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

21:35:48.0078 2380 ClipSrv - ok

21:35:48.0203 2380 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

21:35:48.0234 2380 clr_optimization_v2.0.50727_32 - ok

21:35:48.0328 2380 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

21:35:48.0328 2380 clr_optimization_v4.0.30319_32 - ok

21:35:48.0343 2380 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys

21:35:48.0343 2380 CmdIde - ok

21:35:48.0359 2380 COMSysApp - ok

21:35:48.0375 2380 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys

21:35:48.0375 2380 Cpqarray - ok

21:35:48.0421 2380 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

21:35:48.0453 2380 CryptSvc - ok

21:35:48.0515 2380 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys

21:35:48.0562 2380 dac2w2k - ok

21:35:48.0578 2380 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys

21:35:48.0578 2380 dac960nt - ok

21:35:48.0875 2380 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

21:35:48.0906 2380 DcomLaunch - ok

21:35:48.0968 2380 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

21:35:49.0000 2380 Dhcp - ok

21:35:49.0046 2380 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

21:35:49.0046 2380 Disk - ok

21:35:49.0062 2380 dlcx_device - ok

21:35:49.0062 2380 dmadmin - ok

21:35:49.0328 2380 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

21:35:49.0593 2380 dmboot - ok

21:35:49.0656 2380 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

21:35:49.0812 2380 dmio - ok

21:35:49.0859 2380 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

21:35:49.0859 2380 dmload - ok

21:35:49.0906 2380 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

21:35:49.0921 2380 dmserver - ok

21:35:49.0953 2380 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

21:35:49.0968 2380 DMusic - ok

21:35:50.0015 2380 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

21:35:50.0031 2380 Dnscache - ok

21:35:50.0125 2380 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

21:35:50.0156 2380 Dot3svc - ok

21:35:50.0187 2380 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys

21:35:50.0203 2380 dpti2o - ok

21:35:50.0234 2380 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

21:35:50.0234 2380 drmkaud - ok

21:35:50.0265 2380 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys

21:35:50.0312 2380 E100B - ok

21:35:50.0390 2380 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys

21:35:50.0390 2380 e1express - ok

21:35:50.0437 2380 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

21:35:50.0453 2380 EapHost - ok

21:35:50.0484 2380 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

21:35:50.0484 2380 ERSvc - ok

21:35:50.0562 2380 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

21:35:50.0562 2380 Eventlog - ok

21:35:50.0671 2380 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

21:35:50.0859 2380 EventSystem - ok

21:35:50.0921 2380 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

21:35:50.0968 2380 Fastfat - ok

21:35:51.0062 2380 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

21:35:51.0093 2380 FastUserSwitchingCompatibility - ok

21:35:51.0234 2380 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe

21:35:51.0234 2380 Fax - ok

21:35:51.0250 2380 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

21:35:51.0265 2380 Fdc - ok

21:35:51.0281 2380 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

21:35:51.0281 2380 Fips - ok

21:35:51.0296 2380 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

21:35:51.0296 2380 Flpydisk - ok

21:35:51.0359 2380 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

21:35:51.0390 2380 FltMgr - ok

21:35:51.0562 2380 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

21:35:51.0578 2380 FontCache3.0.0.0 - ok

21:35:51.0625 2380 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

21:35:51.0640 2380 Fs_Rec - ok

21:35:51.0671 2380 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

21:35:51.0828 2380 Ftdisk - ok

21:35:51.0859 2380 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

21:35:51.0859 2380 GEARAspiWDM - ok

21:35:51.0906 2380 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

21:35:51.0906 2380 Gpc - ok

21:35:51.0968 2380 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

21:35:51.0968 2380 HDAudBus - ok

21:35:52.0015 2380 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

21:35:52.0015 2380 helpsvc - ok

21:35:52.0031 2380 HidServ - ok

21:35:52.0062 2380 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

21:35:52.0062 2380 HidUsb - ok

21:35:52.0140 2380 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

21:35:52.0156 2380 hkmsvc - ok

21:35:52.0218 2380 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys

21:35:52.0218 2380 hpn - ok

21:35:52.0312 2380 HSFHWBS2 (77e4ff0b73bc0aeaaf39bf0c8104231f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys

21:35:52.0375 2380 HSFHWBS2 - ok

21:35:52.0859 2380 HSF_DP (60e1604729a15ef4a3b05f298427b3b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

21:35:53.0156 2380 HSF_DP - ok

21:35:53.0281 2380 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

21:35:53.0359 2380 HTTP - ok

21:35:53.0406 2380 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

21:35:53.0437 2380 HTTPFilter - ok

21:35:53.0468 2380 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys

21:35:53.0468 2380 i2omgmt - ok

21:35:53.0500 2380 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys

21:35:53.0500 2380 i2omp - ok

21:35:53.0531 2380 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

21:35:53.0546 2380 i8042prt - ok

21:35:55.0593 2380 ialm (28423512370705aeda6a652fedb25468) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys

21:35:57.0468 2380 ialm - ok

21:35:57.0984 2380 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\drivers\iaStor.sys

21:35:58.0062 2380 iaStor - ok

21:35:58.0218 2380 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

21:35:58.0250 2380 IDriverT - ok

21:35:58.0671 2380 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

21:35:59.0046 2380 idsvc - ok

21:35:59.0281 2380 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

21:35:59.0296 2380 Imapi - ok

21:35:59.0375 2380 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

21:35:59.0390 2380 ImapiService - ok

21:35:59.0421 2380 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys

21:35:59.0421 2380 ini910u - ok

21:36:02.0531 2380 IntcAzAudAddService (17bbbabb21f86b650b2626045a9d016c) C:\WINDOWS\system32\drivers\RtkHDAud.sys

21:36:02.0578 2380 IntcAzAudAddService - ok

21:36:03.0015 2380 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

21:36:03.0031 2380 IntelIde - ok

21:36:03.0078 2380 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

21:36:03.0093 2380 intelppm - ok

21:36:03.0218 2380 IntuitUpdateService - ok

21:36:03.0281 2380 IntuitUpdateServiceV4 (1663a135865f0ba6e853353e98e67f2a) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

21:36:03.0281 2380 IntuitUpdateServiceV4 - ok

21:36:03.0296 2380 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

21:36:03.0312 2380 Ip6Fw - ok

21:36:03.0359 2380 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

21:36:03.0359 2380 IpFilterDriver - ok

21:36:03.0375 2380 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

21:36:03.0390 2380 IpInIp - ok

21:36:03.0453 2380 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

21:36:03.0500 2380 IpNat - ok

21:36:03.0953 2380 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe

21:36:03.0968 2380 iPod Service - ok

21:36:04.0015 2380 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

21:36:04.0031 2380 IPSec - ok

21:36:04.0046 2380 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

21:36:04.0046 2380 IRENUM - ok

21:36:04.0078 2380 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

21:36:04.0078 2380 isapnp - ok

21:36:04.0234 2380 JavaQuickStarterService (c2c1660ddcc9bd67eb98d6d5f91c107f) C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

