Jump to content

Memory could not be read


hkw

Recommended Posts

I have posted above Topic in General Malwarebytes' Anti-Malware Forum, noknojon suggest the following :

Please visit the Malware Removal area and follow the instructions on posting there -

As we do not work on Malware removal or diagnostics in the general forums please follow these directions -

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post - Please allow at least 48 hours for a reply as the experts can get busy at times -

Also add a brief note to the experts as to your problems -

Following is the post I first post there:

Days ago, I have download and installed Malwarebytes' AntiMalware v1.46(trial). After updating and system scan, there were trojans and malwares found and were subsequently quarantined and removed. Upon system reboot, when I clicked again on the Quarantine Topic of the screen, error message appeared with:

"Command reference 0x7348889a0x00030023,the memory could not be read, then the application is closed"

Then everytime when I clicked on Quarantine Topic again, same result with error message still occurred except changes in

numbers 0x000XXXXX from 0x00030023.

What is the cause of this problem? Can it be solved or any other means which you can advise or to have it completely removed and installed again?

Following is the recent complete scan as recommended by noknojon yesterday:

noknojon: Luckily there is no crash during system scan!

After 1 min scanning, there is an error occured with remarks 'please inform this error code to our support group

MBAM-ERROR-ADD_TO_RESULTS(0,6)

Complete scan results are as follows:

The following malicious software are found in your system, please close all unused

applicatios before clearance to successfully remove threats:

01) Trojan.BHO

02) Trojan.BHO Registry Key

HKEY_CLASSES_ROOT\Interface\{a1dd29ed-2598-48e9-9793-64a9cd08ac94}

(No action taken)

03) Trojan.BHO Registry Key

HKEY_CLASSES_ROOT\Typelib\{87ca3845-37fe-414c-81cf-e08a7d0f6779}

(No action taken)

04) Trojan.BHO File

C:\Documents and Settings\david\Desktop\Thunder_v5.9.22.1466\ComDlls\xunleiBHO_Now.dll

(No action action)

05) Trojan.BHO Memory Module

C:\Documents and Settings\david\Desktop\Thunder_v5.9.22.1466\ComDlls\xunleiBHO_Now.dll

(No action action)

06) Trojan.BHO Registry Key

HKEY_CLASSES_ROOT\Interface\{988934a4-064b-11d3-bb80-00104b35e7f9}{802f530b-a8f6-4631-ae49-6bacaac6373e}

(No action taken)

07) Trojan.BHO Registry Key

HKEY_CLASSES_ROOT\CLSID\{802f530b-a8f6-4631-ae49-6bacaac6373e}

(No action taken)

08) Trojan.BHO Registry Key

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\Ext\Stats\{802f530b-a8f6-4631-ae49-6bacaac6373e}

(No action taken)

09) Trojan.BHO Registry Key

HKEY_CLASSES_ROOT\CLSID\{889d2feb-5411-4565-8998-1dd2c5261283}

(No action taken)

10) Trojan.BHO Registry Key

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\Ext\Settings\

{889d2feb-5411-4565-8998-1dd2c5261283} (No action taken)

11) Trojan.BHO Registry Key

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\Ext\Stats\

{889d2feb-5411-4565-8998-1dd2c5261283} (No action taken)

12) Trojan.BHO Registry Key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Explorer\

Browser Helper Objects\{889d2feb-5411-4565-8998-1dd2c5261283} (No action taken)

13) ThTheftMarker.CRude File

C:\System Volume Information\_restore{7AB7F0FD-EA11-498F-B6F7-5AB95BAF1E4F}\RP219\A0154571.exe

14) Trojan.Agent.CK File

C:\System Volume Information\_restore{7AB7F0FD-EA11-498F-B6F7-5AB95BAF1E4F}\RP220\A0155806.exe

There is one querry I like to point out nearly all items quoted here are appeared on recent malicious log report which was already quarantined and removed. If they are really removed, how can they appear again here. Does it mean that malicious softwares found will only be removed on registered version and not applicable to trial version?

Link to post
Share on other sites

  • Replies 93
  • Created
  • Last Reply

Top Posters In This Topic

Following is my first complete scan report after MBAM software installation:

My operating system is Windows XP Pro SP3. I am using I.E.8 and my security software is Kaspersky Internet Security 2011. I hereby also enclose mbam log report as follows for your easy reference:

?????? 4855

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2010/10/15 ?? 10:08:34

mbam-log-2010-10-15 (22-08-34).txt

Scanning type: rapid scanning is

scan objects quantity: 146,493

scan a total Time: 2 hours, 22 minutes, 9

infected seconds memory process quantity: 0

infected memory modules: 1

infected note register table number of projects: 15

infected note register table volume: 0

infected note book lists number of projects: 0

infected folders: 1

infected file quantity: 3

The infected memory process quantity:

(does not detect a harmful item)

The infected memory modules Quantity:

C:\Documents and Settings\david\Desktop\Thunder_v5.9.22.1466\ComDlls\xunleiBHO_Now.dll (Trojan.BHO)

-> Delete on reboot.

The infected note register table number of projects:

HKEY_CLASSES_ROOT\Interface\{988934a4-064b-11d3-bb80-00104b35e7f9} (Trojan.BHO)

-> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{a1dd29ed-2598-48e9-9793-64a9cd08ac94} (Trojan.BHO)

-> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{61bd6924-d4fb-4ba2-b2ef-ebe5e203d122} (Trojan.Clicker)

-> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{87ca3845-37fe-414c-81cf-e08a7d0f6779} (Trojan.BHO) -

> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{802f530b-a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) ->

Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{802f530b-

a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) ->

Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\

{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{889d2feb-

5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser

Helper Objects\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO)

->Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\

{61bd6924-d4fb-4ba2-b2ef-ebe5e203d122} (Trojan.Clicker) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{61bd6924-

d4fb-4ba2-b2ef-ebe5e203d122} (Trojan.Clicker) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser

Helper Objects\{61bd6924-d4fb-4ba2-b2ef-ebe5e203d122} (Trojan.Clicker) ->

Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\msm4file (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qvodadblocker.qvodblock (Adware.Baidu) -> Quarantined and deleted successfully.

The infected note register table volume:

(does not detect a harmful item)

The infected note book lists number of projects:

(does not detect a harmful item)

The infected information kits Quantity:

C:\Program Files\Common Files\System\msnc (Rogue.ANGantiVirus) -> Quarantined

and deleted successfully.

The infected file Quantity:

C:\Documents and Settings\david\Desktop\Thunder_v5.9.22.1466

\ComDlls\xunleiBHO_Now.dll (Trojan.BHO) -> Delete on reboot.

Link to post
Share on other sites

Hello ,

And :) My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the Quick Scan button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

  • Double-click on RKUnhookerLE to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth and uncheck the rest
  • Click OK
  • Wait until it's finished and then go to File > Save Report
  • Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • RKU log

Thanks and again sorry for the delay.

Link to post
Share on other sites

Elise025: It's very nice to hear from you and thanks for your kind assistance rendered on the matter.

Before I go on with your advice, do I leave the scan results untouched and not to have them quarantined and removed? The scan results page is still pending for any action as I am now waiting for your reply!

As soon as I get any reply from you, I will then go ahead with the log report i.e. OTL & RKU log? And there is no need to perform full normal system scan again for updatded log?

Link to post
Share on other sites

OTListIt.txt. :

OTL logfile created on: 2010/10/27 ?? 07:01:04 - Run 1

OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\david\??

