Unable to install Antivirus program

Question

plastered 0 Junior Poster in Training

14 Years Ago

Hi,

I had to recently uninstall my AV and when I try to reinstall it, it does install but when I click on the icon nothing happens. In addition to that, my internet service is gone into super slow motion too. Taking quite a while to open pages etc. I am also not able to run Malware antimalware, HJT and also unable to use online scanner.

Please advice.

windows-virus

4 Contributors
40 Replies
912 Views
1 Week Discussion Span
Latest Post 14 Years Ago Latest Post by plastered

All 40 Replies

gerbil 216 Industrious Poster

14 Years Ago

Which AV. Some, eg, Norton, AVG, require a special uninstaller tool to be run. The slowness is most likely due to a confused AV installation - all file activity, traffic is monitored by the AV.

crunchie 990 Most Valuable Poster

14 Years Ago

Click START then RUN

Now type Combofix /u in the runbox and click OK. Note the space between the X and the /, it needs to be there.

Please download ComboFix by sUBs from HERE or HERE You must rename combofix BEFORE saving it to your pc.

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

plastered commented: Super!! +1

crunchie 990 Most Valuable Poster

14 Years Ago

Can you please do the following.

===============

Scan with HijackThis and then place a check next to all the following, if present:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O3 - Toolbar: GVDownloader - {ae4df123-9140-4f93-9b32-ff0186389cc3} - mscoree.dll (file missing)

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

aashishn86 0 Junior Poster · Answer 1 · 2009-06-05T14:14:05+00:00

Hi,
I had to recently uninstall my AV and when I try to reinstall it, it does install but when I click on the icon nothing happens. In addition to that, my internet service is gone into super slow motion too. Taking quite a while to open pages etc. I am also not able to run Malware antimalware, HJT and also unable to use online scanner.
Please advice.

see this thread...
similar problem

i have the same problem, its resolved to some extent but i am going to be doing all this soon....

gerbil 216 Industrious Poster · Answer 2 · 2009-06-05T18:49:22+00:00

..or perhaps you installed the AV into an infected system, or perhaps you have become infected with some malware which your AV does not detect.
Tell which AV you uninstalled.

plastered 0 Junior Poster in Training · Answer 3 · 2009-06-06T06:32:08+00:00

plastered 0 Junior Poster in Training

14 Years Ago

My apologies, I have Kaspersky Internet Security 2009

gerbil 216 Industrious Poster · Answer 4 · 2009-06-06T17:30:09+00:00

Good-oh. You might try running the correct removal tool from this site, and then attempt to reinstall KIS.
http://support.kaspersky.com/faq/?qid=208279463
Good luck. And please come back if that does not solve your problem.

plastered 0 Junior Poster in Training · Answer 5 · 2009-06-07T02:58:37+00:00

Hi,

I ran the uninstaller. But it does not detect that KIS is installed. This is peculiar because my Windows Security Alert tells me that the Antivirus and the firewall are switched off.

So reinstalled and then used the remover to uninstall the software only to get the same description from the Windows Security Alert. Also I noticed that there are no restore points available for System Restore!

gerbil 216 Industrious Poster · Answer 6 · 2009-06-07T06:38:25+00:00

Okay. It does look like a few keys in registry are not being cleaned, and Windows Security is picking up on them. More worrying is the inability to run anti-malware scans, loss of restore points. Let's try a couple in safe mode as an initial check:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: http://www.gt500.org/malwarebytes/database.jsp , both to a thumbdrive.
Run the installer, when it completes uncheck the Launch and Update boxes to finish. Next, dclick the mbam-rules.exe file, it will install into MBAM.
Start MBAM via the icon and ...

==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe
-CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

plastered 0 Junior Poster in Training · Answer 7 · 2009-06-07T21:08:36+00:00

Tried the steps, but the application do not execute at all. When I click on the icons to run the application there is no changes at all except for the hourglass appearing for a couple of seconds.

I had the Task Manager up when I was trying to run these applications but on clicking them there is no response in the Task Manager, no sign of a new process at all.

aashishn86 0 Junior Poster · Answer 8 · 2009-06-07T21:49:49+00:00

hey
try running dr web as asked in that link i posted once...
may be it'll help
it did help me...

plastered 0 Junior Poster in Training · Answer 9 · 2009-06-08T02:42:42+00:00

I ran the software and it did find few trojans, four to be exact. One was Killbit, ubi81 in the temp folder, and two dll files with long names in the System32 folder.

Said that, it still hasnt improved the situation. I am still unable to run MBAM n HJT.

plastered 0 Junior Poster in Training · Answer 10 · 2009-06-08T03:41:00+00:00

plastered 0 Junior Poster in Training

14 Years Ago

@ aashishn86

the reply was in response to your suggestion.

@ gerbil

I was able to run Panda Online Security Scan. I am attaching the log along.

ActiveScan.txt (8.58 KB)

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-06-08 03:08:20
PROTECTIONS: 1
MALWARE: 2
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Kaspersky Internet Security                  8.0.0.454                     No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029434  spyware/virtumonde                 Spyware             No        0         Yes            No           hkey_local_machine\software\microsoft\removerp
01054371  W32/TDSS.BF.worm                   Virus/Worm          Yes       1         No             No           globalroot\systemroot\system32\gxvxcwqvvvdlwruqjxenkclcveptdrumqrmlt.dll
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "
;===================================================================================================================================================================================
  184379  MEDIUM     MS08-001                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  182043  HIGH       MS07-064                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  170907  HIGH       MS07-046                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  170904  HIGH       MS07-043                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  133387  MEDIUM     MS06-065                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  133386  MEDIUM     MS06-064                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  129976  MEDIUM     MS06-052                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  120825  MEDIUM     MS06-032                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  108743  MEDIUM     MS06-007                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
   93394  HIGH       MS05-050                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
;===================================================================================================================================================================================

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 11 · 2009-06-08T07:43:43+00:00

Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

==

Reboot and try running mba-m again.

plastered 0 Junior Poster in Training · Answer 12 · 2009-06-08T12:24:40+00:00

plastered 0 Junior Poster in Training

14 Years Ago

The option TDSSserv is not available in DM.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 13 · 2009-06-08T15:33:23+00:00

I will assume that under the show hidden devices option, you couldn't find the driver named TDSSserv.

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

plastered 0 Junior Poster in Training · Answer 14 · 2009-06-08T19:13:29+00:00

Yes, there was no TDSSserv drive in the DM.

I ran the CF tool but nothing happened no windows popped up nothing. I had my internet connection switched off too. To get back online I had to restart the computer.

plastered 0 Junior Poster in Training · Answer 15 · 2009-06-09T03:44:21+00:00

plastered 0 Junior Poster in Training

14 Years Ago

I followed the steps and the results are attached.

--------------------------------------------------------------------

You should be awarded The Nobel Prize!

