This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

I think its infected........(or possessed)

67 min read

This thread's last reply is from November 4, 2010, 1:54 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Deogee
November 1, 2010, 4:03 AM UTC
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:58:24 PM, on 10/31/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\basfipm.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\dleacoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\MP3 Rocket Toolbar\Mp3RocketSvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE
C:\Program Files\Dell V310-V510 Series\dleamon.exe
C:\Program Files\Dell V310-V510 Series\ezprint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Mark\My Documents\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Dell Toolbar - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Dell Toolbar - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll
O3 - Toolbar: Mp3Rocket Toolbar - {4C350B19-6CA1-4569-B14C-296D8D65300B} - "C:\Program Files\MP3 Rocket Toolbar\mp3rockettb.dll" (file missing)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Mark\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [dleamon.exe] "C:\Program Files\Dell V310-V510 Series\dleamon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Dell V310-V510 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -update activex (User 'Default user')
O4 - Startup: MP3 Rocket (Minimized).lnk = C:\Program Files\MP3 Rocket\MP3Rocket.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dleaCATSCustConnectService - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dleaserv.exe
O23 - Service: dlea_device - - C:\WINDOWS\system32\dleacoms.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Mp3Rocket Toolbar Helper - Unknown owner - C:\Program Files\MP3 Rocket Toolbar\Mp3RocketSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: ZwankySearch Service - Unknown owner - C:\Documents and Settings\All Users\Application Data\ZwankySearch\zwankysearch143.exe (file missing)

--
End of file - 10350 bytes
Uninstall-log:

µTorrent
ABBYY FineReader 6.0 Sprint
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2
ALPS Touch Pad Driver
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.2.6
avast! Pro Antivirus
Bonjour
Broadcom Advanced Control Suite 2
Broadcom ASF Management Applications
Broadcom Gigabit Integrated Controller
Broadcom Gigabit Integrated Controller
C-Major Audio
Compatibility Pack for the 2007 Office system
Conexant D110 MDC V.92 Modem
Crawler Toolbar with Web Security Guard
Dell Toolbar
Dell V310-V510 Series
Dell Wireless WLAN Card
eMedia Guitar Songs
EPSON CardMonitor
EPSON PhotoStarter3.0
EPSON Print CD
EPSON Printer Software
EPSON SPR300 Reference Guide
eReg
Guitar Pro 5.1
High Definition Audio Driver Package - KB835221
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
Java(TM) 6 Update 17
Logitech SetPoint 6.0
mCore
mDriver
mDrWiFi
mHlpDell
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
mIWA
mLogView
mMHouse
Mozilla Firefox (3.0.15)
MP3 Rocket
MP3 Rocket Toolbar
mPfMgr
mPfWiz
mProSafe
mSCfg
mSSO
MSXML 6 Service Pack 2 (KB954459)
mWlsSafe
mWMI
mZConfig
OGA Notifier 2.0.0048.0
OverDrive Media Console
PowerDVD
QuickTime
RealPlayer
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360131)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Spyware Terminator
Texas Instruments PCIxx21/x515/xx12 drivers.
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Support Tools
Windows XP Service Pack 3
WinRAR archiver

I use Google Chrome as my browser, occasionally, an IE browser will randomly pop up (open) to some ad page.
I've also noticed that my chrome program (window) will just randomly deactivate-- I'll be surfing,then the screen will flicker & that window is no longer active (until I click my mouse on it)
I've also noticed my screen saver will go on, run for a bit,then w/out me touching the mouse, or anything else, it suddenly goes back to my desktop--- can you say ANNOYING!!?!! :evil:
Just as I was typing this out IE opened w/ a Gamevance site--again--- ANNOYING!!! :twisted:

I'm not all that tech savy & I appreciate any & all help you can give me.
Thanks,
Mark
deltalima
November 2, 2010, 10:20 AM UTC
Checking your log - back soon.
deltalima
November 2, 2010, 10:38 AM UTC
Hi Deogee,

Welcome to the forum.

My nickname is deltalima and I will be helping you with your computer problems.

The logs can take some time to research, so please be patient with me.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.


Please note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


Remove P2P Programs

  • I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    µTorrent


  • Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
  • Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

  • Click on start
  • Then Run
  • In the open text entry box please copy/paste appwiz.cpl Then click enter.
  • Press the "Remove" or "Change/Remove"...button to uninstall the programs listed above (in red) and any other P2P you have installed NOW.
  • Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.
Deogee
November 2, 2010, 10:46 AM UTC last edited November 2, 2010, 10:55 AM UTC
Hi deltalima,

Getting rid of that torrent program right now.
Can't thank you enough for helping me out w/ this stuff.
Took MP3 Rocket off as well (another P2P program).
deltalima
November 2, 2010, 10:51 AM UTC
Hi Deogee,

Getting rid of that torrent program right now.


Download and run OTL
Download OTL by Old Timer and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized
  • Please post the contents of these 2 Notepad files in your next reply.


Please download GMER Rootkit Scanner from here.
  • Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
  • Run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the "Scan" and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE

Important! Please do not select the "Show all" checkbox during the scan..