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000404 | Country: ?? | Language: CHT | Date Format: yyyy/M/d

1,024.00 Mb Total Physical Memory | 429.00 Mb Available Physical Memory | 42.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 53.00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 58.59 Gb Total Space | 28.49 Gb Free Space | 48.63% Space Free | Partition Type: NTFS

Drive D: | 90.45 Gb Total Space | 62.78 Gb Free Space | 69.41% Space Free | Partition Type: NTFS

Drive E: | 39.12 Gb Total Space | 1.00 Gb Free Space | 2.56% Space Free | Partition Type: NTFS

Drive F: | 18.14 Gb Total Space | 5.13 Gb Free Space | 28.27% Space Free | Partition Type: NTFS

Computer Name: HOME-D38C3AB9C5 | User Name: david | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/10/26 22:09:26 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\david\??\OTL.exe

PRC - [2010/10/08 19:01:42 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe

PRC - [2010/10/03 04:20:00 | 004,537,280 | ---- | M] (SlySoft, Inc.) -- C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

PRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/07/01 21:34:46 | 000,129,720 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe

PRC - [2010/06/18 20:19:50 | 002,787,120 | ---- | M] (?????????????) -- C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\Thunder.exe

PRC - [2010/06/18 01:50:26 | 000,608,048 | ---- | M] (ShenZhen Xunlei Networking Technologies,LTD) -- C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\ThunderService.exe

PRC - [2010/06/02 11:33:34 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2009/09/23 13:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

PRC - [2009/04/10 15:54:34 | 005,374,424 | ---- | M] (http://www.verycd.com) -- C:\Documents and Settings\david\??\eMule_v0.49cbuild1015\emule.exe

PRC - [2009/03/10 13:11:36 | 000,869,696 | ---- | M] (PC Tools Software) -- C:\Program Files\PC Tools Disk Suite\DSService.exe

PRC - [2009/01/16 11:31:48 | 000,267,584 | ---- | M] (PC Tools Software) -- C:\Program Files\PC Tools Disk Suite\aDSProcMngr.exe

PRC - [2008/04/15 20:00:00 | 000,978,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/04/15 20:00:00 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe

PRC - [2007/05/29 00:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

PRC - [2004/07/08 16:13:42 | 000,106,496 | ---- | M] (Sony Corporation.) -- C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe

PRC - [2001/12/15 12:10:36 | 000,036,864 | ---- | M] (Zenographics) -- C:\WINDOWS\system32\zstatus.exe

========== Modules (SafeList) ==========

MOD - [2010/10/26 22:09:26 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\david\??\OTL.exe

MOD - [2010/08/24 00:11:32 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

MOD - [2010/02/05 02:17:27 | 000,129,984 | ---- | M] (SlySoft, Inc.) -- C:\Program Files\SlySoft\AnyDVD\ADvdDiscHlp.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\mosw\saofh.exe -- (TERH)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Sunbelt Software\CounterSpy\SBPIMSvc.exe -- (SBPIMSvc)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe -- (PavPrSrv)

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010/10/08 19:01:42 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)

SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010/04/21 19:55:40 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009/09/23 13:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)

SRV - [2009/03/10 13:11:36 | 000,869,696 | ---- | M] (PC Tools Software) [Auto | Running] -- C:\Program Files\PC Tools Disk Suite\DSService.exe -- (DiskSuiteService)

SRV - [2007/05/29 00:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\TfSysMon.sys -- (TfSysMon)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\TfNetMon.sys -- (TfNetMon)

DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\TfFsMon.sys -- (TfFsMon)

DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\DRIVERS\ShlDrv51.sys -- (ShldDrv)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SBREdrv.sys -- (SBRE)

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\DRIVERS\PavProc.sys -- (PavProc)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\david\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys -- (cpuz132)

DRV - [2010/10/08 19:01:42 | 000,475,736 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)

DRV - [2010/10/01 05:25:16 | 000,030,376 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)

DRV - [2010/09/14 21:16:06 | 000,108,480 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)

DRV - [2010/07/30 18:23:52 | 000,722,416 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010/06/09 17:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)

DRV - [2010/06/09 17:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\kl1.sys -- (KL1)

DRV - [2010/05/07 12:06:26 | 000,032,856 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)

DRV - [2009/11/02 20:27:24 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)

DRV - [2008/04/15 20:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)

DRV - [2008/04/14 21:15:32 | 000,700,928 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2008/04/14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2008/04/14 00:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)

DRV - [2008/04/13 22:05:40 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)

DRV - [2004/03/08 12:55:50 | 000,013,567 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS -- (cdrbsdrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://hk.yahoo.com/

IE - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2010/10/08 18:30:11 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/08/14 18:34:22 | 000,000,766 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 activate.adobe.com

O2 - BHO: (ThunderAtOnce Class) - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\ComDlls\TDMediaDetector.dll (?????????????)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found

O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)

O2 - BHO: (Thunder Browser Helper) - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\ComDlls\xunleiBHO_Now.dll (?????????????)

O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)

O3 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.

O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)

O4 - HKLM..\Run: [Cmaudio] File not found

O4 - HKLM..\Run: [DiskSuite] C:\Program Files\PC Tools Disk Suite\aDSProcMngr.exe (PC Tools Software)

O4 - HKLM..\Run: [hp 1000 firmware] C:\Program Files\hp LaserJet 1000\fwdl.exe (Zenographics)

O4 - HKLM..\Run: [iMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)

O4 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

O4 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003..\Run: [DUTools] C:\Program Files\NamiRobot\DUTool.exe File not found

O4 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003..\Run: [eMuleAutoStart] C:\Documents and Settings\david\??\eMule_v0.49cbuild1015\emule.exe (http://www.verycd.com)

O4 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003..\Run: [Thunder] C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\Thunder.exe (?????????????)

O4 - Startup: C:\Documents and Settings\All Users\???????\???\??\Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe (Sony Corporation)

O4 - Startup: C:\Documents and Settings\All Users\???????\???\??\Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe (Sony Corporation.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1123561945-1532298954-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data]

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()

O8 - Extra context menu item: ?????? - C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\geturl.htm ()

O8 - Extra context menu item: ?????????? - C:\Documents and Settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\getAllurl.htm ()

O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)

O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O20 - AppInit_DLLs: (zipfldra.dll) - File not found

O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky Lab ZAO)

O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\avldr: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)

O24 - Desktop Components:0 (?????) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\david\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\david\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/10/23 10:08:22 | 000,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (MACHINE BootExecut) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/27 06:58:25 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\david\??\OTL.exe

[2010/10/26 22:25:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\My Documents\MbamScanTools

[2010/10/25 22:12:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\My Documents\F-secure_v1.19.0.23237+betaTesting

[2010/10/25 11:40:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\My Documents\Picture Package

[2010/10/24 18:59:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\Local Settings\Application Data\BHO

[2010/10/24 08:32:41 | 000,000,000 | ---D | C] -- C:\eMule_v0.49cbuild1015

[2010/10/24 08:32:35 | 000,000,000 | ---D | C] -- C:\Temp

[2010/10/23 20:14:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\AdvancedSystemCarePro_v3.7.2.0

[2010/10/23 10:48:00 | 000,151,552 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm

[2010/10/23 10:47:59 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll

[2010/10/23 10:47:45 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2010/10/23 09:58:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\muvee Technologies

[2010/10/23 09:58:40 | 000,000,000 | ---D | C] -- C:\Program Files\Sony Corporation

[2010/10/22 19:14:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\__??.[??_?.1024???]

[2010/10/22 17:04:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\Saw.6.2009.R5.LiNE.XviD.AC3-Rx

[2010/10/22 16:47:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\??

[2010/10/19 00:25:03 | 000,000,000 | ---D | C] -- C:\AvastKeyFiles

[2010/10/15 19:27:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/10/15 19:27:25 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/10/15 19:27:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/10/15 00:45:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\WinPatrolPlus_v18.0.2010+kygen

[2010/10/10 21:29:50 | 000,000,000 | ---D | C] -- C:\???

[2010/10/08 18:28:48 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab

[2010/10/08 18:28:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

[2010/10/08 18:28:09 | 000,475,736 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys

[2010/10/08 18:25:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files

[2010/10/06 14:51:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\Local Settings\Application Data\Threat Expert

[2010/10/05 20:54:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\Application Data\Panda Security

[2010/10/05 20:50:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\Application Data\SurfSecret Privacy Suite

[2010/10/05 20:47:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Panda Security

[2010/10/05 15:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\SlySoft

[2010/10/01 20:18:22 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8

[2010/10/01 20:14:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\My Documents\PcSetup

[2010/10/01 05:25:16 | 000,030,376 | ---- | C] (Elaborate Bytes AG) -- C:\WINDOWS\System32\drivers\ElbyCDIO.sys

[2010/09/30 19:18:24 | 000,089,256 | ---- | C] (Elaborate Bytes AG) -- C:\WINDOWS\System32\ElbyCDIO.dll

[2010/09/29 23:27:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\david\??\????