CF_LOG.txt (19.84 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

ComboFix 09-06-07.07 - HP_Owner 2009-06-09  2:57.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.1279.946 [GMT 5.5:30]
Running from: c:\documents and settings\HP_Owner\Desktop\Combo-Fix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\HP_Owner\LOCALS~1\Temp\tmp2.tmp
c:\windows\9g2234wesdf3dfgjf23
c:\windows\IE4 Error Log.txt
c:\windows\system32\ABCD.exe
c:\windows\system32\drivers\gxvxcobbpixdulkbrrpuyavdtomltqfxexwva.sys
c:\windows\system32\EdNWDcfe.ini
c:\windows\system32\EdNWDcfe.ini2
c:\windows\system32\gxvxchtklrsokaxjbgxqtjknsphifppjwyydw.dll
c:\windows\system32\gxvxcwqvvvdlwruqjxenkclcveptdrumqrmlt.dll
c:\windows\system32\nfr.assembly
c:\windows\t55ft2824f44.dat
c:\windows\t55ft2829f44.dat
c:\windows\Tasks\lrnlubnn.job
D:\Desktop.ini

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS


(((((((((((((((((((((((((   Files Created from 2009-05-08 to 2009-06-08  )))))))))))))))))))))))))))))))
.

2009-06-07 20:57 . 2008-06-19 11:54	28544	----a-w-	c:\windows\system32\drivers\pavboot.sys
2009-06-07 20:56 . 2009-06-07 20:56	--------	d-----w-	c:\program files\Panda Security
2009-06-07 17:32 . 2009-06-07 17:32	--------	d-----w-	c:\documents and settings\HP_Owner\DoctorWeb
2009-06-07 16:59 . 2009-06-07 16:59	--------	dc-h--w-	c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-06-07 15:04 . 2009-06-07 15:04	--------	d-----w-	c:\program files\Trend Micro
2009-06-07 14:57 . 2009-01-14 10:41	15504	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-06-07 14:57 . 2009-01-14 10:41	38496	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 14:57 . 2009-06-07 14:57	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-06-06 23:03 . 2009-06-07 20:39	--------	d-----w-	c:\program files\Windows Live Safety Center
2009-06-04 11:33 . 2008-12-03 19:55	120832	----a-w-	c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-06-03 12:06 . 2009-06-03 12:07	--------	d-----w-	c:\documents and settings\HP_Owner\.housecall6.6
2009-05-27 15:35 . 2009-05-27 15:35	--------	d-----w-	c:\program files\DownloadToolz
2009-05-27 13:59 . 2009-05-27 13:59	29352	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll
2009-05-27 13:59 . 2009-05-27 13:59	23720	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll
2009-05-27 13:59 . 2009-05-27 13:59	23056	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll
2009-05-27 13:59 . 2009-05-27 13:59	221208	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll
2009-05-27 13:59 . 2009-05-27 13:59	21160	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll
2009-05-27 13:59 . 2009-05-27 13:59	110248	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll
2009-05-27 13:46 . 2007-11-27 17:26	91328	----a-w-	c:\windows\system32\drivers\msfwdrv.sys
2009-05-27 13:46 . 2007-11-27 17:26	116416	----a-w-	c:\windows\system32\drivers\msfwhlpr.sys
2009-05-27 13:45 . 2008-05-15 10:45	53168	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2009-05-27 13:45 . 2009-05-27 13:45	--------	d-----w-	c:\windows\system32\bits
2009-05-27 13:45 . 2007-03-29 12:56	7168	------w-	c:\windows\system32\dllcache\bitsprx4.dll
2009-05-27 13:45 . 2007-03-29 12:56	7168	------w-	c:\windows\system32\bitsprx4.dll
2009-05-27 13:12 . 2009-06-03 09:25	--------	d-----w-	c:\program files\Microsoft Windows OneCare Live
2009-05-27 11:38 . 2009-05-27 11:38	604416	----a-w-	c:\windows\system32\TUProgSt.exe
2009-05-27 11:38 . 2009-04-27 08:51	28928	----a-w-	c:\windows\system32\uxtuneup.dll
2009-05-27 11:38 . 2009-05-27 11:38	361216	----a-w-	c:\windows\system32\TuneUpDefragService.exe
2009-05-27 11:38 . 2009-05-27 11:38	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:38	--------	d-----w-	c:\program files\TuneUp Utilities 2009
2009-05-27 11:37 . 2009-05-27 11:37	--------	d-sh--w-	c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-27 08:54 . 2009-05-27 09:00	--------	d-----w-	c:\documents and settings\HP_Owner\Local Settings\Application Data\The Weather Channel
2009-05-27 08:46 . 2009-06-05 03:43	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-05-27 07:29 . 2009-05-27 07:29	--------	d-----w-	c:\program files\MSSOAP
2009-05-27 05:58 . 2009-05-27 05:58	--------	d-----w-	c:\program files\Easy Desk Utilities
2009-05-27 05:58 . 1997-01-20 09:42	71680	----a-w-	c:\windows\ST5UNST.EXE
2009-05-27 05:10 . 2009-06-03 11:21	--------	d-----w-	c:\program files\True Sword 5
2009-05-26 15:18 . 2009-05-26 15:18	--------	d-sh--w-	c:\documents and settings\LocalService\PrivacIE

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 21:34 . 2008-10-13 11:57	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\uTorrent
2009-06-08 17:24 . 2008-12-10 15:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-06-03 12:02 . 2008-10-24 09:38	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-06-03 08:50 . 2008-10-21 08:30	--------	d-----w-	c:\program files\Bonjour
2009-05-27 14:19 . 2009-05-27 14:19	810152	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch3\HTML\item_templ\common\fixes\TSFix056472.dll
2009-05-27 05:45 . 2008-10-24 07:25	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-05-26 09:41 . 2009-02-09 20:16	827424	--sha-w-	c:\windows\system32\drivers\fidbox2.dat
2009-05-26 09:41 . 2009-02-09 20:16	4874272	--sha-w-	c:\windows\system32\drivers\fidbox.dat
2009-05-26 09:41 . 2009-02-09 20:16	39160	--sha-w-	c:\windows\system32\drivers\fidbox.idx
2009-05-26 09:41 . 2009-02-09 20:16	3908	--sha-w-	c:\windows\system32\drivers\fidbox2.idx
2009-05-25 16:33 . 2008-10-13 02:18	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-05-25 10:28 . 2009-03-02 06:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\Ubisoft
2009-05-05 15:54 . 2008-11-02 13:15	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\LogMeIn Rescue
2009-04-22 11:53 . 2009-01-28 19:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\DriverCure
2009-04-19 18:42 . 2008-10-15 09:38	1324	----a-w-	c:\windows\system32\d3d9caps.dat
2009-04-08 10:20 . 2008-10-14 13:17	98304	----a-w-	c:\windows\system32\CmdLineExt.dll
2009-04-08 10:17 . 2009-04-08 10:17	10134	----a-r-	c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2009-03-27 02:44 . 2008-10-13 11:36	453152	----a-w-	c:\windows\system32\NVUNINST.EXE
2009-03-24 13:03 . 2009-03-24 13:03	237264	----a-w-	c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-02-24 18:35 . 2009-02-24 18:35	41161496	----a-w-	c:\program files\PhysX_9.09.0203_SystemSoftware.exe
2009-02-23 21:50 . 2009-02-23 21:50	32376	----a-w-	c:\program files\nv4_disp.cat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-10 270128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12cfg914-k641-26sf-n31p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12zfg94-f641-2sf-k31p-5n1er6h6l2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\13cfg914-k641-26sf-n33p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Home Theater SchSvr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06
HKEY_LOCAL_MACHI

HJT_Log.txt (6.18 KB)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:11:02, on 2009-06-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: GVDownloader - {ae4df123-9140-4f93-9b32-ff0186389cc3} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O17 - HKLM\System\CS1\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneCare AntiSpyware and AntiVirus (OneCareMP) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe (file missing)

--
End of file - 6332 bytes

plastered 0 Junior Poster in Training · Answer 16 · 2009-06-09T05:19:26+00:00

I also did a MBAM scan and the log is attached.