Please post the GMER log along with OTL.txt and Extras.txt from the OTL scan into your next reply.
Deogee
November 2, 2010, 11:12 AM UTC
Heres the OTL log.
If I understand the GMER directions, I need to go off-line & run only that program, so I'll be back w/ that log in a couple minutes.
Again, can't thank you enough for all the help!

OTL logfile created on: 11/2/2010 6:59:38 AM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\Mark\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 148.00 Mb Available Physical Memory | 29.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): c:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.81 Gb Total Space | 37.41 Gb Free Space | 67.02% Space Free | Partition Type: NTFS
Drive D: | 4.13 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: SANDERS-AF551B0 | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mark\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
PRC - C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe (Crawler.com)
PRC - C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Dell V310-V510 Series\ezprint.exe ()
PRC - C:\Program Files\Dell V310-V510 Series\dleamon.exe ()
PRC - C:\WINDOWS\system32\dleacoms.exe ( )
PRC - C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe (Intel(R) Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\system32\BAsfIpM.exe (Broadcom Corp.)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mark\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (ZwankySearch Service) -- C:\Documents and Settings\All Users\Application Data\ZwankySearch\zwankysearch143.exe File not found
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (dlea_device) -- C:\WINDOWS\System32\dleacoms.exe ( )
SRV - (dleaCATSCustConnectService) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dleaserv.exe ()
SRV - (EvtEng) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (WLANKEEPER) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe (Intel(R) Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (BAsfIpM) -- C:\WINDOWS\system32\BAsfIpM.exe (Broadcom Corp.)
SRV - (Pctspk) -- C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)


========== Driver Services (SafeList) ==========

DRV - (UIUSys) -- C:\WINDOWS\System32\drivers\UIUSys.sys File not found
DRV - (sp_rsdrv2) -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ()
DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (ALWIL Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (GTIPCI21) -- C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.SYS (Conexant Systems, Inc.)
DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (STAC97) -- C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (ql1280) -- C:\WINDOWS\System32\drivers\ql1280.sys (QLogic Corporation)
DRV - (ql12160) -- C:\WINDOWS\System32\drivers\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\System32\drivers\ql1080.sys (QLogic Corporation)
DRV - (ultra) -- C:\WINDOWS\System32\drivers\ultra.sys (Promise Technology, Inc.)
DRV - (symc8xx) -- C:\WINDOWS\System32\drivers\symc8xx.sys (LSI Logic)
DRV - (sym_u3) -- C:\WINDOWS\System32\drivers\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\System32\drivers\sym_hi.sys (LSI Logic)
DRV - (asc) -- C:\WINDOWS\System32\drivers\asc.sys (Advanced System Products, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\System32\drivers\sparrow.sys (Adaptec, Inc.)
DRV - (mraid35x) -- C:\WINDOWS\System32\drivers\mraid35x.sys (American Megatrends Inc.)
DRV - (symc810) -- C:\WINDOWS\System32\drivers\symc810.sys (Symbios Logic Inc.)
DRV - (asc3550) -- C:\WINDOWS\System32\drivers\asc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde) -- C:\WINDOWS\System32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (AliIde) -- C:\WINDOWS\System32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (OMCI) -- C:\WINDOWS\system32\drivers\omci.sys (Dell Inc)
DRV - (BASFND) -- C:\WINDOWS\system32\drivers\BASFND.sys (Broadcom Corporation)
DRV - (Vpctcom) -- C:\WINDOWS\system32\DRIVERS\vpctcom.sys (PCtel, Inc.)
DRV - (Vvoice) -- C:\WINDOWS\system32\DRIVERS\vvoice.sys (PCtel, Inc.)
DRV - (Vmodem) -- C:\WINDOWS\system32\DRIVERS\vmodem.sys (PCTEL, INC.)
DRV - (Ptserli) -- C:\WINDOWS\system32\drivers\ptserli.sys (PCTEL, INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1844237615-688789844-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1844237615-688789844-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {5F321A53-3F65-45F2-9903-587E3CA15404}:1.0
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultengine: "Mp3Rocket"
FF - prefs.js..browser.search.defaultenginename: "Mp3Rocket"
FF - prefs.js..browser.search.order.1: "Mp3Rocket"
FF - prefs.js..browser.search.selectedEngine: "Mp3Rocket"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/06/21 10:47:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\Toolbar\firefox\ [2010/10/30 22:49:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/24 12:26:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/24 12:26:33 | 000,000,000 | ---D | M]

[2009/06/20 17:46:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mark\Application Data\Mozilla\Extensions
[2009/06/21 07:26:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\lshiwz9l.default\extensions
[2010/07/26 17:06:02 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/25 09:29:38 | 000,000,000 | ---D | M] (ZwankySearch) -- C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}
[2007/07/26 12:05:16 | 000,001,329 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
[2010/11/02 06:25:24 | 000,045,258 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Mp3Rocket.xml
[2010/11/02 06:25:24 | 000,045,238 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Mp3Rocket.xml.bak