[2010/09/29 20:14:53 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2010/09/29 20:14:43 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2010/09/29 20:01:37 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour

[2010/04/21 18:17:24 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\david\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/10/26 22:09:26 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\david\??\OTL.exe

[2010/10/26 22:08:42 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\david\??\RKUnhookerLE.EXE

[2010/10/25 17:45:57 | 000,002,361 | ---- | M] () -- C:\Documents and Settings\david\??\Microsoft Office Word 2003.lnk

[2010/10/25 09:38:45 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1123561945-1532298954-1417001333-1003.job

[2010/10/25 09:38:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/10/25 09:38:23 | 1073,319,936 | -HS- | M] () -- C:\hiberfil.sys

[2010/10/24 11:36:25 | 000,927,744 | ---- | M] () -- C:\Documents and Settings\david\My Documents\KIS2011????.doc

[2010/10/23 23:05:15 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1123561945-1532298954-1417001333-1003.job

[2010/10/23 12:24:19 | 000,081,983 | ---- | M] () -- C:\Documents and Settings\david\??\????.htm

[2010/10/23 10:08:22 | 000,000,100 | ---- | M] () -- C:\AUTOEXEC.BAT

[2010/10/23 10:02:06 | 000,000,893 | ---- | M] () -- C:\Documents and Settings\All Users\??\Picture Package Menu.lnk

[2010/10/23 10:02:06 | 000,000,887 | ---- | M] () -- C:\Documents and Settings\All Users\??\Picture Package???????.lnk

[2010/10/23 10:02:05 | 000,000,763 | ---- | M] () -- C:\Documents and Settings\All Users\???????\???\??\Picture Package Menu.lnk

[2010/10/23 10:01:19 | 000,000,813 | ---- | M] () -- C:\Documents and Settings\All Users\???????\???\??\Picture Package VCD Maker.lnk

[2010/10/22 18:54:20 | 000,012,288 | ---- | M] () -- C:\Documents and Settings\david\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/10/21 19:16:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/10/18 16:52:05 | 000,501,248 | ---- | M] () -- C:\Documents and Settings\david\My Documents\APE??????.doc

[2010/10/18 16:00:00 | 000,108,032 | ---- | M] () -- C:\WINDOWS\System32\ff_vfw.dll

[2010/10/18 16:00:00 | 000,000,038 | ---- | M] () -- C:\WINDOWS\avisplitter.ini

[2010/10/17 20:15:25 | 000,002,391 | ---- | M] () -- C:\Documents and Settings\david\??\Microsoft Office Outlook 2003.lnk

[2010/10/17 17:32:31 | 000,004,205 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI

[2010/10/15 19:27:35 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\??\Malwarebytes' Anti-Malware.lnk

[2010/10/15 01:05:29 | 000,002,527 | ---- | M] () -- C:\Documents and Settings\All Users\??\Rapidshare Auto Downloader.lnk

[2010/10/13 22:37:57 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\david\??\???????.doc

[2010/10/13 17:44:21 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/10/13 13:36:30 | 000,254,272 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/10/08 20:06:25 | 000,002,341 | ---- | M] () -- C:\Documents and Settings\All Users\??\iTunes.lnk

[2010/10/08 19:12:29 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\??\Adobe Reader 9.4.lnk

[2010/10/08 19:01:42 | 000,475,736 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys

[2010/10/08 18:32:19 | 000,113,933 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat

[2010/10/08 18:32:19 | 000,097,549 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat

[2010/10/08 18:32:02 | 000,000,843 | ---- | M] () -- C:\Documents and Settings\david\??\Kaspersky Internet Security 2011.lnk

[2010/10/08 00:31:54 | 000,063,488 | ---- | M] () -- C:\Documents and Settings\david\My Documents\Panda Cloud Antivirus.doc

[2010/10/06 09:49:51 | 000,000,012 | ---- | M] () -- C:\Documents and Settings\david\intlname.ols

[2010/10/06 09:37:37 | 000,553,876 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB

[2010/10/06 01:20:20 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\david\My Documents\~$??????.doc

[2010/10/05 20:18:58 | 000,435,840 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/10/05 20:18:58 | 000,335,010 | ---- | M] () -- C:\WINDOWS\System32\prfh0404.dat

[2010/10/05 20:18:58 | 000,166,942 | ---- | M] () -- C:\WINDOWS\System32\prfc0404.dat

[2010/10/05 20:18:58 | 000,068,544 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/10/05 15:38:58 | 000,000,754 | ---- | M] () -- C:\Documents and Settings\All Users\??\AnyDVD.lnk

[2010/10/05 00:25:49 | 000,033,280 | ---- | M] () -- C:\Documents and Settings\david\My Documents\F-secure.doc

[2010/10/01 20:18:39 | 000,087,608 | ---- | M] () -- C:\Documents and Settings\david\Application Data\inst.exe

[2010/10/01 20:18:39 | 000,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\david\Application Data\pcouffin.sys

[2010/10/01 20:18:39 | 000,007,887 | ---- | M] () -- C:\Documents and Settings\david\Application Data\pcouffin.cat

[2010/10/01 20:18:39 | 000,001,144 | ---- | M] () -- C:\Documents and Settings\david\Application Data\pcouffin.inf

[2010/10/01 20:18:35 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\david\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8.lnk

[2010/10/01 20:18:35 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\david\??\DVDFab 8.lnk

[2010/10/01 05:25:16 | 000,030,376 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\System32\drivers\ElbyCDIO.sys

[2010/09/30 19:18:24 | 000,089,256 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\System32\ElbyCDIO.dll

[2010/09/27 12:19:29 | 000,040,448 | ---- | M] () -- C:\Documents and Settings\david\My Documents\abc??.doc

========== Files Created - No Company Name ==========

[2010/10/27 06:58:25 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\david\??\RKUnhookerLE.EXE

[2010/10/24 11:36:22 | 000,927,744 | ---- | C] () -- C:\Documents and Settings\david\My Documents\KIS2011????.doc

[2010/10/23 12:24:18 | 000,081,983 | ---- | C] () -- C:\Documents and Settings\david\??\????.htm

[2010/10/23 10:48:21 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini

[2010/10/23 10:47:58 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2010/10/23 10:47:57 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2010/10/23 10:47:55 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2010/10/23 10:02:06 | 000,000,893 | ---- | C] () -- C:\Documents and Settings\All Users\??\Picture Package Menu.lnk

[2010/10/23 10:02:06 | 000,000,887 | ---- | C] () -- C:\Documents and Settings\All Users\??\Picture Package???????.lnk

[2010/10/23 10:02:05 | 000,000,763 | ---- | C] () -- C:\Documents and Settings\All Users\???????\???\??\Picture Package Menu.lnk

[2010/10/23 10:01:51 | 000,001,458 | ---- | C] () -- C:\WINDOWS\System32\LTOCX12n.INF

[2010/10/23 10:01:19 | 000,000,813 | ---- | C] () -- C:\Documents and Settings\All Users\???????\???\??\Picture Package VCD Maker.lnk

[2010/10/18 16:52:05 | 000,501,248 | ---- | C] () -- C:\Documents and Settings\david\My Documents\APE??????.doc

[2010/10/15 19:27:35 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\??\Malwarebytes' Anti-Malware.lnk

[2010/10/08 19:12:29 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\??\Adobe Reader 9.4.lnk

[2010/10/08 18:34:39 | 000,000,843 | ---- | C] () -- C:\Documents and Settings\david\??\Kaspersky Internet Security 2011.lnk

[2010/10/08 18:32:19 | 000,113,933 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat

[2010/10/08 18:32:19 | 000,097,549 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat

[2010/10/07 18:30:49 | 000,063,488 | ---- | C] () -- C:\Documents and Settings\david\My Documents\Panda Cloud Antivirus.doc

[2010/10/06 09:37:23 | 000,553,876 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB

[2010/10/06 02:58:44 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\david\??\???????.doc

[2010/10/06 01:20:20 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\david\My Documents\~$??????.doc

[2010/10/05 15:38:58 | 000,000,754 | ---- | C] () -- C:\Documents and Settings\All Users\??\AnyDVD.lnk