I tried to reinstall the Anti virus software - Kaspersky Internet Security 2009 and was successful, said that I am unable to download updates and access any webpages. Although utorrent downloads the files in queue with our any problem.

I uninstalled KIS 2009 and I was able to browse the internet again. Assuming some problem with the Installation file, I tried to install Windows One Live Care and failed as it could not download the update. I then tried to install AVG and was successful but again I was unable to update the software and lost the browsing functionality. I currently have no security system running.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 17 · 2009-06-09T06:55:16+00:00

I will go through your combofix log when I get home from work. You need to paste it (and all your logs) into your reply rather than attach them.
MBA-M is about a year out of date. Update it and run it again please.

plastered 0 Junior Poster in Training · Answer 18 · 2009-06-09T13:00:48+00:00

Below is the log in the order of CF and HJT. Get home grab a drink, relax and then reply :)

==========================================

ComboFix 09-06-07.07 - HP_Owner 2009-06-09 2:57.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1279.946 [GMT 5.5:30]
Running from: c:\documents and settings\HP_Owner\Desktop\Combo-Fix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\HP_Owner\LOCALS~1\Temp\tmp2.tmp
c:\windows\9g2234wesdf3dfgjf23
c:\windows\IE4 Error Log.txt
c:\windows\system32\ABCD.exe
c:\windows\system32\drivers\gxvxcobbpixdulkbrrpuyavdtomltqfxexwva.sys
c:\windows\system32\EdNWDcfe.ini
c:\windows\system32\EdNWDcfe.ini2
c:\windows\system32\gxvxchtklrsokaxjbgxqtjknsphifppjwyydw.dll
c:\windows\system32\gxvxcwqvvvdlwruqjxenkclcveptdrumqrmlt.dll
c:\windows\system32\nfr.assembly
c:\windows\t55ft2824f44.dat
c:\windows\t55ft2829f44.dat
c:\windows\Tasks\lrnlubnn.job
D:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS

((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))
.

2009-06-07 20:57 . 2008-06-19 11:54 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-06-07 20:56 . 2009-06-07 20:56 -------- d-----w- c:\program files\Panda Security
2009-06-07 17:32 . 2009-06-07 17:32 -------- d-----w- c:\documents and settings\HP_Owner\DoctorWeb
2009-06-07 16:59 . 2009-06-07 16:59 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-06-07 15:04 . 2009-06-07 15:04 -------- d-----w- c:\program files\Trend Micro
2009-06-07 14:57 . 2009-01-14 10:41 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-07 14:57 . 2009-01-14 10:41 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 14:57 . 2009-06-07 14:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-06 23:03 . 2009-06-07 20:39 -------- d-----w- c:\program files\Windows Live Safety Center
2009-06-04 11:33 . 2008-12-03 19:55 120832 ----a-w- c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-06-03 12:06 . 2009-06-03 12:07 -------- d-----w- c:\documents and settings\HP_Owner\.housecall6.6
2009-05-27 15:35 . 2009-05-27 15:35 -------- d-----w- c:\program files\DownloadToolz
2009-05-27 13:59 . 2009-05-27 13:59 29352 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll
2009-05-27 13:59 . 2009-05-27 13:59 23720 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll
2009-05-27 13:59 . 2009-05-27 13:59 23056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll
2009-05-27 13:59 . 2009-05-27 13:59 221208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll
2009-05-27 13:59 . 2009-05-27 13:59 21160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll
2009-05-27 13:59 . 2009-05-27 13:59 110248 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll
2009-05-27 13:46 . 2007-11-27 17:26 91328 ----a-w- c:\windows\system32\drivers\msfwdrv.sys
2009-05-27 13:46 . 2007-11-27 17:26 116416 ----a-w- c:\windows\system32\drivers\msfwhlpr.sys
2009-05-27 13:45 . 2008-05-15 10:45 53168 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2009-05-27 13:45 . 2009-05-27 13:45 -------- d-----w- c:\windows\system32\bits
2009-05-27 13:45 . 2007-03-29 12:56 7168 ------w- c:\windows\system32\dllcache\bitsprx4.dll
2009-05-27 13:45 . 2007-03-29 12:56 7168 ------w- c:\windows\system32\bitsprx4.dll
2009-05-27 13:12 . 2009-06-03 09:25 -------- d-----w- c:\program files\Microsoft Windows OneCare Live
2009-05-27 11:38 . 2009-05-27 11:38 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-27 11:38 . 2009-04-27 08:51 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-05-27 11:38 . 2009-05-27 11:38 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-27 11:38 . 2009-05-27 11:38 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:37 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:38 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-27 11:37 . 2009-05-27 11:37 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-27 08:54 . 2009-05-27 09:00 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\The Weather Channel
2009-05-27 08:46 . 2009-06-05 03:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-27 07:29 . 2009-05-27 07:29 -------- d-----w- c:\program files\MSSOAP
2009-05-27 05:58 . 2009-05-27 05:58 -------- d-----w- c:\program files\Easy Desk Utilities
2009-05-27 05:58 . 1997-01-20 09:42 71680 ----a-w- c:\windows\ST5UNST.EXE
2009-05-27 05:10 . 2009-06-03 11:21 -------- d-----w- c:\program files\True Sword 5
2009-05-26 15:18 . 2009-05-26 15:18 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 21:34 . 2008-10-13 11:57 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\uTorrent
2009-06-08 17:24 . 2008-12-10 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-03 12:02 . 2008-10-24 09:38 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-03 08:50 . 2008-10-21 08:30 -------- d-----w- c:\program files\Bonjour
2009-05-27 14:19 . 2009-05-27 14:19 810152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch3\HTML\item_templ\common\fixes\TSFix056472.dll
2009-05-27 05:45 . 2008-10-24 07:25 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-05-26 09:41 . 2009-02-09 20:16 827424 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-26 09:41 . 2009-02-09 20:16 4874272 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-26 09:41 . 2009-02-09 20:16 39160 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-26 09:41 . 2009-02-09 20:16 3908 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-25 16:33 . 2008-10-13 02:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-25 10:28 . 2009-03-02 06:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2009-05-05 15:54 . 2008-11-02 13:15 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\LogMeIn Rescue
2009-04-22 11:53 . 2009-01-28 19:04 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverCure
2009-04-19 18:42 . 2008-10-15 09:38 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-04-08 10:20 . 2008-10-14 13:17 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-04-08 10:17 . 2009-04-08 10:17 10134 ----a-r- c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2009-03-27 02:44 . 2008-10-13 11:36 453152 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-03-24 13:03 . 2009-03-24 13:03 237264 ----a-w- c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-02-24 18:35 . 2009-02-24 18:35 41161496 ----a-w- c:\program files\PhysX_9.09.0203_SystemSoftware.exe
2009-02-23 21:50 . 2009-02-23 21:50 32376 ----a-w- c:\program files\nv4_disp.cat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-10 270128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12cfg914-k641-26sf-n31p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12zfg94-f641-2sf-k31p-5n1er6h6l2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\13cfg914-k641-26sf-n33p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Home Theater SchSvr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MskAgentexe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntuser
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINREMOTE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"winss"=2 (0x2)
"Nero BackItUp Scheduler 3"=2 (0x2)
"NMIndexingService"=3 (0x3)
"gusvc"=2 (0x2)
"UxTuneUp"=2 (0x2)
"TuneUp.ProgramStatisticsSvc"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\valve\\czero.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\nvsvc32.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\HP_Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\HP_Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-08 28544]
S1 27af3eb5;27af3eb5;c:\windows\system32\drivers\27af3eb5.sys --> c:\windows\system32\drivers\27af3eb5.sys [?]
S1 b9061be1;b9061be1;c:\windows\system32\drivers\b9061be1.sys --> c:\windows\system32\drivers\b9061be1.sys [?]
S1 jxakrhzq;jxakrhzq;\??\c:\windows\system32\drivers\jxakrhzq.sys --> c:\windows\system32\drivers\jxakrhzq.sys [?]
S1 qhhkbrno;qhhkbrno;\??\c:\windows\system32\drivers\qhhkbrno.sys --> c:\windows\system32\drivers\qhhkbrno.sys [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2008-10-18 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2008-10-18 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2008-10-18 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2008-10-18 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2008-10-18 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2008-10-18 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2008-10-18 115752]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2008-10-18 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2008-10-18 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2008-10-18 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2008-10-18 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2008-10-18 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2008-10-18 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2008-10-18 117672]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-05-27 604416]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-06-08 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 10:07]