21:36:04.0234 2380 JavaQuickStarterService - ok

21:36:04.0265 2380 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

21:36:04.0281 2380 Kbdclass - ok

21:36:04.0281 2380 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

21:36:04.0296 2380 kbdhid - ok

21:36:04.0390 2380 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

21:36:04.0437 2380 kmixer - ok

21:36:04.0500 2380 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

21:36:04.0531 2380 KSecDD - ok

21:36:04.0578 2380 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

21:36:04.0609 2380 lanmanserver - ok

21:36:04.0812 2380 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

21:36:04.0859 2380 lanmanworkstation - ok

21:36:04.0859 2380 Lbd - ok

21:36:04.0875 2380 lbrtfdc - ok

21:36:04.0937 2380 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

21:36:04.0937 2380 LmHosts - ok

21:36:04.0984 2380 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys

21:36:04.0984 2380 MBAMProtector - ok

21:36:05.0234 2380 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

21:36:05.0250 2380 MBAMService - ok

21:36:05.0281 2380 mdmxsdk (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

21:36:05.0281 2380 mdmxsdk - ok

21:36:05.0312 2380 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

21:36:05.0328 2380 Messenger - ok

21:36:05.0359 2380 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

21:36:05.0359 2380 mnmdd - ok

21:36:05.0406 2380 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

21:36:05.0406 2380 mnmsrvc - ok

21:36:05.0468 2380 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

21:36:05.0468 2380 Modem - ok

21:36:05.0468 2380 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys

21:36:05.0484 2380 MODEMCSA - ok

21:36:05.0515 2380 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

21:36:05.0531 2380 Mouclass - ok

21:36:05.0562 2380 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

21:36:05.0562 2380 mouhid - ok

21:36:05.0593 2380 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

21:36:05.0593 2380 MountMgr - ok

21:36:05.0671 2380 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

21:36:05.0718 2380 MozillaMaintenance - ok

21:36:05.0843 2380 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys

21:36:05.0859 2380 mraid35x - ok

21:36:05.0953 2380 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

21:36:06.0015 2380 MRxDAV - ok

21:36:06.0015 2380 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

21:36:06.0015 2380 MSDTC - ok

21:36:06.0062 2380 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

21:36:06.0062 2380 Msfs - ok

21:36:06.0078 2380 MSIServer - ok

21:36:06.0125 2380 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

21:36:06.0125 2380 MSKSSRV - ok

21:36:06.0140 2380 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

21:36:06.0140 2380 MSPCLOCK - ok

21:36:06.0171 2380 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

21:36:06.0187 2380 MSPQM - ok

21:36:06.0203 2380 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

21:36:06.0203 2380 mssmbios - ok

21:36:06.0234 2380 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

21:36:06.0234 2380 MSTEE - ok

21:36:06.0296 2380 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

21:36:06.0328 2380 Mup - ok

21:36:06.0375 2380 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

21:36:06.0390 2380 NABTSFEC - ok

21:36:06.0546 2380 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

21:36:06.0656 2380 napagent - ok

21:36:06.0921 2380 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

21:36:06.0968 2380 NDIS - ok

21:36:07.0000 2380 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

21:36:07.0000 2380 NdisIP - ok

21:36:07.0031 2380 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

21:36:07.0046 2380 NdisTapi - ok

21:36:07.0093 2380 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

21:36:07.0093 2380 Ndisuio - ok

21:36:07.0140 2380 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

21:36:07.0156 2380 NdisWan - ok

21:36:07.0203 2380 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

21:36:07.0203 2380 NDProxy - ok

21:36:07.0234 2380 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

21:36:07.0234 2380 NetBIOS - ok

21:36:07.0312 2380 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

21:36:07.0359 2380 NetBT - ok

21:36:07.0453 2380 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

21:36:07.0484 2380 NetDDE - ok

21:36:07.0500 2380 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

21:36:07.0500 2380 NetDDEdsdm - ok

21:36:07.0515 2380 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

21:36:07.0515 2380 Netlogon - ok

21:36:07.0625 2380 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

21:36:07.0640 2380 Netman - ok

21:36:07.0968 2380 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

21:36:08.0000 2380 NetTcpPortSharing - ok

21:36:08.0109 2380 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

21:36:08.0109 2380 Nla - ok

21:36:08.0125 2380 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

21:36:08.0140 2380 Npfs - ok

21:36:08.0328 2380 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

21:36:08.0500 2380 Ntfs - ok

21:36:08.0500 2380 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

21:36:08.0500 2380 NtLmSsp - ok

21:36:08.0687 2380 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

21:36:08.0921 2380 NtmsSvc - ok

21:36:08.0968 2380 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

21:36:08.0968 2380 Null - ok

21:36:09.0593 2380 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

21:36:10.0265 2380 nv - ok

21:36:10.0562 2380 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

21:36:10.0562 2380 NwlnkFlt - ok

21:36:10.0578 2380 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

21:36:10.0593 2380 NwlnkFwd - ok

21:36:10.0640 2380 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

21:36:10.0656 2380 Parport - ok

21:36:10.0671 2380 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

21:36:10.0687 2380 PartMgr - ok

21:36:10.0703 2380 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

21:36:10.0718 2380 ParVdm - ok

21:36:10.0953 2380 PcCtlCom - ok

21:36:10.0984 2380 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

21:36:11.0000 2380 PCI - ok

21:36:11.0000 2380 PCIDump - ok

21:36:11.0015 2380 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

21:36:11.0015 2380 PCIIde - ok

21:36:11.0078 2380 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

21:36:11.0109 2380 Pcmcia - ok

21:36:11.0125 2380 PDCOMP - ok

21:36:11.0140 2380 PDFRAME - ok

21:36:11.0140 2380 PDRELI - ok

21:36:11.0156 2380 PDRFRAME - ok

21:36:11.0187 2380 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys

21:36:11.0203 2380 perc2 - ok

21:36:11.0234 2380 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys

21:36:11.0234 2380 perc2hib - ok

21:36:11.0484 2380 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE

21:36:11.0500 2380 PEVSystemStart - ok

21:36:11.0562 2380 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

21:36:11.0562 2380 PlugPlay - ok

21:36:11.0593 2380 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

21:36:11.0593 2380 PolicyAgent - ok

21:36:11.0640 2380 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

21:36:11.0656 2380 PptpMiniport - ok

21:36:11.0656 2380 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

21:36:11.0656 2380 ProtectedStorage - ok

21:36:11.0687 2380 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

21:36:11.0718 2380 PSched - ok

21:36:11.0828 2380 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

21:36:11.0843 2380 Ptilink - ok

21:36:11.0890 2380 PxHelp20 (03e0fe281823ba64b3782f5b38950e73) C:\WINDOWS\system32\Drivers\PxHelp20.sys

21:36:11.0906 2380 PxHelp20 - ok

21:36:11.0937 2380 QCDonner (fddd1aeb9f81ef1e6e48ae1edc2a97d6) C:\WINDOWS\system32\DRIVERS\OVCD.sys