[2010/10/04 23:59:30 | 000,033,280 | ---- | C] () -- C:\Documents and Settings\david\My Documents\F-secure.doc

[2010/10/01 20:18:35 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\david\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8.lnk

[2010/10/01 20:18:35 | 000,000,670 | ---- | C] () -- C:\Documents and Settings\david\??\DVDFab 8.lnk

[2010/09/29 20:16:52 | 000,002,341 | ---- | C] () -- C:\Documents and Settings\All Users\??\iTunes.lnk

[2010/09/27 12:19:28 | 000,040,448 | ---- | C] () -- C:\Documents and Settings\david\My Documents\abc??.doc

[2010/09/07 18:19:08 | 000,000,426 | ---- | C] () -- C:\WINDOWS\AvDetected.ini

[2010/08/13 08:15:48 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2010/07/27 09:02:14 | 000,000,065 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2010/06/02 10:36:28 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib

[2010/05/25 22:25:38 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\david\Application Data\default.rss

[2010/05/25 22:23:26 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010/05/08 10:57:16 | 000,012,288 | ---- | C] () -- C:\Documents and Settings\david\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/04/25 15:01:38 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010/04/22 15:10:52 | 000,233,525 | ---- | C] () -- C:\WINDOWS\System32\isutil.dll

[2010/04/22 15:10:50 | 000,000,271 | ---- | C] () -- C:\WINDOWS\apptune.ini

[2010/04/21 21:32:16 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll

[2010/04/21 18:17:24 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\david\Application Data\inst.exe

[2010/04/21 18:17:24 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\david\Application Data\pcouffin.cat

[2010/04/21 18:17:24 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\david\Application Data\pcouffin.inf

[2010/04/21 15:50:07 | 000,722,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2010/04/21 00:27:02 | 000,000,379 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2010/04/20 23:57:22 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2003/03/06 20:17:30 | 000,004,881 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2003/02/19 01:26:28 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll

========== LOP Check ==========

[2010/09/23 08:39:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[2010/05/28 21:10:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ashampoo

[2010/06/04 22:13:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Backup

[2010/07/26 21:53:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bqckup

[2010/06/04 21:11:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

[2010/04/22 12:03:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz

[2010/10/01 03:03:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grid

[2010/05/28 22:31:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\page

[2010/10/05 20:47:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security

[2010/08/01 20:45:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Software

[2010/07/17 08:51:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\River Past G5

[2010/10/05 15:39:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft

[2010/10/27 04:13:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/08/04 00:45:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Thunder Network

[2010/06/08 12:18:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk

[2010/04/21 21:51:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/05/28 21:56:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\Ashampoo

[2010/08/25 10:30:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\foobar2000

[2010/10/05 20:54:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\Panda Security

[2010/07/17 08:48:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\River Past G5

[2010/10/05 20:50:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\SurfSecret Privacy Suite

[2010/05/25 21:17:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\Thinstall

[2010/10/01 20:18:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\Vso

[2010/05/19 23:10:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\david\Application Data\Xunlei

========== Purity Check ==========

========== Files - Unicode (All) ==========

[2010/08/07 09:29:06 | 000,001,404 | ---- | M] ()(C:\??????????.txt) -- C:\??????????.txt

[2010/08/07 08:50:56 | 000,001,404 | ---- | C] ()(C:\??????????.txt) -- C:\??????????.txt

[2010/08/07 08:50:43 | 000,000,000 | ---D | M](C:\????????) -- C:\????????

[2010/08/07 08:50:43 | 000,000,000 | ---D | C](C:\????????) -- C:\????????

========== Alternate Data Streams ==========

@Alternate Data Stream - 197 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:556BBACC

@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84

< End of report >

Extra.txt. :

OTL Extras logfile created on: 2010/10/27 ?? 07:01:04 - Run 1

OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\david\??

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000404 | Country: ?? | Language: CHT | Date Format: yyyy/M/d

1,024.00 Mb Total Physical Memory | 429.00 Mb Available Physical Memory | 42.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 53.00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 58.59 Gb Total Space | 28.49 Gb Free Space | 48.63% Space Free | Partition Type: NTFS

Drive D: | 90.45 Gb Total Space | 62.78 Gb Free Space | 69.41% Space Free | Partition Type: NTFS

Drive E: | 39.12 Gb Total Space | 1.00 Gb Free Space | 2.56% Space Free | Partition Type: NTFS

Drive F: | 18.14 Gb Total Space | 5.13 Gb Free Space | 28.27% Space Free | Partition Type: NTFS

Computer Name: HOME-D38C3AB9C5 | User Name: david | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1" (Ventis Media Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 1

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)

"C:\Documents and Settings\david\Local Settings\Temp\Torrent2Exe\T2E.exe" = C:\Documents and Settings\david\Local Settings\Temp\Torrent2Exe\T2E.exe:*:Enabled:Torrent2Exe -- File not found

"C:\Documents and Settings\david\??\Thunder v5.9.3.951\Program\THUNDER.EXE" = C:\Documents and Settings\david\??\Thunder v5.9.3.951\Program\THUNDER.EXE:*:Enabled:Thunder -- File not found

"C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\ThunderService.exe" = C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\ThunderService.exe:*:Enabled:ThunderService1.0.2.77 -- (ShenZhen Xunlei Networking Technologies,LTD)

"C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\ThunderLiveUD.exe" = C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\ThunderLiveUD.exe:*:Enabled:ThunderLiveUD1.0.2.77 -- (Thunder Networking Technologies,LTD)

"C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\XLBugReport.exe" = C:\Program Files\Common Files\Thunder Network\DS\Ver1\1.0.2.77\XLBugReport.exe:*:Enabled:XLBugReport1.0.2.77 -- ()

"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}" = Adobe Flash Player 10 Plugin

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler

"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4

"{0e96fcbd-74a7-4446-9861-039d6ead30b6}" = Nero LiquidTV

"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4

"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB

"{1E2F8AE3-3437-44E6-BB75-E95751D6B83F}" = Picture Package

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java 6 Update 22

"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes

"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0

"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed

"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types

"{350C97B6-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode

"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent

"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4

"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin

"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit

"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision

"{44C3CFD4-2194-4809-A1D2-EE32258A6FBB}" = Adobe Color JA Recommended Settings CS4

"{47C6F987-685A-41AE-B092-E75B277AEE39}" = Adobe Flash CS4 Extension - Flash Lite STI others

"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress

"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver

"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support

"{6131b28c-4dea-487b-8775-de100b55882e}" = Nero MediaHome 4

"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner

"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011

"{6cb15beb-28f8-41fa-ac3a-5846c90d9e8b}" = Nero 9

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart

"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights

"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4

"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed

"{899ea971-29f0-402b-a736-0c9a5e20e05a}" = Nero BackItUp 4

"{90110404-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4

"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4

"{975C8028-51D8-44A9-9585-82E9810FE96A}" = HP LaserJet 1000

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9acd03d7-4743-4d1a-9d15-aa16cb6b3fb7}" = Nero InCD-Reader

"{9CC5E685-58F5-4238-AA90-C803BCC6ED8B}" = Rapidshare Auto Downloader 3.8.2

"{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap

"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress

"{AC76BA86-7AD7-1028-7B44-A94000000001}" = Adobe Reader 9.4.0 - Chinese Traditional

"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{B132E67C-EEA5-492B-B368-543CD88D8569}" = AnyDVD Registration

"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles

"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect

"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center

"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit

"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module

"{BD3374D3-C2E6-42B7-A80B-E850B6886246}" = Adobe Flash CS4 STI-other

"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4

"{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax

"{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook Personal Folders Backup