2009-06-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-10 06:52]

2009-06-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-453054114-3321203614-4080054335-1007.job
- c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-25 19:46]

2009-06-08 c:\windows\Tasks\User_Feed_Synchronization-{CFEA29CB-5388-4B47-99F1-AD447D471D80}.job
- c:\windows\system32\msfeedssync.exe [2008-08-21 21:35]
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{4E3E60F5-F691-475F-AFBA-CF9FCAB47C15} - (no file)
Notify-opnmmliI - opnmmliI.dll
SafeBoot-procexp90.Sys
MSConfigStartUp-URLLSTCK - (no file)

.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: {35D307E8-6B83-4F28-9479-8EC657B823F4} = 218.248.255.139,218.248.255.212
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\
FF - prefs.js: browser.startup.homepage -
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\TechnicianConsole@logmeinrescue.com\platform\WINNT\plugins\npRescue.dll
FF - plugin: c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service

FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 03:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,15,81,e6,06,b4,ed,4d,be,72,cd,\
"3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,15,81,e6,06,b4,ed,4d,be,72,cd,\

[HKEY_USERS\S-1-5-21-453054114-3321203614-4080054335-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-453054114-3321203614-4080054335-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:50,e6,ce,80,05,c7,b6,f3,72,e7,64,23,b0,f5,ad,5c,d2,be,a1,cb,d1,07,ec,
4d,89,ba,6e,88,fe,5d,19,6a,c3,81,05,b9,63,68,8a,3d,09,70,42,88,aa,1f,08,0f,\
"??"=hex:e9,f3,f3,8a,33,5e,1a,21,8e,2f,44,0e,c3,d8,a9,fb
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1436)
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-08 3:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-08 21:36

Pre-Run: 3,258,785,792 bytes free
Post-Run: 3,805,380,608 bytes free

273 --- E O F --- 2009-04-18 03:10

===========================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:11:02, on 2009-06-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: GVDownloader - {ae4df123-9140-4f93-9b32-ff0186389cc3} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O17 - HKLM\System\CS1\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneCare AntiSpyware and AntiVirus (OneCareMP) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe (file missing)

--
End of file - 6332 bytes

============================================

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 19 · 2009-06-09T15:23:11+00:00

Please go to Jotti's or to virustotal and have these files scanned. Post the results back here.

c:\windows\system32\drivers\27af3eb5.sys
c:\windows\system32\drivers\b9061be1.sys
c:\windows\system32\drivers\jxakrhzq.sys
c:\windows\system32\drivers\qhhkbrno.sys

plastered 0 Junior Poster in Training · Answer 20 · 2009-06-09T21:42:23+00:00

The four files are not available in the Drivers folder. I changed the setting for hidden folders too to see if missed them but they are not in the folder.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 21 · 2009-06-10T02:23:47+00:00

Go here http://www.billsway.com/vbspage/ and download, unzip and run the Registry Search Tool.

Type 27af3eb5 in the dialog box.
Let it run and after a few minutes, a prompt will appear.
Click OK to write the results to Notepad and post them here.

Repeat for the other 3 files.

plastered 0 Junior Poster in Training · Answer 22 · 2009-06-10T03:07:44+00:00

Here are the results.

============================================

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "27af3eb5" 2009-06-10 02:32:20

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\27af3eb5]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\27af3eb5]
"ImagePath"="\\SystemRoot\\System32\\drivers\\27af3eb5.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\27af3eb5]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\27af3eb5]
"ImagePath"="\\SystemRoot\\System32\\drivers\\27af3eb5.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\27af3eb5]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\27af3eb5]
"ImagePath"="\\SystemRoot\\System32\\drivers\\27af3eb5.sys"

[HKEY_USERS\S-1-5-21-453054114-3321203614-4080054335-1007\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="27af3eb5.sys"

===============================================

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "b9061be1" 2009-06-10 02:33:48

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b9061be1]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b9061be1]
"ImagePath"="\\SystemRoot\\System32\\drivers\\b9061be1.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\b9061be1]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\b9061be1]
"ImagePath"="\\SystemRoot\\System32\\drivers\\b9061be1.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b9061be1]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b9061be1]
"ImagePath"="\\SystemRoot\\System32\\drivers\\b9061be1.sys"

===============================================

; Registry search results for string "jxakrhzq" 2009-06-10 02:35:14

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jxakrhzq]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jxakrhzq]
"Args"="C:\\WINDOWS\\system32\\drivers\\jxakrhzq.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jxakrhzq\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\jxakrhzq]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\jxakrhzq]
"Args"="C:\\WINDOWS\\system32\\drivers\\jxakrhzq.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\jxakrhzq\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jxakrhzq]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jxakrhzq]
"Args"="C:\\WINDOWS\\system32\\drivers\\jxakrhzq.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\jxakrhzq\Security]

===============================================

; Registry search results for string "qhhkbrno" 2009-06-10 02:36:25

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qhhkbrno]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qhhkbrno]
"Args"="C:\\WINDOWS\\system32\\drivers\\qhhkbrno.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qhhkbrno\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\qhhkbrno]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\qhhkbrno]
"Args"="C:\\WINDOWS\\system32\\drivers\\qhhkbrno.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\qhhkbrno\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qhhkbrno]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qhhkbrno]
"Args"="C:\\WINDOWS\\system32\\drivers\\qhhkbrno.sys:changelist"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qhhkbrno\Security]

==============================================

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 23 · 2009-06-10T05:37:19+00:00

Please back your Registry with ERUNT.
Follow the link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
For the version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.

Note: To restore your registry, go to the folder and start ERDNT.exe

==

Download the attached zip file and unzip fixme.reg. Close all browser windows. Double click the file to run it and when asked if you want to merge with your registry, answer yes.
Reboot when done.

Run combofix again as per previous instructions and post the log when done.

plastered 0 Junior Poster in Training · Answer 24 · 2009-06-10T16:16:29+00:00

Did as advised. Here is the log report.

==================================================

ComboFix 09-06-09.06 - HP_Owner 2009-06-10 15:38.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1279.875 [GMT 5.5:30]
Running from: c:\documents and settings\HP_Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gxvxccount

.
((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 )))))))))))))))))))))))))))))))
.