O1 HOSTS File: ([2004/08/12 09:19:39 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Dell Toolbar) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O3 - HKLM\..\Toolbar: (Dell Toolbar) - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-1844237615-688789844-839522115-1003\..\Toolbar\WebBrowser: (Dell Toolbar) - {09B71986-2AC5-482D-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [dleamon.exe] C:\Program Files\Dell V310-V510 Series\dleamon.exe ()
O4 - HKLM..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Dell V310-V510 Series\ezprint.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SpywareTerminator] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UIUCU] C:\Documents and Settings\Mark\Local Settings\Temp\UIUCU.EXE (Conexant Systems, Inc.)
O4 - HKU\S-1-5-21-1844237615-688789844-839522115-1003..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe (Adobe Systems, Inc.)
O4 - HKU\S-1-5-18..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1844237615-688789844-839522115-1003\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-1844237615-688789844-839522115-1003\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-1844237615-688789844-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/05/04 23:27:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{488255a0-5df7-11de-a2be-806d6172696f}\Shell\PlayWithPDVDDX\Command - "" = C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe -- [2007/03/02 15:33:54 | 000,063,600 | ---- | M] (CyberLink Corp.)
O33 - MountPoints2\{720a57c1-38da-11de-958b-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{720a57c1-38da-11de-958b-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{720a57c1-38da-11de-958b-806d6172696f}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/30 22:48:11 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2010/10/30 22:47:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2010/10/30 22:47:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Mark\Application Data\Spyware Terminator
[2010/10/30 22:47:28 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator
[2010/10/29 07:12:02 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/29 07:12:01 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/29 07:10:55 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/28 17:46:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/10/28 17:45:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/03/07 11:41:10 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacoin.dll
[2010/03/07 11:37:40 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dleainpa.dll
[2010/03/07 11:37:40 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\DLEAhcp.dll
[2010/03/07 11:37:39 | 001,048,576 | ---- | C] ( ) -- C:\WINDOWS\System32\dleaserv.dll
[2010/03/07 11:37:39 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\dleausb1.dll
[2010/03/07 11:37:39 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dleapmui.dll
[2010/03/07 11:37:39 | 000,577,536 | ---- | C] ( ) -- C:\WINDOWS\System32\dlealmpm.dll
[2010/03/07 11:37:39 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\dleaiesc.dll
[2010/03/07 11:37:38 | 000,688,128 | ---- | C] ( ) -- C:\WINDOWS\System32\dleahbn3.dll
[2010/03/07 11:37:37 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacomm.dll
[2010/03/07 11:37:36 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacomc.dll
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/02 06:39:00 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003UA.job
[2010/11/01 17:39:05 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003Core.job
[2010/10/31 03:36:38 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\File Helper.job
[2010/10/31 03:35:43 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/10/31 03:34:58 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2010/10/31 03:34:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/10/31 03:34:22 | 000,209,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/31 03:15:36 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/30 22:50:35 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Spyware Terminator.lnk
[2010/10/30 22:47:42 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010/10/30 10:17:20 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/29 14:05:54 | 000,052,365 | ---- | M] () -- C:\Documents and Settings\Mark\Desktop\Freedom.jpg
[2010/10/28 17:17:02 | 000,016,400 | ---- | M] (Logitech, Inc.) -- C:\WINDOWS\System32\drivers\LNonPnP.sys
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/30 22:50:35 | 000,000,797 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Spyware Terminator.lnk
[2010/10/30 22:47:42 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010/10/29 14:06:31 | 000,052,365 | ---- | C] () -- C:\Documents and Settings\Mark\Desktop\Freedom.jpg
[2010/04/25 13:45:48 | 000,008,704 | ---- | C] () -- C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/07 11:41:16 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dleavs.dll
[2010/03/07 11:41:02 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dleagcfg.dll
[2010/03/07 11:41:01 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\dleacui.dll
[2010/03/07 11:41:01 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\dleacuir.dll
[2010/03/07 11:39:02 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\DLEAwupd.dll
[2010/03/07 11:37:40 | 000,385,024 | ---- | C] () -- C:\WINDOWS\System32\DLEAinst.dll
[2010/03/07 11:37:39 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\dleajswr.dll
[2010/03/07 11:37:38 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\dleains.dll
[2010/03/07 11:37:38 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\dleainsb.dll
[2010/03/07 11:37:38 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\dleacu.dll
[2010/03/07 11:37:38 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\dleagrd.dll
[2010/03/07 11:37:38 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dleainsr.dll
[2010/03/07 11:37:38 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\dleacub.dll
[2010/03/07 11:37:38 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dleacur.dll
[2010/03/07 11:37:35 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\DLEAcfg.dll
[2010/03/07 11:33:15 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\DLEAsm.dll
[2010/03/07 11:33:15 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\DLEAsmr.dll
[2010/02/07 13:25:00 | 000,000,093 | ---- | C] () -- C:\WINDOWS\R300.ini
[2009/10/30 08:38:09 | 000,000,621 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2009/09/05 15:17:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/04 12:13:08 | 000,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/07/04 12:13:08 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Mark\Application Data\PnkBstrK.sys
[2009/07/04 12:12:21 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini
[2009/06/20 20:00:24 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2009/06/20 19:36:02 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/06/20 19:32:05 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4764.dll
[2009/06/20 19:29:49 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2009/06/20 19:29:49 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2009/06/03 22:22:53 | 000,007,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\DS1410D.SYS
[2009/06/03 22:22:42 | 000,530,432 | ---- | C] () -- C:\WINDOWS\System32\drivers\Capt931a.sys
[2009/06/03 22:22:42 | 000,024,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\Camd931a.sys
[2009/06/03 22:22:42 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2009/06/03 22:22:39 | 000,051,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\atnt40k.sys
[2009/05/04 14:48:09 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/01/07 18:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

< End of report >
deltalima
November 2, 2010, 11:21 AM UTC
Hi Deogee,

Heres the OTL log


Please also post the Extras.txt log.