"{CAAD9070-2642-4068-BA0B-E0BC5605270C}" = PDF Settings CS4

"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw

"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM

"{d2b04c79-fccb-4948-a16c-2077d384eb60}" = Nero Move it

"{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime

"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support

"{de32e2db-e267-4f5f-b561-1ed5aa7b06e8}" = SecurDisc Viewer

"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit

"{E5FCED12-3E77-4C0E-A305-5AEB38A52A70}" = AdobeColorCommonSetCMYK

"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime

"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer

"{EED50C97-C79E-4149-BD82-7C5A22437708}" = Adobe Setup

"{ef74ee1e-5f5f-4e61-9d36-f2e9957a3e97}" = Nero LiquidTV

"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help

"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0

"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects

"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4

"{F8C6BABF-0837-4EA0-AD6C-8E5A392A7538}" = ImageMixer VCD2

"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4

"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4

"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool

"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour

"Adobe_a68eec966ce913ddaa63251dc82ed31" = Adobe Flash CS4 Professional

"AnyDVD" = AnyDVD

"Audio Converter Pro" = River Past Audio Converter Pro

"C-Media Audio Driver" = C-Media WDM Audio Driver

"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2009-09-09

"DS-Monkey Audio Source" = DS-Monkey Audio Source 1.00

"DVDFab 8_is1" = DVDFab 8.0.2.1 (30/09/2010)

"foobar2000" = foobar2000 v1.1

"GOGOBOX" = GOGOBOX

"ie8" = Windows Internet Explorer 8

"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011

"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.5.0

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"MediaMonkey_is1" = MediaMonkey 2.5 Language Pack 1.7

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"PC Tools Disk Suite_is1" = PC Tools Disk Suite 1.0

"RealAlt_is1" = Real Alternative 2.0.2

"RealPlayer 12.0" = RealPlayer

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinRAR archiver" = WinRAR ????

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1123561945-1532298954-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

< End of report >

Link to post
Share on other sites

RKU log :

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>Drivers

==============================================

0xF71C9000 kl1.sys 5382144 bytes (Kaspersky Lab ZAO, Kaspersky Unified Driver)

0x804D8000 C:\WINDOWS\system32\ntoskrnl.exe 2189824 bytes (Microsoft Corporation, NT Kernel & System)

0x804D8000 PnpManager 2189824 bytes

0x804D8000 RAW 2189824 bytes

0x804D8000 WMIxWDM 2189824 bytes

0xBF080000 C:\WINDOWS\System32\ati3duag.dll 1892352 bytes (ATI Technologies Inc. , ati3duag.dll)

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xF6C34000 C:\WINDOWS\system32\drivers\cmuda.sys 1376256 bytes (C-Media Inc, C-Media Audio WDM Driver)

0xF70C8000 PCI_PNP7622 1052672 bytes

0xF70C8000 spay.sys 1052672 bytes

0xF70C8000 sptd 1052672 bytes

0xF6AB7000 C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys 1044480 bytes (Conexant Systems, Inc., HSF_DP driver)

0xF6DE8000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 815104 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)

0xF6A0F000 C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys 688128 bytes (Conexant Systems, Inc., HSF_CNXT driver)

0xF6F3E000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xBF24E000 C:\WINDOWS\System32\ativvaxx.dll 520192 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)

0xAA759000 C:\WINDOWS\system32\DRIVERS\klif.sys 520192 bytes (Kaspersky Lab, Klif Mini-Filter [fre_wnet_x86])

0xAA59A000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xF685B000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xAA6A5000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xA8B92000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)

0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)

0xA87E1000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xBF048000 C:\WINDOWS\System32\ati2cqag.dll 229376 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)

0xF69D9000 C:\WINDOWS\System32\Drivers\ahw8car7.SYS 221184 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 221184 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)

0xF6BB6000 C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys 221184 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)

0xF68B9000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xF7082000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xA9774000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xF6F11000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xA7BFC000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xAA60A000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xAA67D000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF702C000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)

0xAA657000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xA7F9A000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xF6C10000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xF6BEC000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xF6D84000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xAA635000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x806EF000 ACPI_HAL 131840 bytes

0x806EF000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF6FF4000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF7052000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xF6EF7000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF6DA7000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 102400 bytes (SlySoft, Inc., AnyDVD Filter Driver)

0xF7014000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xAA4BA000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xF70B0000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)

0xF6FCB000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xF699A000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xA9DB5000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xF6DC0000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xF6DD4000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xAA6FE000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF6FE2000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xF7071000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xF6989000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xF6979000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xF77DC000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF77FC000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xF779C000 C:\WINDOWS\system32\DRIVERS\serial.sys 61440 bytes (Microsoft Corporation, Serial Device Driver)

0xAA27A000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF78EC000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF77EC000 C:\WINDOWS\system32\DRIVERS\redbook.sys 57344 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xF774C000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF781C000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF77AC000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 49152 bytes (Microsoft Corporation, i8042 Port Driver)

0xF785C000 C:\WINDOWS\System32\Drivers\pcouffin.sys 49152 bytes (VSO Software, low level access layer for CD/DVD/BD devices)

0xF783C000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF772C000 VolSnap.sys 49152 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xF792C000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF77CC000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF771C000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF782C000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF793C000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 40960 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)

0xF778C000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 40960 bytes (Microsoft Corporation, Processor Device Driver)

0xF780C000 C:\WINDOWS\system32\DRIVERS\klim5.sys 40960 bytes (Kaspersky Lab ZAO, Kaspersky Lab Intermediate Network Driver)

0xF787C000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF786C000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF773C000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF770C000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF77BC000 C:\WINDOWS\system32\DRIVERS\klmouflt.sys 36864 bytes (Kaspersky Lab, KLMOUFLT Mouse Device Filter [fre_wnet_x86])

0xF784C000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF791C000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xA8B5A000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xF790C000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF7A44000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)

0xF7A14000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF7A2C000 C:\WINDOWS\system32\DRIVERS\sisnic.sys 32768 bytes (SiS Corporation, SiS PCI Fast Ethernet Adapter Driver)

0xF7A24000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xF79B4000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xF798C000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF79FC000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)

0xF79CC000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF7A34000 C:\WINDOWS\system32\DRIVERS\kl2.sys 24576 bytes (Kaspersky Lab ZAO, Kaspersky Unified Driver)

0xF79E4000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xF79EC000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF7B0C000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xF7A04000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF7994000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF7AD4000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF7AE4000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF7AC4000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xF7A1C000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)

0xF7A84000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xF7BC8000 C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS 16384 bytes (B.H.A Corporation, CD-ROM Filter Driver for Windows2000/xp)

0xF6EC3000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xF684B000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF7BAC000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF7B1C000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xAA7D8000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xF7BEC000 C:\WINDOWS\system32\DRIVERS\fsvga.sys 12288 bytes (Microsoft Corporation, Full Screen Video Driver)

0xF7BB8000 C:\WINDOWS\system32\DRIVERS\gameenum.sys 12288 bytes (Microsoft Corporation, Game Port Enumerator)

0xA8BEE000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)

0xF7BF8000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xF69C9000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF7C34000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF7C10000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xF7C48000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xF7C30000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF7C0C000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF7C38000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF7C80000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)

0xF7C3C000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF7C1E000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF7C2A000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7C0E000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF7D05000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7E09000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xF7D98000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xF7CD4000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0x86FE01F8 unknown_irp_handler 3592 bytes

0x85E6B1F8 unknown_irp_handler 3592 bytes

0x86E811F8 unknown_irp_handler 3592 bytes

0x86F9C1F8 unknown_irp_handler 3592 bytes

0x86E671F8 unknown_irp_handler 3592 bytes

0x86E661F8 unknown_irp_handler 3592 bytes

0x86FD2500 unknown_irp_handler 2816 bytes

0x86B92500 unknown_irp_handler 2816 bytes

0x86E52500 unknown_irp_handler 2816 bytes

0x86B98500 unknown_irp_handler 2816 bytes

0x86B24500 unknown_irp_handler 2816 bytes

==============================================

>Stealth

==============================================

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x218, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x85B08551 LDT (IN GDT of Core 1) Modification, Base+0x278, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x3D0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x854886C4 LDT (IN GDT of Core 1) Modification, Base+0x3D8, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x85A80000 LDT (IN GDT of Core 1) Modification, Base+0x3F0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xA90, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0xBF8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xC48, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x85708583 LDT (IN GDT of Core 1) Modification, Base+0xD80, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B0001 LDT (IN GDT of Core 1) Modification, Base+0xE78, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x8424AA6A LDT (IN GDT of Core 1) Modification, Base+0xE98, DPL_USER, Rpl : 2, Type: CallGate32, Core [1]