2009-06-09 21:32 . 2009-06-09 21:32 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-06-09 21:32 . 2009-06-09 21:32 -------- d-----w- c:\program files\Sony
2009-06-09 21:30 . 2009-06-09 21:30 -------- d-----w- c:\program files\Avanquest update
2009-06-09 21:30 . 2009-06-09 21:30 -------- d-----w- c:\windows\LastGood
2009-06-09 21:30 . 2009-06-09 21:32 -------- d-----w- c:\program files\Sony Ericsson
2009-06-09 21:29 . 2009-06-09 21:29 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\InstallShield
2009-06-09 21:20 . 2009-06-09 21:20 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\MSNInstaller
2009-06-07 20:57 . 2008-06-19 11:54 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-06-07 20:56 . 2009-06-07 20:56 -------- d-----w- c:\program files\Panda Security
2009-06-07 17:32 . 2009-06-07 17:32 -------- d-----w- c:\documents and settings\HP_Owner\DoctorWeb
2009-06-07 16:59 . 2009-06-07 16:59 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-06-07 15:04 . 2009-06-07 15:04 -------- d-----w- c:\program files\Trend Micro
2009-06-07 14:57 . 2009-01-14 10:41 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-07 14:57 . 2009-01-14 10:41 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 14:57 . 2009-06-07 14:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-06 23:03 . 2009-06-07 20:39 -------- d-----w- c:\program files\Windows Live Safety Center
2009-06-04 11:33 . 2008-12-03 19:55 120832 ----a-w- c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-06-03 12:06 . 2009-06-03 12:07 -------- d-----w- c:\documents and settings\HP_Owner\.housecall6.6
2009-05-27 15:35 . 2009-05-27 15:35 -------- d-----w- c:\program files\DownloadToolz
2009-05-27 13:59 . 2009-05-27 13:59 29352 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll
2009-05-27 13:59 . 2009-05-27 13:59 23720 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll
2009-05-27 13:59 . 2009-05-27 13:59 23056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll
2009-05-27 13:59 . 2009-05-27 13:59 221208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll
2009-05-27 13:59 . 2009-05-27 13:59 21160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll
2009-05-27 13:59 . 2009-05-27 13:59 110248 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll
2009-05-27 13:46 . 2007-11-27 17:26 91328 ----a-w- c:\windows\system32\drivers\msfwdrv.sys
2009-05-27 13:46 . 2007-11-27 17:26 116416 ----a-w- c:\windows\system32\drivers\msfwhlpr.sys
2009-05-27 13:45 . 2008-05-15 10:45 53168 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2009-05-27 13:45 . 2009-05-27 13:45 -------- d-----w- c:\windows\system32\bits
2009-05-27 13:45 . 2007-03-29 12:56 7168 ------w- c:\windows\system32\dllcache\bitsprx4.dll
2009-05-27 13:45 . 2007-03-29 12:56 7168 ------w- c:\windows\system32\bitsprx4.dll
2009-05-27 13:12 . 2009-06-08 22:56 -------- d-----w- c:\program files\Microsoft Windows OneCare Live
2009-05-27 11:38 . 2009-05-27 11:38 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-27 11:38 . 2009-04-27 08:51 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-05-27 11:38 . 2009-05-27 11:38 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-27 11:38 . 2009-05-27 11:38 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:37 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:38 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-27 11:37 . 2009-05-27 11:37 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-27 08:54 . 2009-05-27 09:00 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\The Weather Channel
2009-05-27 08:46 . 2009-06-05 03:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-27 07:29 . 2009-05-27 07:29 -------- d-----w- c:\program files\MSSOAP
2009-05-27 05:58 . 2009-05-27 05:58 -------- d-----w- c:\program files\Easy Desk Utilities
2009-05-27 05:58 . 1997-01-20 09:42 71680 ----a-w- c:\windows\ST5UNST.EXE
2009-05-27 05:10 . 2009-06-03 11:21 -------- d-----w- c:\program files\True Sword 5
2009-05-26 15:18 . 2009-05-26 15:18 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 09:59 . 2008-10-13 11:57 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\uTorrent
2009-06-09 21:30 . 2008-10-13 02:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-09 21:25 . 2008-11-22 09:43 -------- d-----w- c:\program files\Google
2009-06-09 21:21 . 2008-11-16 17:27 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\Sony
2009-06-09 21:19 . 2008-10-13 02:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-06-09 21:19 . 2008-10-13 02:04 -------- d-----w- c:\program files\HP
2009-06-09 21:12 . 2008-10-15 11:25 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-03 12:02 . 2008-10-24 09:38 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-03 08:50 . 2008-10-21 08:30 -------- d-----w- c:\program files\Bonjour
2009-05-27 14:19 . 2009-05-27 14:19 810152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch3\HTML\item_templ\common\fixes\TSFix056472.dll
2009-05-27 05:45 . 2008-10-24 07:25 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-05-25 10:28 . 2009-03-02 06:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2009-05-05 15:54 . 2008-11-02 13:15 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\LogMeIn Rescue
2009-04-22 11:53 . 2009-01-28 19:04 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverCure
2009-04-19 18:42 . 2008-10-15 09:38 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-04-08 10:20 . 2008-10-14 13:17 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-04-08 10:17 . 2009-04-08 10:17 10134 ----a-r- c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2009-03-27 02:44 . 2008-10-13 11:36 453152 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-03-24 13:03 . 2009-03-24 13:03 237264 ----a-w- c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-02-24 18:35 . 2009-02-24 18:35 41161496 ----a-w- c:\program files\PhysX_9.09.0203_SystemSoftware.exe
2009-02-23 21:50 . 2009-02-23 21:50 32376 ----a-w- c:\program files\nv4_disp.cat
.