If you have problems running GMER then please run this alternative scan.

Scan With RKUnHooker

  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth, Files, Code Hooks. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in a reply here.
Deogee
November 2, 2010, 11:34 AM UTC
deltalima,

Sorry about the Extras log.; here it is. Ran GMER and it didn't find anything. Should I run the RKUnHooker program instead/ additionally?


OTL Extras logfile created on: 11/2/2010 6:59:38 AM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\Mark\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 148.00 Mb Available Physical Memory | 29.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): c:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.81 Gb Total Space | 37.41 Gb Free Space | 67.02% Space Free | Partition Type: NTFS
Drive D: | 4.13 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: SANDERS-AF551B0 | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-1844237615-688789844-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer -- (RealNetworks, Inc.)
"C:\WINDOWS\system32\dleacoms.exe" = C:\WINDOWS\system32\dleacoms.exe:*:Enabled:V310-V510 Series Server -- ( )
"C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe" = C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader -- (ABBYY (BIT Software))
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe" = C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh -- File not found
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" = C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator -- (Crawler.com)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO
"{09B71986-2AC5-482d-B6CB-42EA34F4F85B}" = Dell Toolbar
"{0E0479F8-180F-4054-B4F7-17EE657F90BF}" = TIPCI
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{109D28C7-FB38-483A-9C91-001CB59E2699}" = EPSON CardMonitor
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{25D24E84-64A9-40D2-85CF-540B1C4A6D52}" = Broadcom ASF Management Applications
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 17
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5983C895-DDA4-45D9-A8D1-877D5DE7693E}" = EPSON PhotoStarter3.0
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Advanced Control Suite 2
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E369B27-13E2-41A5-9879-358EE1C8B5AD}" = Broadcom Gigabit Integrated Controller
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{89B078C4-50B0-453E-BF53-3A7E6A0D85FA}" = Windows Support Tools
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8ED929E5-37D5-4E01-8052-4FF5E67F403D}" = OverDrive Media Console
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = C-Major Audio
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}" = EPSON Print CD
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audacity_is1" = Audacity 1.2.6
"avast5" = avast! Pro Antivirus
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.92 Modem
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"Dell V310-V510 Series" = Dell V310-V510 Series
"eMedia Guitar Songs" = eMedia Guitar Songs
"EPSON Printer and Utilities" = EPSON Printer Software
"Guitar Pro 5_is1" = Guitar Pro 5.1
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{0E0479F8-180F-4054-B4F7-17EE657F90BF}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{25D24E84-64A9-40D2-85CF-540B1C4A6D52}" = Broadcom ASF Management Applications
"InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Advanced Control Suite 2
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"ProInst" = Intel(R) PROSet/Wireless Software
"RealPlayer 6.0" = RealPlayer
"Silent Package Run-Time Sample" = EPSON SPR300 Reference Guide
"SP6" = Logitech SetPoint 6.0
"Spyware Terminator_is1" = Spyware Terminator
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1844237615-688789844-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 11/5/2009 7:43:49 AM | Computer Name = SANDERS-AF551B0 | Source = avast! | ID = 33554522
Description =

Error - 11/26/2009 11:10:19 AM | Computer Name = SANDERS-AF551B0 | Source = avast! | ID = 33554522
Description =

Error - 11/27/2009 11:35:22 PM | Computer Name = SANDERS-AF551B0 | Source = avast! | ID = 33554522
Description =

Error - 11/27/2009 11:36:15 PM | Computer Name = SANDERS-AF551B0 | Source = avast! | ID = 33554522
Description =

Error - 11/27/2009 11:36:51 PM | Computer Name = SANDERS-AF551B0 | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 11/1/2010 7:00:13 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8812

Error - 11/1/2010 7:00:15 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/1/2010 7:00:15 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10781

Error - 11/1/2010 7:00:15 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10781

Error - 11/1/2010 7:00:17 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/1/2010 7:00:17 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 13156

Error - 11/1/2010 7:00:17 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 13156

Error - 11/1/2010 7:00:19 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/1/2010 7:00:19 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 15187

Error - 11/1/2010 7:00:19 PM | Computer Name = SANDERS-AF551B0 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 15187

[ System Events ]
Error - 10/30/2010 6:47:55 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).

Error - 10/30/2010 6:48:33 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 10/30/2010 6:48:50 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7034
Description = The Mp3Rocket Toolbar Helper service terminated unexpectedly. It
has done this 1 time(s).

Error - 10/30/2010 6:49:33 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 10/30/2010 11:20:03 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dleaCATSCustConnectService
service to connect.

Error - 10/30/2010 11:20:03 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7000
Description = The dleaCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 10/30/2010 11:21:08 PM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7023
Description = The iPod Service service terminated with the following error: %%2147549465

Error - 10/30/2010 11:21:28 PM | Computer Name = SANDERS-AF551B0 | Source = DCOM | ID = 10010
Description = The server {063D34A4-BF84-4B8D-B699-E8CA06504DDE} did not register
with DCOM within the required timeout.