0x84D084A7 LDT (IN GDT of Core 1) Modification, Base+0x028, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1]

0x684B001D LDT (IN GDT of Core 1) Modification, Base+0x120, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B000D LDT (IN GDT of Core 1) Modification, Base+0x2A0, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x841CE354 LDT (IN GDT of Core 1) Modification, Base+0x430, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x4E0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x000E0000 LDT (IN GDT of Core 1) Modification, Base+0x518, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x84D0856D LDT (IN GDT of Core 1) Modification, Base+0x630, DPL_USER, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x960, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0xE4080038 LDT (IN GDT of Core 1) Modification, Base+0xBC0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x85240000 LDT (IN GDT of Core 1) Modification, Base+0xC28, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x85E08551 LDT (IN GDT of Core 1) Modification, Base+0xC68, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1]

0x8570856D LDT (IN GDT of Core 1) Modification, Base+0xCB8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x108, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0001 LDT (IN GDT of Core 1) Modification, Base+0x180, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x1F8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x2B0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x85B0E358 LDT (IN GDT of Core 1) Modification, Base+0x2F8, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x428, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x478, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x8464E2DC LDT (IN GDT of Core 1) Modification, Base+0x698, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xA78, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xB70, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xEB0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0001 LDT (IN GDT of Core 1) Modification, Base+0xF00, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xF08, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x858884E4 LDT (IN GDT of Core 1) Modification, Base+0x0E0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x634B0002 LDT (IN GDT of Core 1) Modification, Base+0x368, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x85588576 LDT (IN GDT of Core 1) Modification, Base+0x540, DPL_USER, Rpl : 2, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0x6E0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x858885A5 LDT (IN GDT of Core 1) Modification, Base+0xA28, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x85D885A5 LDT (IN GDT of Core 1) Modification, Base+0xAB8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x85CC0000 LDT (IN GDT of Core 1) Modification, Base+0xCD0, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x85DC0000 LDT (IN GDT of Core 1) Modification, Base+0xCE0, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x634B0002 LDT (IN GDT of Core 1) Modification, Base+0xD60, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x260, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x2B0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x348, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0xE2500078 LDT (IN GDT of Core 1) Modification, Base+0x418, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0x470, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x4C0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x5C8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x8470856D LDT (IN GDT of Core 1) Modification, Base+0x6B0, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1]

0x684B000D LDT (IN GDT of Core 1) Modification, Base+0x728, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0001 LDT (IN GDT of Core 1) Modification, Base+0x7B8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x800, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x8A0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x84C086C4 LDT (IN GDT of Core 1) Modification, Base+0x8A8, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0x9F0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xB68, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x85088599 LDT (IN GDT of Core 1) Modification, Base+0xD28, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xDD8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0xFB8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0xE4200038 LDT (IN GDT of Core 1) Modification, Base+0x110, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x150, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0x208, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x3C0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0x448, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0x658, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x85040000 LDT (IN GDT of Core 1) Modification, Base+0xC08, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1]

0x84508590 LDT (IN GDT of Core 1) Modification, Base+0xC80, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1]

0x854084D4 LDT (IN GDT of Core 1) Modification, Base+0xC88, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1]

0x8570857D LDT (IN GDT of Core 1) Modification, Base+0xD58, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xDD8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x0E0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x290, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x6D6B8586 LDT (IN GDT of Core 1) Modification, Base+0x3B0, DPL_USER, Rpl : 2, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0x498, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0x7C0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xA08, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0003 LDT (IN GDT of Core 1) Modification, Base+0xCE0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xCF8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x84A086C4 LDT (IN GDT of Core 1) Modification, Base+0xD00, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xDA8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B001D LDT (IN GDT of Core 1) Modification, Base+0xE50, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x861884F5 LDT (IN GDT of Core 1) Modification, Base+0xF58, DPL_USER, Rpl : 1, Type: CallGate32, Core [1]

0x8668856D LDT (IN GDT of Core 1) Modification, Base+0xF68, DPL_USER, Rpl : 1, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x0E0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x188, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x2F0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x400, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B0015 LDT (IN GDT of Core 1) Modification, Base+0x510, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0x568, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x6B8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x828, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x8E0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xAC8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0001 LDT (IN GDT of Core 1) Modification, Base+0xB98, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x859C0000 LDT (IN GDT of Core 1) Modification, Base+0xCA0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xD58, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xF90, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x85708575 LDT (IN GDT of Core 1) Modification, Base+0x028, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1]

0x684B000B LDT (IN GDT of Core 1) Modification, Base+0x3B0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x851886B1 LDT (IN GDT of Core 1) Modification, Base+0x580, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0003 LDT (IN GDT of Core 1) Modification, Base+0x590, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x5A8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B001F LDT (IN GDT of Core 1) Modification, Base+0x638, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0002 LDT (IN GDT of Core 1) Modification, Base+0x688, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x730, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0001 LDT (IN GDT of Core 1) Modification, Base+0x938, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x940, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B001D LDT (IN GDT of Core 1) Modification, Base+0x9D8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0xCE8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x8508856D LDT (IN GDT of Core 1) Modification, Base+0xD68, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x85B4E4F2 LDT (IN GDT of Core 1) Modification, Base+0xE18, DPL_USER, Rpl : 2, Type: CallGate32, Core [1]

0x8628856D LDT (IN GDT of Core 1) Modification, Base+0xF48, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x0E0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x130, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x1F0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x852086FC LDT (IN GDT of Core 1) Modification, Base+0x270, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x634B0002 LDT (IN GDT of Core 1) Modification, Base+0x3A0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x84E00900 LDT (IN GDT of Core 1) Modification, Base+0x3D8, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x418, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x808, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B000D LDT (IN GDT of Core 1) Modification, Base+0xBD8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0xBF0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xC40, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x85A0856D LDT (IN GDT of Core 1) Modification, Base+0xCA8, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xE30, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0xFB8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x008, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x120, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x348, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B002C LDT (IN GDT of Core 1) Modification, Base+0x398, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1]

0x8584E2DF LDT (IN GDT of Core 1) Modification, Base+0x568, DPL_USER, Rpl : 3, Type: CallGate32, Core [1]

0x684B020A LDT (IN GDT of Core 1) Modification, Base+0x728, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0022 LDT (IN GDT of Core 1) Modification, Base+0xA08, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xB80, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0xDF0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x9C67E0DA LDT (IN GDT of Core 1) Modification, Base+0x318, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x418, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x748, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0x798, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x820, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x850C0000 LDT (IN GDT of Core 1) Modification, Base+0xC10, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x853C0000 LDT (IN GDT of Core 1) Modification, Base+0xC40, DPL_USER, Rpl : 0, Type: CallGate32, Core [1]

0x684B000A LDT (IN GDT of Core 1) Modification, Base+0xC50, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B0A0A LDT (IN GDT of Core 1) Modification, Base+0xCA0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x854CE3FA LDT (IN GDT of Core 1) Modification, Base+0xE98, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1]

0x684B001D LDT (IN GDT of Core 1) Modification, Base+0xF20, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1]

0x684B000B LDT (IN GDT of Core 1) Modification, Base+0x008, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

0x634B0A0F LDT (IN GDT of Core 1) Modification, Base+0x0C0, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1]

WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]

Link to post
Share on other sites

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

elise015:Thanks for the reply. For the time being, do I perform ComboFix installation first or I have the MBAM complete scan again to have those malwares removed before the ComboFix installation? For the temporary disabling of MBAM, I notice that the reference enclosed is only for registered version and mine is trial version. Do I have to register it first and follow those instrctions given?

Link to post
Share on other sites

elise025: I have downloaded ComboFix. Do you mean I disable Kaspersky protection now and takes no concern of MBAM by executing ComboFix direct? While executing ComboFix, Windows Microsoft Recovery Console will be automatically installed if it is being detected absent in the System?

Link to post
Share on other sites

Do you mean I disable Kaspersky protection now and takes no concern of MBAM by executing ComboFix direct? While executing ComboFix, Windows Microsoft Recovery Console will be automatically installed if it is being detected absent in the System?
Yes, disable Kaspersky. MBAM will be no problem.

Combofix will automatically prompt you to install the Recovery Console.