((((((((((((((((((((((((((((( SnapShot@2009-06-08_21.33.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-09 21:25 . 2009-06-09 21:25 16384 c:\windows\Temp\Perflib_Perfdata_658.dat
- 2008-10-18 08:40 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3esdm2_9764AEB0AF92C101555E353C0F0D3CF5C63F33FA\i386\se3ecmnt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3esdm2_9764AEB0AF92C101555E353C0F0D3CF5C63F33FA\i386\se3ecmnt.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 98568 c:\windows\system32\DRVSTORE\se3eobx2_4D2AF8EAA7B19E8748780FA6098D3AACC5D8D9F9\i386\se3eobex.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 98568 c:\windows\system32\DRVSTORE\se3eobx2_4D2AF8EAA7B19E8748780FA6098D3AACC5D8D9F9\i386\se3eobex.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3eobx2_4D2AF8EAA7B19E8748780FA6098D3AACC5D8D9F9\i386\se3ecmnt.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3eobx2_4D2AF8EAA7B19E8748780FA6098D3AACC5D8D9F9\i386\se3ecmnt.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 15112 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3emdfl.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 15112 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3emdfl.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3ecmnt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3ecmnt.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3ebus_278301E0E0E3254933BAAF4F06701023D35DABD9\i386\se3ewhnt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 12424 c:\windows\system32\DRVSTORE\se3ebus_278301E0E0E3254933BAAF4F06701023D35DABD9\i386\se3ewhnt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 83080 c:\windows\system32\DRVSTORE\se3ebus_278301E0E0E3254933BAAF4F06701023D35DABD9\i386\se3ebus.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 83080 c:\windows\system32\DRVSTORE\se3ebus_278301E0E0E3254933BAAF4F06701023D35DABD9\i386\se3ebus.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916sdm2_21F85660AA82023EA111CC6BDFE4E4EF2EDFED63\i386\s916cmnt.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916sdm2_21F85660AA82023EA111CC6BDFE4E4EF2EDFED63\i386\s916cmnt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916obx2_74455A9D7CF2BC68446FD3455ABFCCDA93FFD087\i386\s916cmnt.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916obx2_74455A9D7CF2BC68446FD3455ABFCCDA93FFD087\i386\s916cmnt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 15016 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916mdfl.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 15016 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916mdfl.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916cmnt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916cmnt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916bus_3395190DF2FB782139DB9E18AA83FD42AAB0E78E\i386\s916whnt.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 12200 c:\windows\system32\DRVSTORE\s916bus_3395190DF2FB782139DB9E18AA83FD42AAB0E78E\i386\s916whnt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 83496 c:\windows\system32\DRVSTORE\s916bus_3395190DF2FB782139DB9E18AA83FD42AAB0E78E\i386\s916bus.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 83496 c:\windows\system32\DRVSTORE\s916bus_3395190DF2FB782139DB9E18AA83FD42AAB0E78E\i386\s916bus.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018whnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018whnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 10792 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018crnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 10792 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018crnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018sdm2_451645CEF4DA534B9212B7694D6EE15D943601C8\i386\s1018cmnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018sdm2_451645CEF4DA534B9212B7694D6EE15D943601C8\i386\s1018cmnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018obx2_3F00212C6781220B6B1F796C0DA0A35D5C0AAE41\i386\s1018cmnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018obx2_3F00212C6781220B6B1F796C0DA0A35D5C0AAE41\i386\s1018cmnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 25768 c:\windows\system32\DRVSTORE\s1018ndis_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018nd5.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 25768 c:\windows\system32\DRVSTORE\s1018ndis_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018nd5.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 25384 c:\windows\system32\DRVSTORE\s1018ndis_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018nd3.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 25384 c:\windows\system32\DRVSTORE\s1018ndis_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018nd3.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 15016 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018mdfl.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 15016 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018mdfl.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018cmnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018cmnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018bus_0B40609BB22317BBE8A6B621E727100B605F6BA5\i386\s1018whnt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 12200 c:\windows\system32\DRVSTORE\s1018bus_0B40609BB22317BBE8A6B621E727100B605F6BA5\i386\s1018whnt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 90408 c:\windows\system32\DRVSTORE\s1018bus_0B40609BB22317BBE8A6B621E727100B605F6BA5\i386\s1018bus.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 90408 c:\windows\system32\DRVSTORE\s1018bus_0B40609BB22317BBE8A6B621E727100B605F6BA5\i386\s1018bus.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017whnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017whnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 10792 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017crnt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 10792 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017crnt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017sdm2_FB88FE66DC7F4C8D0969ACDAE3F2D95BD694BB35\i386\s0017cmnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017sdm2_FB88FE66DC7F4C8D0969ACDAE3F2D95BD694BB35\i386\s0017cmnt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017obx2_1FE89284935CB6030A7DFFB405CD91E5DF78A05F\i386\s0017cmnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017obx2_1FE89284935CB6030A7DFFB405CD91E5DF78A05F\i386\s0017cmnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 25768 c:\windows\system32\DRVSTORE\s0017ndis_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017nd5.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 25768 c:\windows\system32\DRVSTORE\s0017ndis_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017nd5.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 25384 c:\windows\system32\DRVSTORE\s0017ndis_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017nd3.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 25384 c:\windows\system32\DRVSTORE\s0017ndis_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017nd3.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 15016 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017mdfl.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 15016 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017mdfl.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017cmnt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017cmnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017bus_C3F1CB57399B43BF3B56C47287BF38A4D1FD24A7\i386\s0017whnt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 12200 c:\windows\system32\DRVSTORE\s0017bus_C3F1CB57399B43BF3B56C47287BF38A4D1FD24A7\i386\s0017whnt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 90536 c:\windows\system32\DRVSTORE\s0017bus_C3F1CB57399B43BF3B56C47287BF38A4D1FD24A7\i386\s0017bus.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 90536 c:\windows\system32\DRVSTORE\s0017bus_C3F1CB57399B43BF3B56C47287BF38A4D1FD24A7\i386\s0017bus.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016whnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016whnt.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 10792 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016crnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 10792 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016crnt.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016sdm2_49EC14686E23454842B5DD1E08A12351912F071A\i386\s0016cmnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016sdm2_49EC14686E23454842B5DD1E08A12351912F071A\i386\s0016cmnt.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016obx2_A8E1C631CA004AB1BE81A3D48D308AF233F680BF\i386\s0016cmnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016obx2_A8E1C631CA004AB1BE81A3D48D308AF233F680BF\i386\s0016cmnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 25512 c:\windows\system32\DRVSTORE\s0016ndis_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016nd5.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 25512 c:\windows\system32\DRVSTORE\s0016ndis_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016nd5.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 25128 c:\windows\system32\DRVSTORE\s0016ndis_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016nd3.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 25128 c:\windows\system32\DRVSTORE\s0016ndis_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016nd3.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 15016 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016mdfl.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 15016 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016mdfl.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016cmnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016cmnt.sys
- 2008-10-18 08:39 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016bus_CBA53D764D4AE1B85F201CB5EAAA002EFC57DFA2\i386\s0016whnt.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 12200 c:\windows\system32\DRVSTORE\s0016bus_CBA53D764D4AE1B85F201CB5EAAA002EFC57DFA2\i386\s0016whnt.sys
- 2008-10-18 08:39 . 2008-05-16 07:03 89256 c:\windows\system32\DRVSTORE\s0016bus_CBA53D764D4AE1B85F201CB5EAAA002EFC57DFA2\i386\s0016bus.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 89256 c:\windows\system32\DRVSTORE\s0016bus_CBA53D764D4AE1B85F201CB5EAAA002EFC57DFA2\i386\s0016bus.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016sdm2_9FBFF1EEEB0015F5CA2F0634B300C450FF556BA3\i386\a016cmnt.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016sdm2_9FBFF1EEEB0015F5CA2F0634B300C450FF556BA3\i386\a016cmnt.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016obx2_3839048F455A46A4FF4033F897B7AAA7BF427B58\i386\a016cmnt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016obx2_3839048F455A46A4FF4033F897B7AAA7BF427B58\i386\a016cmnt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 15016 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016mdfl.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 15016 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016mdfl.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016cmnt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016cmnt.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016bus_DFCCFF5CDE2FABCF26C68FAA7371A787F2CF5BB9\i386\a016whnt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 12200 c:\windows\system32\DRVSTORE\a016bus_DFCCFF5CDE2FABCF26C68FAA7371A787F2CF5BB9\i386\a016whnt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 83880 c:\windows\system32\DRVSTORE\a016bus_DFCCFF5CDE2FABCF26C68FAA7371A787F2CF5BB9\i386\a016bus.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 83880 c:\windows\system32\DRVSTORE\a016bus_DFCCFF5CDE2FABCF26C68FAA7371A787F2CF5BB9\i386\a016bus.sys