Error - 10/31/2010 3:35:27 AM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the dleaCATSCustConnectService
service to connect.

Error - 10/31/2010 3:35:28 AM | Computer Name = SANDERS-AF551B0 | Source = Service Control Manager | ID = 7000
Description = The dleaCATSCustConnectService service failed to start due to the
following error: %%1053


< End of report >
deltalima
November 2, 2010, 11:38 AM UTC
Hi Deogee,

Ran GMER and it didn't find anything


Please post the log from GMER as detections are not obvious. If no log was produced then please run RKUnHooker and post that log.
Deogee
November 2, 2010, 11:57 AM UTC
UnHook Log:


RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0xF7CB0000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5672960 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xBF1CC000 C:\WINDOWS\System32\igxpdx32.DLL 2531328 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xF7A1C000 C:\WINDOWS\system32\DRIVERS\w29n51.sys 2211840 bytes (Intel® Corporation, Intel® Wireless LAN Driver)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2066816 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2066816 bytes
0x804D7000 RAW 2066816 bytes
0x804D7000 WMIxWDM 2066816 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF04E000 C:\WINDOWS\System32\igxpdv32.DLL 1564672 bytes (Intel Corporation, Component GHAL Driver)
0xF828C000 vmodem.sys 606208 bytes (PCTEL, INC., HSP Modem Modem Device Driver)
0xF83AF000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xAA3FB000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0xAA53E000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF8320000 vpctcom.sys 401408 bytes (PCtel, Inc., HSP Modem Virtual Control Device)
0xF7885000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAA694000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA98DC000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xAA4C6000 C:\WINDOWS\System32\Drivers\aswSnx.SYS 331776 bytes (ALWIL Software, avast! Virtualization Driver)
0xF79D9000 C:\WINDOWS\system32\drivers\STAC97.sys 274432 bytes (SigmaTel, Inc., SigmaTel Audio Driver (WDM))
0xA91BB000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF78E3000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xF8503000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA9CE7000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF8382000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xAA5AE000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF7C72000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 172032 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.)
0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 172032 bytes (Intel Corporation, Intel Graphics 2D Driver)
0xAA644000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xAA517000 C:\WINDOWS\System32\Drivers\aswSP.SYS 159744 bytes (ALWIL Software, avast! self protection module)
0xAA5D9000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xF79B5000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF7C4E000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF7992000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAA5FF000 C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 143360 bytes (-, -)
0xAA622000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806D0000 ACPI_HAL 131840 bytes
0x806D0000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF8465000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF84B5000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF84D4000 pcmcia.sys 122880 bytes (Microsoft Corporation, PCMCIA Bus Driver)
0xF7977000 C:\WINDOWS\system32\DRIVERS\Apfiltr.sys 110592 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)
0xF8272000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF849D000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xAA3E3000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF8485000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xA9F94000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (ALWIL Software, avast! File System Filter Driver for Windows XP)
0xA8637000 C:\DOCUME~1\Mark\LOCALS~1\Temp\fwwirpow.sys 94208 bytes
0xF843C000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF794C000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF7C38000 C:\WINDOWS\system32\DRIVERS\gtipci21.sys 90112 bytes (Texas Instruments, Texas Instruments PCI GemCore IFD Handler)
0xA9BE2000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF7963000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF7C9C000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAA6ED000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver)
0xF8453000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF84F2000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF793B000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xA864E000 C:\WINDOWS\System32\Drivers\Udfs.SYS 69632 bytes (Microsoft Corporation, UDF File System Driver)
0xF8792000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF8862000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF8842000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF8682000 vvoice.sys 65536 bytes (PCtel, Inc., HSP Modem device driver)
0xF8822000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF8872000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA9DBC000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF86F2000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF8672000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF8832000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF8882000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF8652000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF8762000 C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xF88A2000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF8722000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF8852000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF8642000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF8892000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF8702000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (ALWIL Software, avast! TDI Filter Driver)
0xF8632000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF86C2000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF86B2000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF8662000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF8752000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF8812000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF86A2000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF8712000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA985C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF8772000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF88C2000 cercsr6.sys 32768 bytes (Adaptec, Inc., DELL CERC SATA1.5/6ch Miniport Driver)
0xF88E2000 C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.)
0xF88EA000 C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.)
0xF8A0A000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF8A2A000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF89A2000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF8A3A000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF88B2000 C:\WINDOWS\System32\Drivers\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF8A32000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (ALWIL Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
0xF89BA000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xF89B2000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF89AA000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF899A000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF89FA000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF897A000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0xF898A000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (ALWIL Software, avast! TDI RDR Driver)
0xF8A02000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF88BA000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF89CA000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF89D2000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF89C2000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF8912000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF8A4A000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver)