21:36:11.0953 2380 QCDonner - ok

21:36:11.0968 2380 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys

21:36:11.0984 2380 ql1080 - ok

21:36:12.0000 2380 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys

21:36:12.0015 2380 Ql10wnt - ok

21:36:12.0031 2380 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys

21:36:12.0046 2380 ql12160 - ok

21:36:12.0062 2380 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys

21:36:12.0078 2380 ql1240 - ok

21:36:12.0093 2380 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys

21:36:12.0109 2380 ql1280 - ok

21:36:12.0140 2380 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

21:36:12.0140 2380 RasAcd - ok

21:36:12.0203 2380 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

21:36:12.0234 2380 RasAuto - ok

21:36:12.0281 2380 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

21:36:12.0296 2380 Rasl2tp - ok

21:36:12.0390 2380 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

21:36:12.0406 2380 RasMan - ok

21:36:12.0437 2380 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

21:36:12.0453 2380 RasPppoe - ok

21:36:12.0468 2380 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

21:36:12.0468 2380 Raspti - ok

21:36:12.0531 2380 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

21:36:12.0578 2380 Rdbss - ok

21:36:12.0609 2380 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

21:36:12.0609 2380 RDPCDD - ok

21:36:12.0703 2380 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

21:36:12.0875 2380 rdpdr - ok

21:36:12.0937 2380 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys

21:36:12.0984 2380 RDPWD - ok

21:36:13.0062 2380 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

21:36:13.0093 2380 RDSessMgr - ok

21:36:13.0140 2380 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

21:36:13.0156 2380 redbook - ok

21:36:13.0234 2380 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

21:36:13.0250 2380 RemoteAccess - ok

21:36:13.0312 2380 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys

21:36:13.0312 2380 RimUsb - ok

21:36:13.0343 2380 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

21:36:13.0375 2380 RpcLocator - ok

21:36:13.0515 2380 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll

21:36:13.0515 2380 RpcSs - ok

21:36:13.0593 2380 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

21:36:13.0625 2380 RSVP - ok

21:36:13.0640 2380 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

21:36:13.0640 2380 SamSs - ok

21:36:13.0687 2380 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

21:36:13.0718 2380 SCardSvr - ok

21:36:13.0921 2380 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

21:36:13.0968 2380 Schedule - ok

21:36:14.0015 2380 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

21:36:14.0015 2380 Secdrv - ok

21:36:14.0046 2380 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

21:36:14.0046 2380 seclogon - ok

21:36:14.0062 2380 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

21:36:14.0078 2380 SENS - ok

21:36:14.0109 2380 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

21:36:14.0109 2380 serenum - ok

21:36:14.0140 2380 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

21:36:14.0171 2380 Serial - ok

21:36:14.0203 2380 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

21:36:14.0203 2380 Sfloppy - ok

21:36:14.0296 2380 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

21:36:14.0296 2380 ShellHWDetection - ok

21:36:14.0312 2380 Simbad - ok

21:36:14.0343 2380 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys

21:36:14.0343 2380 sisagp - ok

21:36:14.0375 2380 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

21:36:14.0390 2380 SLIP - ok

21:36:14.0421 2380 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys

21:36:14.0437 2380 Sparrow - ok

21:36:14.0468 2380 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

21:36:14.0468 2380 splitter - ok

21:36:14.0531 2380 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

21:36:14.0531 2380 Spooler - ok

21:36:14.0640 2380 sprtsvc_dellsupportcenter - ok

21:36:14.0687 2380 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

21:36:14.0703 2380 sr - ok

21:36:14.0921 2380 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

21:36:14.0968 2380 srservice - ok

21:36:15.0093 2380 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

21:36:15.0203 2380 Srv - ok

21:36:15.0250 2380 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

21:36:15.0281 2380 SSDPSRV - ok

21:36:15.0328 2380 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

21:36:15.0328 2380 ssmdrv - ok

21:36:15.0468 2380 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

21:36:15.0562 2380 stisvc - ok

21:36:15.0640 2380 stllssvr (7489520e98a119b5a9a00857f4f87d16) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

21:36:15.0671 2380 stllssvr - ok

21:36:15.0687 2380 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

21:36:15.0687 2380 streamip - ok

21:36:15.0828 2380 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

21:36:15.0828 2380 swenum - ok

21:36:15.0906 2380 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

21:36:15.0921 2380 swmidi - ok

21:36:15.0921 2380 SwPrv - ok

21:36:15.0937 2380 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys

21:36:15.0953 2380 symc810 - ok

21:36:16.0000 2380 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys

21:36:16.0015 2380 symc8xx - ok

21:36:16.0015 2380 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys

21:36:16.0031 2380 sym_hi - ok

21:36:16.0046 2380 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys

21:36:16.0062 2380 sym_u3 - ok

21:36:16.0093 2380 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

21:36:16.0109 2380 sysaudio - ok

21:36:16.0156 2380 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

21:36:16.0187 2380 SysmonLog - ok

21:36:16.0265 2380 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

21:36:16.0343 2380 TapiSrv - ok

21:36:16.0500 2380 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

21:36:16.0609 2380 Tcpip - ok

21:36:16.0640 2380 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

21:36:16.0640 2380 TDPIPE - ok

21:36:16.0687 2380 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

21:36:16.0687 2380 TDTCP - ok

21:36:16.0828 2380 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

21:36:16.0843 2380 TermDD - ok

21:36:16.0953 2380 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

21:36:17.0031 2380 TermService - ok

21:36:17.0109 2380 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

21:36:17.0109 2380 Themes - ok

21:36:17.0250 2380 TmPfw - ok

21:36:17.0296 2380 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys

21:36:17.0296 2380 TosIde - ok

21:36:17.0328 2380 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

21:36:17.0343 2380 TrkWks - ok

21:36:17.0406 2380 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

21:36:17.0437 2380 Udfs - ok

21:36:17.0453 2380 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys

21:36:17.0453 2380 ultra - ok

21:36:17.0609 2380 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

21:36:17.0718 2380 Update - ok

21:36:17.0937 2380 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

21:36:18.0000 2380 upnphost - ok

21:36:18.0015 2380 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

21:36:18.0015 2380 UPS - ok

21:36:18.0046 2380 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys

21:36:18.0062 2380 USBAAPL - ok

21:36:18.0093 2380 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

21:36:18.0125 2380 usbaudio - ok

21:36:18.0156 2380 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

21:36:18.0171 2380 usbccgp - ok

21:36:18.0187 2380 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

21:36:18.0187 2380 usbehci - ok

21:36:18.0218 2380 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

21:36:18.0234 2380 usbhub - ok

21:36:18.0250 2380 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

21:36:18.0265 2380 usbprint - ok

21:36:18.0265 2380 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

21:36:18.0281 2380 usbscan - ok

21:36:18.0312 2380 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

21:36:18.0312 2380 USBSTOR - ok

21:36:18.0359 2380 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

21:36:18.0359 2380 usbuhci - ok

21:36:18.0375 2380 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

21:36:18.0375 2380 VgaSave - ok

21:36:18.0437 2380 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys

21:36:18.0453 2380 viaagp - ok

21:36:18.0484 2380 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys

21:36:18.0484 2380 ViaIde - ok

21:36:18.0578 2380 Viewpoint Manager Service - ok

21:36:18.0625 2380 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

21:36:18.0640 2380 VolSnap - ok

21:36:18.0843 2380 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

21:36:18.0953 2380 VSS - ok

21:36:19.0093 2380 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

21:36:19.0140 2380 w32time - ok

21:36:19.0203 2380 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

21:36:19.0218 2380 Wanarp - ok

21:36:19.0281 2380 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

21:36:19.0281 2380 wanatw - ok

21:36:19.0281 2380 WDICA - ok

21:36:19.0343 2380 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

21:36:19.0359 2380 wdmaud - ok

21:36:19.0484 2380 Web Assistant Updater (5cab8953e4a9301553ae5fbe7832767a) C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

21:36:19.0484 2380 Web Assistant Updater - ok

21:36:19.0546 2380 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

21:36:19.0562 2380 WebClient - ok

21:36:20.0031 2380 winachsf (f59ed5a43b988a18ef582bb07b2327a7) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