+ 2009-06-09 21:33 . 2009-06-09 21:33 44544 c:\windows\assembly\NativeImages_v2.0.50727_32\stdole\5019ed087ec8a14d9736e983fd921bcd\stdole.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 30208 c:\windows\assembly\NativeImages_v2.0.50727_32\SFMARKETLib\9c6ca8198101cf4d8f75c2868be2c8c9\SFMARKETLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 17920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\5d96fbfcd581a442b421680e8ee722ad\Microsoft.VisualC.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 81920 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.QTOControlL#\1bab28dbcf482648bc71bd46d522ba6d\Interop.QTOControlLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 90112 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.PortableDev#\a738272d43dab44188097442c8a4b27f\Interop.PortableDeviceApiLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 90112 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.PortableDev#\36bedcb3ebe29244a43e9c4bacb84a47\Interop.PortableDeviceTypesLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 35840 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.CDDBUICONTR#\c0f8c8731388ff40bdd288960cfc85dd\Interop.CDDBUICONTROLLibSMS.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 41984 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.CDDBLINKLib#\c5a1b928e6f39843af6c073ba601c1b5\Interop.CDDBLINKLibSMS.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 31232 c:\windows\assembly\NativeImages_v2.0.50727_32\Interfaces\8e1b004fff73a94a965b13a98bea2d41\Interfaces.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 77824 c:\windows\assembly\NativeImages_v2.0.50727_32\AxInterop.QTOContro#\a109f5f04109fa41a8d7ee32ea1c8785\AxInterop.QTOControlLib.ni.dll
- 2008-10-18 08:40 . 2007-04-10 09:44 100360 c:\windows\system32\DRVSTORE\se3esdm2_9764AEB0AF92C101555E353C0F0D3CF5C63F33FA\i386\se3emgmt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 100360 c:\windows\system32\DRVSTORE\se3esdm2_9764AEB0AF92C101555E353C0F0D3CF5C63F33FA\i386\se3emgmt.sys
+ 2009-06-09 21:30 . 2007-04-10 09:44 108552 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3emdm.sys
- 2008-10-18 08:40 . 2007-04-10 09:44 108552 c:\windows\system32\DRVSTORE\se3emdm2_B9A80A4AD6A3087EAEC451F69738F8F9B8EAC7FD\i386\se3emdm.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 103976 c:\windows\system32\DRVSTORE\s916sdm2_21F85660AA82023EA111CC6BDFE4E4EF2EDFED63\i386\s916mgmt.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 103976 c:\windows\system32\DRVSTORE\s916sdm2_21F85660AA82023EA111CC6BDFE4E4EF2EDFED63\i386\s916mgmt.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 100008 c:\windows\system32\DRVSTORE\s916obx2_74455A9D7CF2BC68446FD3455ABFCCDA93FFD087\i386\s916obex.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 100008 c:\windows\system32\DRVSTORE\s916obx2_74455A9D7CF2BC68446FD3455ABFCCDA93FFD087\i386\s916obex.sys
- 2008-10-18 08:40 . 2007-11-02 07:17 109992 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916mdm.sys
+ 2009-06-09 21:30 . 2007-11-02 07:17 109992 c:\windows\system32\DRVSTORE\s916mdm2_85F2F98F689E64A6D6F619016E152C56854F40D7\i386\s916mdm.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 117544 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018unic.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 117544 c:\windows\system32\DRVSTORE\s1018unic_1FB7399C397F1804D018D12FD4A89D05C9CDFC95\i386\s1018unic.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 115368 c:\windows\system32\DRVSTORE\s1018sdm2_451645CEF4DA534B9212B7694D6EE15D943601C8\i386\s1018mgmt.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 115368 c:\windows\system32\DRVSTORE\s1018sdm2_451645CEF4DA534B9212B7694D6EE15D943601C8\i386\s1018mgmt.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 111784 c:\windows\system32\DRVSTORE\s1018obx2_3F00212C6781220B6B1F796C0DA0A35D5C0AAE41\i386\s1018obex.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 111784 c:\windows\system32\DRVSTORE\s1018obx2_3F00212C6781220B6B1F796C0DA0A35D5C0AAE41\i386\s1018obex.sys
- 2008-10-18 08:40 . 2008-06-04 03:04 122024 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018mdm.sys
+ 2009-06-09 21:30 . 2008-06-04 03:04 122024 c:\windows\system32\DRVSTORE\s1018mdm2_96CD230B45A6C3088D31CD1D103E1581F23D2EFD\i386\s1018mdm.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 117672 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017unic.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 117672 c:\windows\system32\DRVSTORE\s0017unic_95BCFE53AD24CD5080894C9E5CE1CA2F859005F0\i386\s0017unic.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 115496 c:\windows\system32\DRVSTORE\s0017sdm2_FB88FE66DC7F4C8D0969ACDAE3F2D95BD694BB35\i386\s0017mgmt.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 115496 c:\windows\system32\DRVSTORE\s0017sdm2_FB88FE66DC7F4C8D0969ACDAE3F2D95BD694BB35\i386\s0017mgmt.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 111912 c:\windows\system32\DRVSTORE\s0017obx2_1FE89284935CB6030A7DFFB405CD91E5DF78A05F\i386\s0017obex.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 111912 c:\windows\system32\DRVSTORE\s0017obx2_1FE89284935CB6030A7DFFB405CD91E5DF78A05F\i386\s0017obex.sys
- 2008-10-18 08:40 . 2008-05-27 06:11 122152 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017mdm.sys
+ 2009-06-09 21:30 . 2008-05-27 06:11 122152 c:\windows\system32\DRVSTORE\s0017mdm2_43AD6300F339C81B71BF3052797FB3979C5001D9\i386\s0017mdm.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 115752 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016unic.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 115752 c:\windows\system32\DRVSTORE\s0016unic_9D1BEA0AD7AC1ECEA653A080CB50A95794EB54A6\i386\s0016unic.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 114216 c:\windows\system32\DRVSTORE\s0016sdm2_49EC14686E23454842B5DD1E08A12351912F071A\i386\s0016mgmt.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 114216 c:\windows\system32\DRVSTORE\s0016sdm2_49EC14686E23454842B5DD1E08A12351912F071A\i386\s0016mgmt.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 110632 c:\windows\system32\DRVSTORE\s0016obx2_A8E1C631CA004AB1BE81A3D48D308AF233F680BF\i386\s0016obex.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 110632 c:\windows\system32\DRVSTORE\s0016obx2_A8E1C631CA004AB1BE81A3D48D308AF233F680BF\i386\s0016obex.sys
+ 2009-06-09 21:30 . 2008-05-16 07:03 120744 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016mdm.sys
- 2008-10-18 08:40 . 2008-05-16 07:03 120744 c:\windows\system32\DRVSTORE\s0016mdm2_682450892C06910A09004057C74387FB5E35E414\i386\s0016mdm.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 104488 c:\windows\system32\DRVSTORE\a016sdm2_9FBFF1EEEB0015F5CA2F0634B300C450FF556BA3\i386\a016mgmt.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 104488 c:\windows\system32\DRVSTORE\a016sdm2_9FBFF1EEEB0015F5CA2F0634B300C450FF556BA3\i386\a016mgmt.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 100648 c:\windows\system32\DRVSTORE\a016obx2_3839048F455A46A4FF4033F897B7AAA7BF427B58\i386\a016obex.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 100648 c:\windows\system32\DRVSTORE\a016obx2_3839048F455A46A4FF4033F897B7AAA7BF427B58\i386\a016obex.sys
+ 2009-06-09 21:30 . 2008-01-18 10:46 110504 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016mdm.sys
- 2008-10-18 08:39 . 2008-01-18 10:46 110504 c:\windows\system32\DRVSTORE\a016mdm2_8FC221937B2924C4F9CE55A0CA993E1DEF07D5BB\i386\a016mdm.sys
+ 2009-06-09 21:33 . 2009-06-09 21:33 233472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c9f96cdae04d6d489fe44371621157b8\System.ServiceProcess.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 339968 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\1c5a4705f3a745419c42234217f48501\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 815104 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\ea489b49c0e17247a9194ef1a630b8ac\System.Runtime.Remoting.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 167936 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\1642a5a56bd9874986947bd173641508\System.Configuration.Install.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 700416 c:\windows\assembly\NativeImages_v2.0.50727_32\PerstNET\ed091b8a3704d0429543947ec37007d3\PerstNET.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 147456 c:\windows\assembly\NativeImages_v2.0.50727_32\MediaManager.Utils\b2dd3ceac03ae44592b65c07e02a0465\MediaManager.Utils.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 282624 c:\windows\assembly\NativeImages_v2.0.50727_32\MediaManager.Splash#\102f918aec7ded4595783d30b5d4bbde\MediaManager.SplashScreen.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 974848 c:\windows\assembly\NativeImages_v2.0.50727_32\MediaManager.GUI\8c95ddd5d6d2d04a85a401ba320bdf7b\MediaManager.GUI.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 892928 c:\windows\assembly\NativeImages_v2.0.50727_32\Lucene.Net\fd67be2eb713f9489dd9e284d3256431\Lucene.Net.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 716800 c:\windows\assembly\NativeImages_v2.0.50727_32\log4net\8639cf467b60084f908726b03e3a7b72\log4net.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 847872 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.WMPLib\3859ec499f504b40a11a11997c05a9bc\Interop.WMPLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 348160 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.SHDocVw\12518719775c0c42960748ae17bdc1e9\Interop.SHDocVw.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 221184 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.QTOLibrary\81987546cc07954eac7720a17389ec62\Interop.QTOLibrary.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 118784 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.IWshRuntime#\4c08d142c6c5fc448c05223a3cd6cb9a\Interop.IWshRuntimeLibrary.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 389120 c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.CDDBCONTROL#\a336de65e37f4640bf65993ae3efd4d3\Interop.CDDBCONTROLLibSMS.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 221184 c:\windows\assembly\NativeImages_v2.0.50727_32\GCPlayer\163f74caa1ee0b4f9e6e61e0a3e67ac2\GCPlayer.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 184320 c:\windows\assembly\NativeImages_v2.0.50727_32\AxInterop.WMPLib\2c29db7f7fad8d4f927dc3d2fcd8985d\AxInterop.WMPLib.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 147456 c:\windows\assembly\NativeImages_v2.0.50727_32\AxInterop.SHDocVw\9baf6f8e8cc1644c840a97d061321b44\AxInterop.SHDocVw.ni.dll
+ 2004-11-09 16:06 . 2009-06-09 21:25 1655152 c:\windows\system32\FNTCACHE.DAT
+ 2009-06-09 21:33 . 2009-06-09 21:33 2703360 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\3926d1884cd8064aab2004ded54a82c8\System.Data.SqlXml.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 1179648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\0d9eaf05448f4a44a9bc40e081110b04\System.Data.OracleClient.ni.dll
+ 2009-06-09 21:33 . 2009-06-09 21:33 1040384 c:\windows\assembly\NativeImages_v2.0.50727_32\Sony.MediaSoftware.#\9b62592ccf3fc44fa21ef01d8839d0db\Sony.MediaSoftware.clrshared.ni.dll
+ 2009-06-09 21:32 . 2009-06-09 21:32 1843200 c:\windows\assembly\NativeImages_v2.0.50727_32\MediaManager\de9097b808750f45b3a12c0378a29f4e\MediaManager.ni.exe
+ 2009-06-09 21:33 . 2009-06-09 21:33 7753728 c:\windows\assembly\NativeImages_v2.0.50727_32\AppCommon\7b5e858b4a9aec4ba80c0ea2a196b653\AppCommon.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-04 158208]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"winss"=2 (0x2)
"Nero BackItUp Scheduler 3"=2 (0x2)
"NMIndexingService"=3 (0x3)
"gusvc"=2 (0x2)
"UxTuneUp"=2 (0x2)
"TuneUp.ProgramStatisticsSvc"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\valve\\czero.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\nvsvc32.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\HP_Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\HP_Owner\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-08 28544]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2008-10-18 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2008-10-18 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2008-10-18 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2008-10-18 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2008-10-18 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2008-10-18 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2008-10-18 115752]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2008-10-18 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2008-10-18 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2008-10-18 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2008-10-18 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2008-10-18 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2008-10-18 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2008-10-18 117672]
S4 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-05-27 604416]
SUnknown 27af3eb5;27af3eb5; [x]
SUnknown b9061be1;b9061be1; [x]
SUnknown jxakrhzq;jxakrhzq; [x]
SUnknown qhhkbrno;qhhkbrno; [x]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 10:07]