0xF8ADE000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0xF8B16000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xAA1AF000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xAA2C3000 C:\WINDOWS\system32\DRIVERS\s24trans.sys 16384 bytes (Intel Corporation, Intel WLAN Packet Driver)
0xF8AE6000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF8AE2000 C:\WINDOWS\system32\DRIVERS\SMCLIB.SYS 16384 bytes (Microsoft Corporation, Smard Card Driver Library)
0xAA30F000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (ALWIL Software, avast! File System Access Blocking Driver)
0xF8A42000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF8A46000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0xAA4BE000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF7865000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF8ABE000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xA9C13000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xF8219000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF8AEE000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF8AC6000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF8B94000 C:\WINDOWS\system32\Drivers\BASFND.sys 8192 bytes (Broadcom Corporation, Broadcom NetDetect Driver.)
0xF8B68000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF8BCA000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF8B66000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF8B36000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF8B32000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF8B6A000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF8B86000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF8B6C000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF8B54000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF8B5E000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF8B34000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF8D47000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF8C85000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF8C96000 C:\WINDOWS\System32\Drivers\LBeepKE.sys 4096 bytes (Logitech, Inc., Logitech Consumer Control Filter Driver.)
0xF8C1F000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF8BFA000 PCIIde.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0002AC54, Type: Inline - RelativeJump 0x80501C54-->80501CA8 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002AD70, Type: Inline - RelativeJump 0x80501D70-->80501DD7 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002AD90, Type: Inline - RelativeJump 0x80501D90-->80501E14 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002AD98, Type: Inline - RelativeJump 0x80501D98-->80501DF0 [ntkrnlpa.exe]
ntkrnlpa.exe+0x0002AE80, Type: Inline - RelativeJump 0x80501E80-->80501E7B [ntkrnlpa.exe]
ntkrnlpa.exe+0x0006AA9A, Type: Inline - RelativeJump 0x80541A9A-->80541AA1 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtCreateProcessEx, Type: Inline - RelativeJump 0x805C73EA-->AA52CBA0 [aswSP.SYS]
ntkrnlpa.exe-->ObInsertObject, Type: Inline - RelativeJump 0x805B8B58-->AA529F6C [aswSP.SYS]
ntkrnlpa.exe-->ObMakeTemporaryObject, Type: Inline - RelativeJump 0x805B1CE0-->AA5285B4 [aswSP.SYS]
[3484]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[3484]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[3484]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->00000000 [shimeng.dll]
[3484]explorer.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->00000000 [shimeng.dll]
[3484]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[3484]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[3484]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x771B1248-->00000000 [shimeng.dll]
[3484]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[5736]chrome.exe-->kernel32.dll-->CreateNamedPipeW, Type: IAT modification 0x004631D0-->00000000 [unknown_code_page]
[5736]chrome.exe-->ntdll.dll-->NtOpenProcessToken, Type: Inline - RelativeCall 0x7C90D614-->00000000 [unknown_code_page]
[5736]chrome.exe-->ntdll.dll-->NtOpenThreadTokenEx, Type: Inline - RelativeCall 0x7C90D684-->00000000 [unknown_code_page]
[5736]chrome.exe-->ntdll.dll-->NtQueryFullAttributesFile, Type: Inline - RelativeCall 0x7C90D7B4-->00000000 [unknown_code_page]
[712]CToolbar.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->00000000 [shimeng.dll]
[712]CToolbar.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77DD1214-->00000000 [aclayers.dll]
[712]CToolbar.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77DD105C-->00000000 [aclayers.dll]
[712]CToolbar.exe-->advapi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77DD11E0-->00000000 [aclayers.dll]
[712]CToolbar.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->00000000 [shimeng.dll]
[712]CToolbar.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77F11084-->00000000 [aclayers.dll]
[712]CToolbar.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77F11078-->00000000 [aclayers.dll]
[712]CToolbar.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77F110B8-->00000000 [aclayers.dll]
[712]CToolbar.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0056AAA4-->00000000 [shimeng.dll]
[712]CToolbar.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0056AF3C-->00000000 [shimeng.dll]
[712]CToolbar.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x0056B114-->00000000 [shimeng.dll]
[712]CToolbar.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x0056AEF4-->00000000 [aclayers.dll]
[712]CToolbar.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x0056B118-->00000000 [aclayers.dll]
[712]CToolbar.exe-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x0056AA98-->00000000 [aclayers.dll]
[712]CToolbar.exe-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x0056AEF0-->00000000 [aclayers.dll]
[712]CToolbar.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->00000000 [shimeng.dll]
[712]CToolbar.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7C9C13E8-->00000000 [aclayers.dll]
[712]CToolbar.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x7C9C163C-->00000000 [aclayers.dll]
[712]CToolbar.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7C9C161C-->00000000 [aclayers.dll]
[712]CToolbar.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7C9C15A0-->00000000 [aclayers.dll]
[712]CToolbar.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->00000000 [shimeng.dll]
[712]CToolbar.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x7E4112F4-->00000000 [aclayers.dll]
[712]CToolbar.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x7E411208-->00000000 [aclayers.dll]
[712]CToolbar.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x7E411340-->00000000 [aclayers.dll]
[712]CToolbar.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x771B1248-->00000000 [shimeng.dll]
[712]CToolbar.exe-->wininet.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x771B124C-->00000000 [aclayers.dll]
[712]CToolbar.exe-->wininet.dll-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x771B1214-->00000000 [aclayers.dll]
[712]CToolbar.exe-->wininet.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x771B122C-->00000000 [aclayers.dll]
[712]CToolbar.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->00000000 [shimeng.dll]
[712]CToolbar.exe-->ws2_32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x71AB10A8-->00000000 [aclayers.dll]
[932]services.exe-->advapi32.dll-->CreateProcessAsUserW, Type: IAT modification 0x01001094-->00000000 [unknown_code_page]
[932]services.exe-->kernel32.dll-->CreateProcessW, Type: IAT modification 0x01001114-->00000000 [unknown_code_page]
deltalima
November 2, 2010, 12:07 PM UTC
Hi Deogee,

Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the textbox. Do not include the word Code
    :otl
    
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
    
SRV - (ZwankySearch Service) -- C:\Documents and Settings\All Users\Application Data\ZwankySearch\zwankysearch143.exe File not found
    
:commands
    
[EMPTYTEMP]
    
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click .
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.