21:36:20.0250 2380 winachsf - ok

21:36:20.0250 2380 WinDefend - ok

21:36:20.0468 2380 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

21:36:20.0500 2380 winmgmt - ok

21:36:20.0609 2380 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\mspmsnsv.dll

21:36:20.0625 2380 WmdmPmSN - ok

21:36:20.0828 2380 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

21:36:20.0875 2380 WmiApSrv - ok

21:36:21.0390 2380 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe

21:36:21.0687 2380 WMPNetworkSvc - ok

21:36:21.0921 2380 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

21:36:21.0921 2380 WpdUsb - ok

21:36:22.0312 2380 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

21:36:22.0546 2380 WPFFontCache_v0400 - ok

21:36:22.0562 2380 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

21:36:22.0562 2380 WS2IFSL - ok

21:36:22.0640 2380 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

21:36:22.0656 2380 wscsvc - ok

21:36:22.0718 2380 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

21:36:22.0734 2380 WSTCODEC - ok

21:36:22.0875 2380 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

21:36:22.0906 2380 wuauserv - ok

21:36:22.0968 2380 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

21:36:23.0000 2380 WudfPf - ok

21:36:23.0031 2380 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

21:36:23.0046 2380 WudfRd - ok

21:36:23.0109 2380 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll

21:36:23.0125 2380 WudfSvc - ok

21:36:23.0312 2380 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

21:36:23.0453 2380 WZCSVC - ok

21:36:23.0531 2380 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

21:36:23.0593 2380 xmlprov - ok

21:36:23.0625 2380 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

21:36:24.0296 2380 \Device\Harddisk0\DR0 - ok

21:36:24.0328 2380 Boot (0x1200) (2c6c431dd41036a1eeb611b83c0881e2) \Device\Harddisk0\DR0\Partition0

21:36:24.0328 2380 \Device\Harddisk0\DR0\Partition0 - ok

21:36:24.0328 2380 ============================================================

21:36:24.0328 2380 Scan finished

21:36:24.0328 2380 ============================================================

21:36:24.0343 2368 Detected object count: 0

21:36:24.0343 2368 Actual detected object count: 0

Share this post


Link to post
Share on other sites

No freezing this time and I had to reboot as per Combofix prompts. It started scanning again and DDS suddenly popped up and ran around Stage 5. I figured that was Combofix's doing and let it be (it didn't freeze this time and supposedly there's a log for it). There are a few things that didn't load up in the taskbar like the Avira Center and MSN Messenger. There is only the Windows Update yellow shield, the volume control, and the icon for disconnecting hardware.

Also experienced some hang time when visiting a few sites.

Here's the Combofix log:

ComboFix 12-06-20.02 - Marcia 06/20/2012 22:51:13.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1547 [GMT -4:00]

Running from: c:\documents and settings\Marcia\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC-cillin Internet Security - Firewall *Enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\3373148944

c:\documents and settings\All Users\SPL5.tmp

c:\documents and settings\All Users\SPL59.tmp

c:\program files\Web Assistant\ExTEnsion32.dll

c:\windows\system32\SETF1.tmp

.

.

((((((((((((((((((((((((( Files Created from 2012-05-21 to 2012-06-21 )))))))))))))))))))))))))))))))

.

.

2012-06-19 10:37 . 2012-06-19 10:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira

2012-06-18 23:54 . 2012-06-18 23:54 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-06-18 23:53 . 2012-06-18 23:53 588728 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-06-18 23:53 . 2012-06-18 23:53 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe

2012-06-18 23:53 . 2012-06-18 23:53 43960 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

2012-06-18 23:53 . 2012-06-18 23:53 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe

2012-06-17 22:24 . 2012-06-17 22:24 -------- d-----w- c:\documents and settings\Marcia\Application Data\Avira

2012-06-17 22:17 . 2012-06-18 23:18 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-06-17 22:17 . 2012-06-18 23:18 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-06-17 22:17 . 2011-09-16 20:09 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-06-17 22:17 . 2012-06-17 22:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2012-06-16 19:51 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-15 22:19 . 2012-05-11 14:42 521728 ------w- c:\windows\system32\dllcache\jsdbgui.dll

2012-06-15 09:04 . 2012-06-15 09:04 -------- d-----w- c:\program files\Oracle

2012-06-15 09:04 . 2012-06-15 09:04 -------- d-----w- c:\documents and settings\Marcia\Application Data\Oracle

2012-06-15 09:04 . 2012-05-04 23:29 143872 ----a-w- c:\windows\system32\javacpl.cpl

2012-06-15 09:04 . 2012-05-04 23:29 772504 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-06-15 05:36 . 2012-06-15 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}

2012-06-15 05:09 . 2012-06-15 05:09 -------- d-----w- c:\documents and settings\Marcia\Application Data\Uniblue

2012-06-15 05:08 . 2012-06-15 05:08 -------- d-----w- c:\program files\Uniblue

2012-06-15 05:08 . 2012-06-15 05:08 -------- d-----w- c:\documents and settings\Marcia\Local Settings\Application Data\PackageAware

2012-06-14 08:08 . 2012-06-14 08:08 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-06-14 07:47 . 2012-06-15 08:43 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-12 23:04 . 2012-06-12 23:04 795 ----a-w- C:\user.js

2012-06-12 23:04 . 2012-06-21 03:03 -------- d-----w- c:\program files\Web Assistant

2012-06-11 07:22 . 2012-06-11 07:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Sun

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-15 08:43 . 2011-09-16 15:03 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-05-31 13:22 . 2004-08-10 17:50 599040 ----a-w- c:\windows\system32\crypt32.dll

2012-05-16 15:08 . 2004-08-10 17:51 916992 ----a-w- c:\windows\system32\wininet.dll

2012-05-15 13:20 . 2009-02-03 13:08 1863168 ----a-w- c:\windows\system32\win32k.sys

2012-05-11 14:42 . 2004-08-10 17:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-05-11 14:42 . 2004-08-10 17:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2012-05-11 11:38 . 2004-08-10 17:51 385024 ----a-w- c:\windows\system32\html.iec

2012-05-04 23:29 . 2011-09-25 00:35 687504 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-02 13:46 . 2009-02-03 13:08 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-04-11 13:14 . 2009-02-03 13:08 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-04-11 12:35 . 2009-02-03 13:08 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2012-06-18 23:53 . 2011-03-29 00:48 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A}]

2009-08-14 02:46 1358848 ------w- c:\program files\MyPoints Toolbar 2.0\Toolbar.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2012-04-09 21:43 1519272 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{89A2510A-B4B6-4683-BEC9-1B96700BC7F1}"= "c:\program files\MyPoints Toolbar 2.0\Toolbar.dll" [2009-08-14 1358848]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-04-09 1519272]

.

[HKEY_CLASSES_ROOT\clsid\{89a2510a-b4b6-4683-bec9-1b96700bc7f1}]

[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar.3]

[HKEY_CLASSES_ROOT\TypeLib\{061ED138-E065-4356-82AA-578F7F1EEAF1}]

[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{89A2510A-B4B6-4683-BEC9-1B96700BC7F1}"= "c:\program files\MyPoints Toolbar 2.0\Toolbar.dll" [2009-08-14 1358848]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-04-09 1519272]

.