2009-06-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-453054114-3321203614-4080054335-1007.job
- c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-25 19:46]

2009-06-10 c:\windows\Tasks\User_Feed_Synchronization-{CFEA29CB-5388-4B47-99F1-AD447D471D80}.job
- c:\windows\system32\msfeedssync.exe [2008-08-21 21:35]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: {35D307E8-6B83-4F28-9479-8EC657B823F4} = 218.248.255.139,218.248.255.212
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\
FF - prefs.js: browser.startup.homepage -
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\TechnicianConsole@logmeinrescue.com\platform\WINNT\plugins\npRescue.dll
FF - plugin: c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\HP_Owner\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service

FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 15:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,15,81,e6,06,b4,ed,4d,be,72,cd,\
"3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,15,81,e6,06,b4,ed,4d,be,72,cd,\

[HKEY_USERS\S-1-5-21-453054114-3321203614-4080054335-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-453054114-3321203614-4080054335-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:50,e6,ce,80,05,c7,b6,f3,72,e7,64,23,b0,f5,ad,5c,d2,be,a1,cb,d1,07,ec,
4d,89,ba,6e,88,fe,5d,19,6a,c3,81,05,b9,63,68,8a,3d,09,70,42,88,aa,1f,08,0f,\
"??"=hex:e9,f3,f3,8a,33,5e,1a,21,8e,2f,44,0e,c3,d8,a9,fb
.
Completion time: 2009-06-10 15:43
ComboFix-quarantined-files.txt 2009-06-10 10:13
ComboFix2.txt 2009-06-08 21:36

Pre-Run: 4,103,966,720 bytes free
Post-Run: 4,102,750,208 bytes free

388 --- E O F --- 2009-04-18 03:10

===============================================

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 25 · 2009-06-10T16:51:35+00:00

crunchie 990 Most Valuable Poster

14 Years Ago

Ok, looking pretty good. How is the pc now?

plastered 0 Junior Poster in Training · Answer 26 · 2009-06-10T20:26:05+00:00

The PC is working better now but I am still unable to update. When I try to update any software for example MBAM it says that the internet connection is inactive. I don't understand.

Unable to install Antivirus program

Recommended Answers Collapse Answers

All 40 Replies

Recommended Answers