Link to post
Share on other sites

ComboFix 10-10-26.04 - david /10/28 ??? 20:05:22.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.950.886.1028.18.1024.696 [GMT 8:00]

????: c:\documents and settings\david\??\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Panda Cloud Antivirus *disabled* (Updated) {3C6467D5-0CB7-4322-B2CA-E08614E5D9B5}

SP: Spy Emergency *enabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}

?? - ????????????? ??

.

((((((((((((((((((((((((((((((((((((((( ?????? )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\page

c:\documents and settings\All Users\Application Data\page\page.ico

c:\documents and settings\All Users\Application Data\page\page.URL

c:\documents and settings\david\Application Data\inst.exe

c:\windows\system32\spool\prtprocs\w32x86\pcldll6l.dll

c:\windows\system32\spool\prtprocs\w32x86\zpp.dll

.

((((((((((((((((((((((((( 2010-09-28 ? 2010-10-28 ????? )))))))))))))))))))))))))))))))

.

2010-10-28 12:29 . 2010-10-28 12:29 -------- d-----w- C:\eMule_v0.49cbuild1015

2010-10-24 10:59 . 2010-10-24 10:59 -------- d-----w- c:\documents and settings\david\Local Settings\Application Data\BHO

2010-10-24 00:32 . 2010-10-24 00:32 -------- d-----w- C:\Temp

2010-10-23 02:48 . 2006-10-18 18:05 232448 ----a-w- c:\windows\system32\mp3fhg.acm

2010-10-23 02:48 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm

2010-10-23 02:47 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll

2010-10-23 02:47 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll

2010-10-23 02:47 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll

2010-10-23 02:47 . 2010-10-18 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll

2010-10-23 02:47 . 2010-10-25 01:45 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-10-23 01:58 . 2010-10-23 01:58 -------- d-----w- c:\program files\Common Files\muvee Technologies

2010-10-23 01:58 . 2010-10-23 02:01 -------- d-----w- c:\program files\Sony Corporation

2010-10-18 16:25 . 2010-10-23 08:02 -------- d-----w- C:\AvastKeyFiles

2010-10-15 11:27 . 2010-04-29 07:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-15 11:27 . 2010-10-15 11:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-15 11:27 . 2010-04-29 07:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-10 13:29 . 2010-10-10 13:31 -------- d-----w- C:\???

2010-10-08 10:32 . 2010-10-08 10:32 97549 ----a-w- c:\windows\system32\drivers\klick.dat

2010-10-08 10:32 . 2010-10-08 10:32 113933 ----a-w- c:\windows\system32\drivers\klin.dat

2010-10-08 10:28 . 2010-10-28 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2010-10-08 10:28 . 2010-10-08 10:28 -------- d-----w- c:\program files\Kaspersky Lab

2010-10-08 10:25 . 2010-10-08 10:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2010-10-06 06:51 . 2010-10-06 06:51 -------- d-----w- c:\documents and settings\david\Local Settings\Application Data\Threat Expert

2010-10-06 01:46 . 2010-10-06 01:46 -------- d-----w- c:\documents and settings\LocalService\???????

2010-10-05 12:54 . 2010-10-05 12:54 -------- d-----w- c:\documents and settings\david\Application Data\Panda Security

2010-10-05 12:50 . 2010-10-05 12:50 -------- d-----w- c:\documents and settings\david\Application Data\SurfSecret Privacy Suite

2010-10-05 12:47 . 2010-10-05 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security

2010-10-05 07:38 . 2010-10-05 07:38 -------- d-----w- c:\program files\SlySoft

2010-10-01 12:18 . 2010-10-01 12:19 -------- d-----w- c:\program files\DVDFab 8

2010-09-30 21:25 . 2010-09-30 21:25 30376 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys

2010-09-30 11:18 . 2010-09-30 11:18 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll

2010-09-29 12:14 . 2010-09-29 12:14 -------- d-----w- c:\program files\iPod

2010-09-29 12:14 . 2010-09-29 12:16 -------- d-----w- c:\program files\iTunes

2010-09-29 12:01 . 2010-09-29 12:01 -------- d-----w- c:\program files\Bonjour

.

(((((((((((((((((((((((((((((((((((((((( ??????????? ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-01 12:18 . 2010-04-21 10:17 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys

2010-10-01 12:18 . 2010-04-21 10:17 47360 ----a-w- c:\documents and settings\david\Application Data\pcouffin.sys

2010-09-18 06:52 . 2008-04-15 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll

2010-09-18 06:52 . 2008-04-15 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll

2010-09-18 06:52 . 2008-04-15 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll

2010-09-18 04:22 . 2008-04-15 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll

2010-09-14 20:50 . 2010-04-23 15:23 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-14 18:29 . 2010-08-21 02:19 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-09-14 13:16 . 2010-09-14 13:16 108480 ----a-w- c:\windows\system32\drivers\AnyDVD.sys

2010-09-10 05:48 . 2008-04-15 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-10 05:48 . 2008-04-15 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-10 05:48 . 2008-04-15 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-09-08 14:37 . 2010-09-08 14:37 3584 ----a-r- c:\documents and settings\david\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2010-09-08 03:17 . 2010-09-08 03:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 03:17 . 2010-09-08 03:17 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-01 11:51 . 2008-04-15 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll

2010-09-01 07:54 . 2008-04-15 12:00 1852416 ----a-w- c:\windows\system32\win32k.sys

2010-08-27 08:02 . 2008-04-15 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2010-08-27 05:58 . 2008-04-15 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 01:43 . 2008-05-04 23:25 7680 ----a-w- c:\windows\system32\xpsp4res.dll

2010-08-26 13:39 . 2008-04-15 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-23 16:11 . 2008-04-15 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll

2010-08-17 13:17 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-16 08:44 . 2008-04-15 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-08-02 03:59 . 2010-06-24 14:11 737280 ----a-w- c:\windows\iun6002.exe

.

------- Sigcheck -------

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . 1791B79392B2C5681F220423E7B14DCA . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-15 . 241D706AC46BC7D59B25C58BF1B08F13 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( ????? ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*??* ???????????????

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-16 205256]

"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2010-10-02 4537280]

"eMuleAutoStart"="c:\documents and settings\david\??\eMule_v0.49cbuild1015\emule.exe" [2009-04-10 5374424]

"Thunder"="c:\documents and settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\Thunder.exe" [2010-06-18 2787120]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-15 208952]

"CJIMETIPSYNC"="c:\program files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE" [2007-03-22 66400]

"PHIMETIPSYNC"="c:\program files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE" [2007-03-22 98656]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2010-05-17 611712]

"hp 1000 firmware"="c:\program files\hp LaserJet 1000\fwdl.exe" [2001-12-15 36864]

"DiskSuite"="c:\program files\PC Tools Disk Suite\aDSProcMngr.exe" [2009-01-16 267584]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-02 202256]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-10-08 352976]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\???????\???\??\

Picture Package Menu.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2010-10-23 151552]

Picture Package VCD Maker.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2010-10-23 106496]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0090404]

IME File REG_SZ MSTCICJA.IME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\ThunderService.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\ThunderLiveUD.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\XLBugReport.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]

R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]

R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [x]

R2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [x]

R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\CounterSpy\SBPIMSvc.exe [x]

R2 TERH;Remote Object Pool Controller;c:\program files\mosw\saofh.exe [x]

R3 Normandy;Normandy SR2; [x]

R3 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-07-30 722416]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]

S2 DiskSuiteService;PC Tools Disk Suite;c:\program files\PC Tools Disk Suite\DSService.exe [2009-03-10 869696]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2010-05-07 32856]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]

.

Link to post
Share on other sites

Hello again, please let me know how things are running now.

CF-SCRIPT

-------------

We need to execute a CF-script.

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

FCopy::
c:\windows\system32\dllcache\tcpip.sys | c:\windows\system32\drivers\tcpip.sys

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Link to post
Share on other sites

elise025: I think I can't proceed with CF-script now as I encounter problem when executing ComboFix. An error message was generated with:

Error - Win32 only

Imcompatible O.S. ComboFix only works for workstations with Windows 2000 and XP

At the same time, the installation of Microsoft Windows Recovery Console is impossible owing to disconnection via internet as mine is manual connection through telephone line

Can I proceed now with Recovery Console installation again? Can it be processed automatically with internet connection?