[HKEY_CLASSES_ROOT\clsid\{89a2510a-b4b6-4683-bec9-1b96700bc7f1}]

[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar.3]

[HKEY_CLASSES_ROOT\TypeLib\{061ED138-E065-4356-82AA-578F7F1EEAF1}]

[HKEY_CLASSES_ROOT\FCTB000060497.IEToolbar]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]

"cdloader"="c:\documents and settings\Marcia\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DLCXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-17 16132608]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-17 138008]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-17 142104]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-17 162584]

"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2007-01-12 292336]

"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

"FaxCenterServer"="c:\program files\Dell PC Fax\fm3032.exe" [2006-11-03 312200]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-14 16384]

"Corel Photo Downloader"="c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2005-08-31 106496]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-04-09 1557160]

"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2004-04-07 496752]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 926\memcard.exe" [2006-11-03 304008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-06-18 348624]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [6/17/2012 6:17 PM 36000]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/17/2012 6:17 PM 86224]

R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]

R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/16/2012 3:51 PM 654408]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/16/2012 3:51 PM 22344]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe --> c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [?]

S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]

S2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [6/12/2012 7:04 PM 185856]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6/14/2012 3:47 AM 257224]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [6/18/2012 7:54 PM 129976]

S3 WinDefend;Windows Defender;c:\windows\System32\svchost.exe -k secsvcs [8/10/2004 1:51 PM 14336]

.

Contents of the 'Scheduled Tasks' folder

.

2012-06-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 08:43]

.

2012-06-08 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]

.

2012-06-21 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\program files\Ask.com\UpdateTask.exe [2012-04-09 21:43]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local;<local>

Trusted Zone: intuit.com\ttlc

TCP: DhcpNameServer = 167.206.254.2 167.206.254.1

FF - ProfilePath - c:\documents and settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb165/?loc=IB_DS&a=6R8vOK9bbx&&i=26&search=

FF - prefs.js: network.proxy.http - localhost

FF - prefs.js: network.proxy.http_port - 8095

FF - prefs.js: network.proxy.type - 0

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6R8vOK9bbx

FF - user.js: extensions.incredibar_i.upn2n - 92824525086274575

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10665

FF - user.js: extensions.incredibar_i.ppd -

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8vOK9bbx&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - 50adac1d000000000000001d09918489

FF - user.js: extensions.incredibar_i.instlDay - 15503

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1419:04

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

.

- - - - ORPHANS REMOVED - - - -

.

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}\bm_installer.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-06-20 23:05

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

DLCXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Completion time: 2012-06-20 23:08:52

ComboFix-quarantined-files.txt 2012-06-21 03:08

.

Pre-Run: 226,553,757,696 bytes free

Post-Run: 226,830,405,632 bytes free

.

- - End Of File - - 878DB2BDA34A8B5F58836AE741B846C5

Share this post


Link to post
Share on other sites

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::
Folder::
c:\program files\MyPoints Toolbar 2.0
c:\program files\Ask.com
FireFox::
FF - ProfilePath - c:\documents and settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\
FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb165/?loc=IB_DS&a=6R8vOK9bbx&&i=26&search=
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 8095
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8vOK9bbx
FF - user.js: extensions.incredibar_i.upn2n - 92824525086274575
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10665
FF - user.js: extensions.incredibar_i.ppd -
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8vOK9bbx&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 50adac1d000000000000001d09918489
FF - user.js: extensions.incredibar_i.instlDay - 15503
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1419:04
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

CFScriptB-4.gif

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  1. report from Combofix
  2. let me know of any problems you may have had
  3. How is the computer doing now after running the script?

Gringo

Share this post


Link to post
Share on other sites

I noticed the Welcome screen stays on longer, taskbar loads up icons as usual, I haven't been getting any random redirects when opening bookmarks/websites from google search.

Combofix log:

ComboFix 12-06-20.02 - Marcia 06/21/2012 0:31.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2037.1503 [GMT -4:00]

Running from: c:\documents and settings\Marcia\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Marcia\Desktop\CFScript.txt

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC-cillin Internet Security - Firewall *Enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Ask.com

c:\program files\Ask.com\assets\oobe\b.png

c:\program files\Ask.com\assets\oobe\bl.png

c:\program files\Ask.com\assets\oobe\br.png

c:\program files\Ask.com\assets\oobe\l.png

c:\program files\Ask.com\assets\oobe\pointer.png

c:\program files\Ask.com\assets\oobe\r.png

c:\program files\Ask.com\assets\oobe\t.png

c:\program files\Ask.com\assets\oobe\tl.png

c:\program files\Ask.com\assets\oobe\tr.png

c:\program files\Ask.com\btn_search.png

c:\program files\Ask.com\cobrand.ico

c:\program files\Ask.com\config.xml

c:\program files\Ask.com\favicon.ico

c:\program files\Ask.com\GenericAskToolbar.dll

c:\program files\Ask.com\limewire_logo.png

c:\program files\Ask.com\mupcfg.xml

c:\program files\Ask.com\precache.exe

c:\program files\Ask.com\SaUpdate.exe

c:\program files\Ask.com\Updater\config.xml

c:\program files\Ask.com\Updater\Updater.exe

c:\program files\Ask.com\UpdateTask.exe

c:\program files\MyPoints Toolbar 2.0

c:\program files\MyPoints Toolbar 2.0\aboutTabs.7.js

c:\program files\MyPoints Toolbar 2.0\aboutTabs.8.js

c:\program files\MyPoints Toolbar 2.0\audio.bmp

c:\program files\MyPoints Toolbar 2.0\blockcursor.cur

c:\program files\MyPoints Toolbar 2.0\blocksound.wav

c:\program files\MyPoints Toolbar 2.0\bookmark_off.bmp

c:\program files\MyPoints Toolbar 2.0\bookmark_on.bmp

c:\program files\MyPoints Toolbar 2.0\bookmarksplugin.dll

c:\program files\MyPoints Toolbar 2.0\bubble_permissions.html

c:\program files\MyPoints Toolbar 2.0\build

c:\program files\MyPoints Toolbar 2.0\caching_banner.html

c:\program files\MyPoints Toolbar 2.0\chevron.bmp

c:\program files\MyPoints Toolbar 2.0\component.xsl

c:\program files\MyPoints Toolbar 2.0\default.xml

c:\program files\MyPoints Toolbar 2.0\efolder.bmp

c:\program files\MyPoints Toolbar 2.0\email.bmp

c:\program files\MyPoints Toolbar 2.0\email2.bmp

c:\program files\MyPoints Toolbar 2.0\emailchecker_plugin.dll

c:\program files\MyPoints Toolbar 2.0\facebook.feature

c:\program files\MyPoints Toolbar 2.0\fbrss.xsl

c:\program files\MyPoints Toolbar 2.0\ff.xsl

c:\program files\MyPoints Toolbar 2.0\folder.bmp

c:\program files\MyPoints Toolbar 2.0\gedit.exe

c:\program files\MyPoints Toolbar 2.0\Helper.dll

c:\program files\MyPoints Toolbar 2.0\Helper.dll.new

c:\program files\MyPoints Toolbar 2.0\icons.bmp

c:\program files\MyPoints Toolbar 2.0\iefavelem.bmp

c:\program files\MyPoints Toolbar 2.0\ImageConversion.dll

c:\program files\MyPoints Toolbar 2.0\images\amazon.bmp

c:\program files\MyPoints Toolbar 2.0\images\ebay.bmp

c:\program files\MyPoints Toolbar 2.0\images\email.bmp

c:\program files\MyPoints Toolbar 2.0\images\email2.bmp

c:\program files\MyPoints Toolbar 2.0\images\msgbox\down.gif

c:\program files\MyPoints Toolbar 2.0\images\msgbox\hr.bmp

c:\program files\MyPoints Toolbar 2.0\images\msgbox\mark.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\mark_do.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\mark_na.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\navbg.bmp

c:\program files\MyPoints Toolbar 2.0\images\msgbox\refresh.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\refresh_do.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\refresh_na.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\trash.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\trash_do.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\trash_na.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\unmark.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\unmark_do.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\unmark_na.png

c:\program files\MyPoints Toolbar 2.0\images\msgbox\up.gif

c:\program files\MyPoints Toolbar 2.0\images\ticker\left.gif

c:\program files\MyPoints Toolbar 2.0\images\ticker\right.gif

c:\program files\MyPoints Toolbar 2.0\images\weather\0.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\1.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\10.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\11.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\12.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\13.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\14.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\15.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\16.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\17.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\18.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\19.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\2.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\20.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\21.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\22.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\23.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\24.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\25.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\26.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\27.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\28.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\29.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\3.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\30.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\31.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\32.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\33.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\34.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\35.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\36.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\37.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\38.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\39.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\4.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\40.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\41.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\42.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\43.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\44.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\45.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\46.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\47.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\5.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\6.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\7.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\8.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\9.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\hr.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\na.bmp

c:\program files\MyPoints Toolbar 2.0\images\weather\png\0.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\1.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\10.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\11.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\12.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\13.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\14.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\15.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\16.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\17.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\18.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\19.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\2.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\20.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\21.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\22.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\23.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\24.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\25.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\26.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\27.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\28.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\29.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\3.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\30.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\31.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\32.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\33.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\34.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\35.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\36.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\37.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\38.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\39.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\4.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\40.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\41.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\42.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\43.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\44.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\45.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\46.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\47.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\5.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\6.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\7.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\8.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\9.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\na.png

c:\program files\MyPoints Toolbar 2.0\images\weather\png\Thumbs.db

c:\program files\MyPoints Toolbar 2.0\images\wikipedia.bmp

c:\program files\MyPoints Toolbar 2.0\images\yahoo.bmp

c:\program files\MyPoints Toolbar 2.0\localization.xml

c:\program files\MyPoints Toolbar 2.0\location.xsl

c:\program files\MyPoints Toolbar 2.0\magglass.ico

c:\program files\MyPoints Toolbar 2.0\manage_bookmarks.html

c:\program files\MyPoints Toolbar 2.0\marquee.html

c:\program files\MyPoints Toolbar 2.0\marquee_permissions.html

c:\program files\MyPoints Toolbar 2.0\messaging.bmp

c:\program files\MyPoints Toolbar 2.0\MimeSniffer.dll

c:\program files\MyPoints Toolbar 2.0\minus.bmp

c:\program files\MyPoints Toolbar 2.0\msgbox_bubble.tmpl

c:\program files\MyPoints Toolbar 2.0\msgbox_openmsg.tmpl

c:\program files\MyPoints Toolbar 2.0\msgboxplugin.dll

c:\program files\MyPoints Toolbar 2.0\offline.html

c:\program files\MyPoints Toolbar 2.0\patch.bat

c:\program files\MyPoints Toolbar 2.0\plus.bmp

c:\program files\MyPoints Toolbar 2.0\podcast.bmp

c:\program files\MyPoints Toolbar 2.0\podcast.xsl

c:\program files\MyPoints Toolbar 2.0\radio.bmp

c:\program files\MyPoints Toolbar 2.0\RadioPlugin.dll

c:\program files\MyPoints Toolbar 2.0\resize.bmp

c:\program files\MyPoints Toolbar 2.0\rssfeed.bmp

c:\program files\MyPoints Toolbar 2.0\RSSReader_plugin.dll

c:\program files\MyPoints Toolbar 2.0\RSSReader_plugin.dll.new

c:\program files\MyPoints Toolbar 2.0\search.xsl

c:\program files\MyPoints Toolbar 2.0\SearchComponent.dll

c:\program files\MyPoints Toolbar 2.0\settings

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_dropdwn_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_dropdwn_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_dropdwn_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_max_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_max_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_max_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_min_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_min_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_min_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_pause_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_pause_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_pause_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_play_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_play_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_play_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_playcntrl_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_playcntrl_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_stop_down.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_stop_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_stop_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_volcntrl_over.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\btn_volcntrl_up.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer1.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer2.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer3.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer4.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer5.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\Equalizer6.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\playcntrl_bg.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\radio.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\radio_mask.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\radio_minimalized.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\radio_minimalized_mask.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\station.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\vol_01.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\vol_02.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\vol_03.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\volslide_bg.bmp

c:\program files\MyPoints Toolbar 2.0\skins\radio\gray03\volslide_track.bmp

c:\program files\MyPoints Toolbar 2.0\star_on.gif

c:\program files\MyPoints Toolbar 2.0\statplugin.dll

c:\program files\MyPoints Toolbar 2.0\ticker.html

c:\program files\MyPoints Toolbar 2.0\Toolbar.dll

c:\program files\MyPoints Toolbar 2.0\Toolbar.dll.new

c:\program files\MyPoints Toolbar 2.0\ToolbarUpdate.exe

c:\program files\MyPoints Toolbar 2.0\TroubleShooter.exe

c:\program files\MyPoints Toolbar 2.0\Uninst.exe

c:\program files\MyPoints Toolbar 2.0\update_progress.html

c:\program files\MyPoints Toolbar 2.0\version.txt

c:\program files\MyPoints Toolbar 2.0\version.xsl

c:\program files\MyPoints Toolbar 2.0\weather_bubble.tmpl

c:\program files\MyPoints Toolbar 2.0\weatherplugin.dll

.

Infected copy of c:\windows\system32\Services.exe was found and disinfected

Restored copy from - c:\windows\ERDNT\cache\services.exe

.

.

((((((((((((((((((((((((( Files Created from 2012-05-21 to 2012-06-21 )))))))))))))))))))))))))))))))

.

.

2012-06-19 10:37 . 2012-06-19 10:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira

2012-06-18 23:54 . 2012-06-18 23:54 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-06-18 23:53 . 2012-06-18 23:53 588728 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-06-18 23:53 . 2012-06-18 23:53 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe

2012-06-18 23:53 . 2012-06-18 23:53 43960 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

2012-06-18 23:53 . 2012-06-18 23:53 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe

2012-06-17 22:24 . 2012-06-17 22:24 -------- d-----w- c:\documents and settings\Marcia\Application Data\Avira

2012-06-17 22:17 . 2012-06-18 23:18 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-06-17 22:17 . 2012-06-18 23:18 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-06-17 22:17 . 2011-09-16 20:09 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-06-17 22:17 . 2012-06-17 22:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2012-06-16 19:51 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-15 22:19 . 2012-05-11 14:42 521728 ------w- c:\windows\system32\dllcache\jsdbgui.dll

2012-06-15 09:04 . 2012-06-15 09:04 -------- d-----w- c:\program files\Oracle

2012-06-15 09:04 . 2012-06-15 09:04 -------- d-----w- c:\documents and settings\Marcia\Application Data\Oracle

2012-06-15 09:04 . 2012-05-04 23:29 143872 ----a-w- c:\windows\system32\javacpl.cpl

2012-06-15 09:04 . 2012-05-04 23:29 772504 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-06-15 05:36 . 2012-06-15 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}

2012-06-15 05:09 . 2012-06-15 05:09 -------- d-----w- c:\documents and settings\Marcia\Application Data\Uniblue