Please advise what I should do now? Thanks!

Link to post
Share on other sites

ComboFix 10-10-26.04 - david /10/29 ??? 1:12.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.950.886.1028.18.1024.554 [GMT 8:00]

????: c:\documents and settings\david\??\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Panda Cloud Antivirus *disabled* (Updated) {3C6467D5-0CB7-4322-B2CA-E08614E5D9B5}

SP: Spy Emergency *enabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}

.

((((((((((((((((((((((((( 2010-09-28 ? 2010-10-28 ????? )))))))))))))))))))))))))))))))

.

2010-10-28 12:29 . 2010-10-28 13:09 -------- d-----w- C:\eMule_v0.49cbuild1015

2010-10-24 10:59 . 2010-10-24 10:59 -------- d-----w- c:\documents and settings\david\Local Settings\Application Data\BHO

2010-10-24 00:32 . 2010-10-24 00:32 -------- d-----w- C:\Temp

2010-10-23 02:48 . 2006-10-18 18:05 232448 ----a-w- c:\windows\system32\mp3fhg.acm

2010-10-23 02:48 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm

2010-10-23 02:47 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll

2010-10-23 02:47 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll

2010-10-23 02:47 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll

2010-10-23 02:47 . 2010-10-18 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll

2010-10-23 02:47 . 2010-10-25 01:45 -------- d-----w- c:\program files\K-Lite Codec Pack

2010-10-23 01:58 . 2010-10-23 01:58 -------- d-----w- c:\program files\Common Files\muvee Technologies

2010-10-23 01:58 . 2010-10-23 02:01 -------- d-----w- c:\program files\Sony Corporation

2010-10-18 16:25 . 2010-10-23 08:02 -------- d-----w- C:\AvastKeyFiles

2010-10-15 11:27 . 2010-04-29 07:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-15 11:27 . 2010-10-15 11:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-15 11:27 . 2010-04-29 07:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-10 13:29 . 2010-10-10 13:31 -------- d-----w- C:\???

2010-10-08 10:32 . 2010-10-08 10:32 97549 ----a-w- c:\windows\system32\drivers\klick.dat

2010-10-08 10:32 . 2010-10-08 10:32 113933 ----a-w- c:\windows\system32\drivers\klin.dat

2010-10-08 10:28 . 2010-10-28 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2010-10-08 10:28 . 2010-10-08 10:28 -------- d-----w- c:\program files\Kaspersky Lab

2010-10-08 10:25 . 2010-10-08 10:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2010-10-06 06:51 . 2010-10-06 06:51 -------- d-----w- c:\documents and settings\david\Local Settings\Application Data\Threat Expert

2010-10-06 01:46 . 2010-10-06 01:46 -------- d-----w- c:\documents and settings\LocalService\???????

2010-10-05 12:54 . 2010-10-05 12:54 -------- d-----w- c:\documents and settings\david\Application Data\Panda Security

2010-10-05 12:50 . 2010-10-05 12:50 -------- d-----w- c:\documents and settings\david\Application Data\SurfSecret Privacy Suite

2010-10-05 12:47 . 2010-10-05 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security

2010-10-05 07:38 . 2010-10-05 07:38 -------- d-----w- c:\program files\SlySoft

2010-10-01 12:18 . 2010-10-01 12:19 -------- d-----w- c:\program files\DVDFab 8

2010-09-30 21:25 . 2010-09-30 21:25 30376 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys

2010-09-30 11:18 . 2010-09-30 11:18 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll

2010-09-29 12:14 . 2010-09-29 12:14 -------- d-----w- c:\program files\iPod

2010-09-29 12:14 . 2010-09-29 12:16 -------- d-----w- c:\program files\iTunes

2010-09-29 12:01 . 2010-09-29 12:01 -------- d-----w- c:\program files\Bonjour

.

(((((((((((((((((((((((((((((((((((((((( ??????????? ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-01 12:18 . 2010-04-21 10:17 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys

2010-10-01 12:18 . 2010-04-21 10:17 47360 ----a-w- c:\documents and settings\david\Application Data\pcouffin.sys

2010-09-18 06:52 . 2008-04-15 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll

2010-09-18 06:52 . 2008-04-15 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll

2010-09-18 06:52 . 2008-04-15 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll

2010-09-18 04:22 . 2008-04-15 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll

2010-09-14 20:50 . 2010-04-23 15:23 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-14 18:29 . 2010-08-21 02:19 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-09-14 13:16 . 2010-09-14 13:16 108480 ----a-w- c:\windows\system32\drivers\AnyDVD.sys

2010-09-10 05:48 . 2008-04-15 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-10 05:48 . 2008-04-15 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-10 05:48 . 2008-04-15 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-09-08 14:37 . 2010-09-08 14:37 3584 ----a-r- c:\documents and settings\david\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2010-09-08 03:17 . 2010-09-08 03:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 03:17 . 2010-09-08 03:17 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-01 11:51 . 2008-04-15 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll

2010-09-01 07:54 . 2008-04-15 12:00 1852416 ----a-w- c:\windows\system32\win32k.sys

2010-08-27 08:02 . 2008-04-15 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2010-08-27 05:58 . 2008-04-15 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 01:43 . 2008-05-04 23:25 7680 ----a-w- c:\windows\system32\xpsp4res.dll

2010-08-26 13:39 . 2008-04-15 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-23 16:11 . 2008-04-15 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll

2010-08-17 13:17 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-16 08:44 . 2008-04-15 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-08-02 03:59 . 2010-06-24 14:11 737280 ----a-w- c:\windows\iun6002.exe

.

------- Sigcheck -------

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . 1791B79392B2C5681F220423E7B14DCA . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-15 . 241D706AC46BC7D59B25C58BF1B08F13 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( ????? ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*??* ???????????????

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-16 205256]

"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2010-10-02 4537280]

"eMuleAutoStart"="c:\documents and settings\david\??\eMule_v0.49cbuild1015\emule.exe" [2009-04-10 5374424]

"Thunder"="c:\documents and settings\david\??\Thunder(??)_v5.9.22.1466(???????)\Program\Thunder.exe" [2010-06-18 2787120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-15 208952]

"CJIMETIPSYNC"="c:\program files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE" [2007-03-22 66400]

"PHIMETIPSYNC"="c:\program files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE" [2007-03-22 98656]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2010-05-17 611712]

"hp 1000 firmware"="c:\program files\hp LaserJet 1000\fwdl.exe" [2001-12-15 36864]

"DiskSuite"="c:\program files\PC Tools Disk Suite\aDSProcMngr.exe" [2009-01-16 267584]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-02 202256]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-23 421160]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-10-08 352976]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\All Users\???????\???\??\

Picture Package Menu.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2010-10-23 151552]

Picture Package VCD Maker.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2010-10-23 106496]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0090404]

IME File REG_SZ MSTCICJA.IME

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\ThunderService.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\ThunderLiveUD.exe"=

"c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.77\\XLBugReport.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010/6/9 ?? 05:43 11352]

R2 DiskSuiteService;PC Tools Disk Suite;c:\program files\PC Tools Disk Suite\DSService.exe [2010/5/9 ?? 03:04 869696]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2010/5/7 ?? 12:06 32856]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009/11/2 ?? 08:27 19472]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys --> c:\windows\system32\DRIVERS\ShlDrv51.sys [?]

S2 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\DRIVERS\PavProc.sys --> c:\windows\system32\DRIVERS\PavProc.sys [?]

S3 Normandy;Normandy SR2; [x]

S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2010/4/21 ?? 03:50 722416]

.

Link to post
Share on other sites

elise025: Sorry I have to abort the execution of CF-script log as warning message on Spy Emergency appeared which is found still enabled and may damage the system or affect the process.

I then search all files and folders of Spy Emergency and cannot find any. Can you help me to locate it and have it removed from the Registry. I reckon I have uninstalled the software long time ago and wonder it still exists in the system.

Following is the file detected on ComboFix log:

SP: Spy Emergency *enabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.