2012-06-15 05:08 . 2012-06-15 05:08 -------- d-----w- c:\program files\Uniblue

2012-06-15 05:08 . 2012-06-15 05:08 -------- d-----w- c:\documents and settings\Marcia\Local Settings\Application Data\PackageAware

2012-06-14 08:08 . 2012-06-14 08:08 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-06-14 07:47 . 2012-06-15 08:43 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-12 23:04 . 2012-06-12 23:04 795 ----a-w- C:\user.js

2012-06-12 23:04 . 2012-06-21 03:03 -------- d-----w- c:\program files\Web Assistant

2012-06-11 07:22 . 2012-06-11 07:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Sun

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-15 08:43 . 2011-09-16 15:03 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-05-31 13:22 . 2004-08-10 17:50 599040 ----a-w- c:\windows\system32\crypt32.dll

2012-05-16 15:08 . 2004-08-10 17:51 916992 ----a-w- c:\windows\system32\wininet.dll

2012-05-15 13:20 . 2009-02-03 13:08 1863168 ----a-w- c:\windows\system32\win32k.sys

2012-05-11 14:42 . 2004-08-10 17:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-05-11 14:42 . 2004-08-10 17:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2012-05-11 11:38 . 2004-08-10 17:51 385024 ----a-w- c:\windows\system32\html.iec

2012-05-04 23:29 . 2011-09-25 00:35 687504 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-02 13:46 . 2009-02-03 13:08 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-04-11 13:14 . 2009-02-03 13:08 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-04-11 12:35 . 2009-02-03 13:08 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2012-06-18 23:53 . 2011-03-29 00:48 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2012-06-21_03.05.26 )))))))))))))))))))))))))))))))))))))))))

.

+ 2012-06-21 04:48 . 2012-06-21 04:48 16384 c:\windows\temp\Perflib_Perfdata_420.dat

+ 2010-12-29 20:34 . 2012-06-21 03:11 102400 c:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe

- 2010-12-29 20:34 . 2012-04-27 12:21 102400 c:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe

+ 2012-06-21 03:11 . 2012-06-21 03:12 2288128 c:\windows\Installer\172b27.msi

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]

"cdloader"="c:\documents and settings\Marcia\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DLCXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-17 16132608]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-17 138008]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-17 142104]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-17 162584]

"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2007-01-12 292336]

"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

"FaxCenterServer"="c:\program files\Dell PC Fax\fm3032.exe" [2006-11-03 312200]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-14 16384]

"Corel Photo Downloader"="c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2005-08-31 106496]

"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2004-04-07 496752]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 926\memcard.exe" [2006-11-03 304008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-06-18 348624]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [6/17/2012 6:17 PM 36000]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/17/2012 6:17 PM 86224]

R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]

R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/16/2012 3:51 PM 654408]

R2 Web Assistant Updater;Web Assistant Updater;c:\program files\Web Assistant\ExtensionUpdaterService.exe [6/12/2012 7:04 PM 185856]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/16/2012 3:51 PM 22344]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe --> c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [?]

S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6/14/2012 3:47 AM 257224]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [6/18/2012 7:54 PM 129976]

S3 WinDefend;Windows Defender;c:\windows\System32\svchost.exe -k secsvcs [8/10/2004 1:51 PM 14336]

.

Contents of the 'Scheduled Tasks' folder

.

2012-06-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 08:43]

.

2012-06-08 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local;<local>

Trusted Zone: intuit.com\ttlc

TCP: DhcpNameServer = 167.206.254.2 167.206.254.1

FF - ProfilePath - c:\documents and settings\Marcia\Application Data\Mozilla\Firefox\Profiles\z3kwvto7.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: network.proxy.type - 0

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{614BDA1F-9BEF-4CD1-BDE4-FA4804929B4A} - c:\program files\MyPoints Toolbar 2.0\Toolbar.dll

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

Toolbar-{89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - c:\program files\MyPoints Toolbar 2.0\Toolbar.dll

Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

WebBrowser-{89A2510A-B4B6-4683-BEC9-1B96700BC7F1} - c:\program files\MyPoints Toolbar 2.0\Toolbar.dll

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe

AddRemove-MyPoints Toolbar 2.0 - c:\program files\MyPoints Toolbar 2.0\Uninst.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-06-21 00:50

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

DLCXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3820)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\dlcxcoms.exe

c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\igfxsrvc.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2012-06-21 00:56:53 - machine was rebooted

ComboFix-quarantined-files.txt 2012-06-21 04:56

ComboFix2.txt 2012-06-21 03:08

.

Pre-Run: 226,728,468,480 bytes free

Post-Run: 226,811,641,856 bytes free

.

- - End Of File - - 566DF9A31F5A1CCFC287D2C5527DBCE0

Share this post


Link to post
Share on other sites

Hello

I would like to see a report that combofix makes.

extra combofix report

  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box


C:\Qoobox\Add-Remove Programs.txt

  • click ok

copy and paste the report into this topic for me to review

Gringo

Share this post


Link to post
Share on other sites

Extra (Add-Remove Program) report:

2chtubo

926plc32

ABBYY FineReader 6.0 Sprint

Adobe AIR

Adobe Digital Editions

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.3)

Adobe Shockwave Player 11.5

AIM 7

Amazon MP3 Downloader 1.0.5

America Online (Choose which version to remove)

AnswerWorks 5.0 English Runtime

AOL Coach Version 1.0(Build:20040229.1 en)

AOL Connectivity Services

AOLIcon

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft Print Creations

ArcSoft Print Creations - Album Page

ArcSoft Print Creations - Funhouse

ArcSoft Print Creations - Greeting Card

ArcSoft Print Creations - Photo Book

ArcSoft Print Creations - Photo Calendar

ArcSoft Print Creations - Scrapbook

ArcSoft Print Creations - Slimline Card

Ask Toolbar

Ask Toolbar Updater

Avira Free Antivirus

Bonjour

Browser Address Error Redirector

Capture NX 2

CCScore

Compatibility Pack for the 2007 Office system

Conexant D850 56K V.9x DFVc Modem

Corel Paint Shop Pro X

Corel Photo Album 6

Critical Update for Windows Media Player 11 (KB959772)

Dell DataSafe Online

Dell Driver Reset Tool

Dell PC Fax

Dell Photo AIO Printer 926

Dell Support Center (Support Software)

Dell System Restore

Digital Line Detect

DivX Web Player

Documentation & Support Launcher

Download Updater (AOL LLC)

EarthLink Setup Files

ESSBrwr

ESSCDBK

ESScore

ESSgui

ESSini

ESSPCD

ESSPDock

ESSTOOLS

essvatgt

Facebook Plug-In

fflink

Games, Music, & Photos Launcher

High Definition Audio Driver Package - KB835221

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB932716-v2)

Hotfix for Windows XP (KB945060-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

Intel® Graphics Media Accelerator Driver

Intel® PRO Network Connections Drivers

Internet Service Offers Launcher

IrfanView (remove only)

iTunes

Japanese Fonts Support For Adobe Reader 8

Java Auto Updater

Java 7 Update 5

JavaFX 2.1.1

Kodak EasyShare software

Learn2 Player (Uninstall Only)

Malwarebytes Anti-Malware version 1.61.0.1400

Mavis Beacon Teaches Typing 12 Standard

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB2656370)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Plus! Digital Media Edition Installer

Microsoft Plus! Photo Story 2 LE

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft VC9 runtime libraries

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Works

Modem Diagnostic Tool

Move Media Player

Mozilla Firefox 9.0.1 (x86 en-US)

MSN

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6 Service Pack 2 (KB954459)

MyPoints Toolbar

MyPoints Toolbar 2.0

netbrdg

NetWaiting

NetZeroInstallers

OfotoXMI

Picture Control Utility

PowerDVD

QuickTime

RealPlayer Basic

Realtek High Definition Audio Driver

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

Safari

Samsung Master

Samsung USB Driver

SearchAssist

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft Windows (KB2564958)

Security Update for Step By Step Interactive Training (KB923723)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB2699988)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 10 (KB936782)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

SFR

SHASTA

skin0001

SKINXSDK

staticcr

TBS WMP Plug-in

The KMPlayer (remove only)

TurboTax 2008

TurboTax 2008 WinPerFedFormset

TurboTax 2008 WinPerProgramHelp

TurboTax 2008 WinPerReleaseEngine

TurboTax 2008 WinPerTaxSupport

TurboTax 2008 WinPerUserEducation

TurboTax 2008 wnyiper

TurboTax 2008 wrapper

TurboTax 2009

TurboTax 2009 WinPerFedFormset

TurboTax 2009 WinPerReleaseEngine

TurboTax 2009 WinPerTaxSupport

TurboTax 2009 wnyiper

TurboTax 2009 wrapper

TurboTax 2010

TurboTax 2010 WinPerFedFormset

TurboTax 2010 WinPerReleaseEngine

TurboTax 2010 WinPerTaxSupport

TurboTax 2010 wnyiper

TurboTax 2010 wrapper

TurboTax 2011

TurboTax 2011 WinPerFedFormset

TurboTax 2011 WinPerReleaseEngine

TurboTax 2011 WinPerTaxSupport

TurboTax 2011 wnciper

TurboTax 2011 wnjiper

TurboTax 2011 wnyiper

TurboTax 2011 wrapper

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2616676-v2)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2718704)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VC80CRTRedist - 8.0.50727.762

Viewpoint Manager (Remove Only)

Viewpoint Media Player

Viewpoint Toolbar

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

VPRINTOL

Web Assistant 2.0.0.442

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer 3.1 (KB893803)

Windows Internet Explorer 8

Windows Media Format 11 runtime

Windows Media Player 10

Windows Media Player 11

Windows XP Service Pack 3

WinRAR archiver

WIRELESS

WorldWinner Games

Share this post


Link to post
Share on other sites

  1. These logs are looking allot better. But we still have some work to do.
    Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..
    uninstall some programs
    NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.
    You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)
    • Programs to remove

      • Ask Toolbar
        Ask Toolbar Updater
        Browser Address Error Redirector
        MyPoints Toolbar
        MyPoints Toolbar 2.0

  • Please download and install
Revo Uninstaller FreeDouble click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Install Java:

Please go here to install Java

  • click on the Free Java Download Button
  • click on Agree and start Free download
  • click on Run
  • click on run again
  • click on install
  • when install is complete click on close

Clean Out Temp Files

  • This small application you may want to keep and use once a week to keep the computer clean.
    Download CCleaner from here http://www.ccleaner.com/
    • Run the installer to install the application.
    • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
    • Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
    • Click Run Cleaner.
    • Close CCleaner.

: Malwarebytes' Anti-Malware :

  • I would like you to rerun MBAM
  • Double-click mbam icon
  • go to the update tab at the top
  • click on check for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidentally close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

Click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

  • Go Here to download HijackThis Installer
  • Save HijackThis Installer to your desktop.
  • Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed it will launch Hijackthis.
  • Click on the Do a system scan and save a log file button. It will scan and the log should open in notepad.
  • Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the Analyze This button its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

NOTE**

sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe

(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit

(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit

and select to run as administrator

"information and logs"

  • In your next post I need the following
  1. Log From MBAM
  2. report from Hijackthis
  3. let me know of any problems you may have had
  4. How is the computer doing now?

Gringo

Share this post


Link to post
Share on other sites

Only issue I seem to have is a bit of hangtime when first opening a webpage in Firefox or any new tab (that might just be Firefox related since I've been holding off on updating to the next version).

Also DDS seems to run automatically everytime we restart the computer (though not always immediately). I remember trying to run the program numerous times before posting this thread; don't know if that's related.

Otherwise Windows and Welcome screens take their time loading up as per usual. Desktop and taskbar items come up quickly. Certain programs like Mozilla and iTunes take their sweet time opening as usual though.

Here's the MBAM log:

Malwarebytes Anti-Malware (PRO) 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.23.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Marcia :: D97VW0G1 [administrator]

Protection: Enabled

6/22/2012 10:44:21 PM

mbam-log-2012-06-22 (22-44-21).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 222595

Time elapsed: 2 minute(s), 40 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

HiJackThis report:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:54:35 PM, on 6/22/2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dlcxcoms.exe

C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Marcia\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080409

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing)

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll

O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"

O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Dell PC Fax\fm3032.exe" /s

O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Marcia\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab

O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab

O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - http://www.worldwinner.com/games/v48/brickout/brickout.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - http://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab

O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} (WorldWinner ActiveX Launcher Control) - http://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab

O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - http://www.worldwinner.com/games/v57/cubis/cubis.cab

O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tilecity Control) - http://www.worldwinner.com/games/v42/tilecity/tilecity.cab

O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - http://www.worldwinner.com/games/v52/dinerdash/dinerdash.cab

O16 - DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} (GolfSol Control) - http://www.worldwinner.com/games/v44/golfsol/golfsol.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: dlcx_device - - C:\WINDOWS\system32\dlcxcoms.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intuit Update Service (IntuitUpdateService) - Unknown owner - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (file missing)

O23 - Service: Intuit Update Service v4 (IntuitUpdateServiceV4) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe (file missing)

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing)

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe (file missing)

O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

O23 - Service: Web Assistant Updater - Unknown owner - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe

--

End of file - 10726 bytes

Share this post


Link to post
Share on other sites

Greetings

Why DDS is doing that I don't know - but I am hopeing ut stops when we clean off our tools

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded start-up entries:

This part of the fix is purely optional

These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    • O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe
      O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
      O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
      O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
      O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
      O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
      O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Dell PC Fax\fm3032.exe" /s
      O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
      O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
      O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
      O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
      O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
      O4 - HKCU\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    [*] Close all open windows and browsers/email, etc...

    [*] Click on the "Fix Checked" button

    [*] When completed, close the application.

    • NOTE**You can research each of those lines
    >here< and see if you want to keep them or not
    just copy the name between the brackets and paste into the search space
    O4 - HKLM\..\Run: [IntelliPoint]

NOTE**

sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe

(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit

(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit

and select to run as administrator

Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scanner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • click on the ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
    • Click Start

    [*]When asked, allow the ActiveX control to install

    • Click Start

    [*]Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.

    [*]Click on Advanced Settings, ensure the options

    • Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.

    [*]Click Scan

    [*]Wait for the scan to finish

    [*] Click on copy to clipboard or copy and paste the results here in this topic

Copy and paste that log as a reply to this topic

Gringo

Share this post


Link to post
Share on other sites

Had an odd re-direct happen when trying to post on a message board. It hung for a bit (presumably to high-volume traffic) and then all of a sudden I got redirected to a 'Mystart Incredibar' page. DDS still kept popping up during online scan. Otherwise everything else is the same.

Eset Online Scanner result:

C:\Documents and Settings\Marcia\.frostwire5\updates\frostwire-5.3.6.windows.exe Win32/OpenCandy application

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.