MBRCheck

Please download MBRCheck.exe to your desktop.
  • Double-click on MBRCheck.exe to run it.
  • It will show a Black screen with some information.
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file in you're next reply.


Malwarebytes Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and select then follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please post that log in your next reply.
The log can also be found here:
  1. Launch Malwarebytes' Anti-Malware
  2. Click on the Logs radio tab.


Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
Deogee
November 2, 2010, 1:22 PM UTC
Here's the most recent logs:


All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\SITEguard deleted successfully.
Service ZwankySearch Service stopped successfully!
Service ZwankySearch Service deleted successfully!
File C:\Documents and Settings\All Users\Application Data\ZwankySearch\zwankysearch143.exe File not found not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 56378945 bytes
->Java cache emptied: 17505 bytes
->Flash cache emptied: 5739 bytes

User: Mark
->Temp folder emptied: 793912427 bytes
->Temporary Internet Files folder emptied: 1686209376 bytes
->Java cache emptied: 69662214 bytes
->FireFox cache emptied: 61232913 bytes
->Google Chrome cache emptied: 371096225 bytes
->Flash cache emptied: 180397 bytes

User: NetworkService
->Temp folder emptied: 956702 bytes
->Temporary Internet Files folder emptied: 31539339 bytes
->Flash cache emptied: 3327 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 4337895 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 143000855 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 107450242 bytes

Total Files Cleaned = 3,172.00 mb


OTL by OldTimer - Version 3.2.17.2 log created on 11022010_083458

Files\Folders moved on Reboot...
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ON7JYSLT\st[1].htm moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\MBM32PAZ\gdefault300[1].htm moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\MBM32PAZ\st[5] moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IZQ9GF41\CAS1MJKL.htm moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8J4NORAJ\st[31] moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\4TQ4443L\iframes_api_loader[1].htm moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0LUNOL6N\st[6] moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0LUNOL6N\st[8] moved successfully.
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...


MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 140):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xF8B32000 \WINDOWS\system32\KDCOM.DLL
0xF8A42000 \WINDOWS\system32\BOOTVID.dll
0xF8503000 ACPI.sys
0xF8B34000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF84F2000 pci.sys
0xF8632000 isapnp.sys
0xF8A46000 compbatt.sys
0xF8A4A000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF8BFA000 PCIIde.sys
0xF88B2000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF8B36000 intelide.sys
0xF84D4000 pcmcia.sys
0xF8642000 MountMgr.sys
0xF84B5000 ftdisk.sys
0xF88BA000 PartMgr.sys
0xF8652000 VolSnap.sys
0xF849D000 atapi.sys
0xF88C2000 cercsr6.sys
0xF8485000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF8662000 disk.sys
0xF8672000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF8465000 fltmgr.sys
0xF8453000 sr.sys
0xF843C000 KSecDD.sys
0xF83AF000 Ntfs.sys
0xF8382000 NDIS.sys
0xF8682000 vvoice.sys
0xF8320000 vpctcom.sys
0xF828C000 vmodem.sys
0xF8272000 Mup.sys
0xF8862000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF8AE2000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7CB0000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF7C9C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7C72000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xF89B2000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7C4E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF89BA000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7C38000 \SystemRoot\system32\DRIVERS\gtipci21.sys
0xF8AE6000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS
0xF7A1C000 \SystemRoot\system32\DRIVERS\w29n51.sys
0xF79D9000 \SystemRoot\system32\drivers\STAC97.sys
0xF79B5000 \SystemRoot\system32\drivers\portcls.sys
0xF8882000 \SystemRoot\system32\drivers\drmk.sys
0xF7992000 \SystemRoot\system32\drivers\ks.sys
0xF8892000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7977000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xF89C2000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF89CA000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF88A2000 \SystemRoot\system32\DRIVERS\serial.sys
0xF8AEE000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7963000 \SystemRoot\system32\DRIVERS\parport.sys
0xF86A2000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF86B2000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF86C2000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF89D2000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF8D46000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF86D2000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF8AF6000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF794C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF86E2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF86F2000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF89DA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF793B000 \SystemRoot\system32\DRIVERS\psched.sys
0xF8702000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF89E2000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF89EA000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF790B000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF8712000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF8B54000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF7885000 \SystemRoot\system32\DRIVERS\update.sys
0xF8B12000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8722000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8752000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8B60000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8AC2000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF8A02000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF8ACA000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF8772000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF8A0A000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF8A12000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0xF8782000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xAA6A5000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xF8ACE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF8A1A000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0xF8B6C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8C3F000 \SystemRoot\System32\Drivers\Null.SYS
0xF8B6E000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8A2A000 \SystemRoot\System32\drivers\vga.sys
0xF8B70000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8B72000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF8A32000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8A3A000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8ADA000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA64A000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA5F1000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF8792000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xAA5C9000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAA5A7000 \SystemRoot\System32\drivers\afd.sys
0xF87A2000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAA584000 \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
0xAA559000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAA4E9000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF87B2000 \SystemRoot\System32\Drivers\Fips.SYS
0xAA4C3000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF87C2000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAA49C000 \SystemRoot\System32\Drivers\aswSP.SYS
0xAA44B000 \SystemRoot\System32\Drivers\aswSnx.SYS
0xF8912000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xAA412000 \SystemRoot\System32\Drivers\Udfs.SYS
0xAA3FA000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8BAC000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xAA681000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8942000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8D4D000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
0xBF1CC000 \SystemRoot\System32\igxpdx32.DLL
0xAA32E000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF8972000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xAA2CA000 \SystemRoot\system32\DRIVERS\s24trans.sys
0xAA1CA000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9F83000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xA9CD6000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF8B68000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF8B7E000 \??\C:\WINDOWS\system32\Drivers\BASFND.sys
0xA9BD1000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9D7B000 \SystemRoot\system32\drivers\sysaudio.sys
0xF8C31000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xA9C06000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA996B000 \SystemRoot\system32\DRIVERS\srv.sys
0xF8922000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xA947A000 \SystemRoot\System32\Drivers\HTTP.sys
0xA8E5F000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 64):
0 System Idle Process
4 System
808 C:\WINDOWS\system32\smss.exe
856 csrss.exe
880 C:\WINDOWS\system32\winlogon.exe
924 C:\WINDOWS\system32\services.exe
936 C:\WINDOWS\system32\lsass.exe
1096 C:\WINDOWS\system32\svchost.exe
1164 svchost.exe
1224 C:\WINDOWS\system32\svchost.exe
1232 C:\WINDOWS\system32\svchost.exe
1296 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1436 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1464 C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
1472 C:\WINDOWS\system32\svchost.exe
1612 svchost.exe
1700 svchost.exe
1900 C:\WINDOWS\system32\WLTRYSVC.EXE
1912 C:\WINDOWS\system32\BCMWLTRY.EXE
1960 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
520 C:\WINDOWS\explorer.exe
900 C:\WINDOWS\system32\spoolsv.exe
1132 scardsvr.exe
1352 svchost.exe
1048 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1520 C:\WINDOWS\system32\BAsfIpM.exe
1412 C:\Program Files\Bonjour\mDNSResponder.exe
1696 C:\WINDOWS\system32\dleacoms.exe
1724 C:\Program Files\Java\jre6\bin\jqs.exe
1992 C:\WINDOWS\system32\pctspk.exe
168 C:\WINDOWS\system32\PnkBstrA.exe
164 C:\WINDOWS\system32\PnkBstrB.exe
204 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
236 C:\Program Files\Spyware Terminator\sp_rsser.exe
364 C:\WINDOWS\system32\svchost.exe
1688 C:\WINDOWS\system32\wuauclt.exe
2308 alg.exe
2868 C:\WINDOWS\system32\WLTRAY.EXE
2884 C:\WINDOWS\system32\hkcmd.exe
2912 C:\WINDOWS\system32\igfxsrvc.exe
2996 C:\WINDOWS\system32\igfxpers.exe
3080 C:\Program Files\Apoint\Apoint.exe
3144 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
3160 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
3188 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
3196 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
3212 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
3256 C:\Program Files\Apoint\hidfind.exe
3264 C:\Program Files\Apoint\ApntEx.exe
3280 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE
3320 C:\Program Files\Dell V310-V510 Series\dleamon.exe
3332 C:\Program Files\Dell V310-V510 Series\ezprint.exe
3348 C:\Program Files\Java\jre6\bin\jusched.exe
3376 C:\Program Files\iTunes\iTunesHelper.exe
3412 C:\Program Files\Logitech\SetPointP\SetPoint.exe
3432 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
3620 C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
3692 C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
3788 C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
3796 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
2300 C:\Program Files\iPod\bin\iPodService.exe
2708 C:\Program Files\Logitech\SetPointP\LU\LULnchr.exe
380 C:\Program Files\Logitech\SetPointP\LU\LogitechUpdate.exe
3968 C:\Documents and Settings\Mark\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK6026GAX, Rev: PA202D

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Known-bad MBR code detected (Whistler / Black Internet)!
SHA1: FBB1A7660497C080BE7F8A83E98FA5AB7B98DC19


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5021

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/2/2010 9:09:28 AM
mbam-log-2010-11-02 (09-09-28).txt

Scan type: Quick scan
Objects scanned: 134005
Time elapsed: 11 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404} (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\chrome (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\defaults (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\defaults\preferences (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\ZwankySearch (Adware.ZwankySearch) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\chrome.manifest (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\install.rdf (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\chrome\zwankysearch.jar (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{5F321A53-3F65-45F2-9903-587E3CA15404}\defaults\preferences\prefs.js (Adware.ZwankySearch) -> Quarantined and deleted successfully.
C:\Program Files\ZwankySearch\zwankysearch.exe (Adware.ZwankySearch) -> Quarantined and deleted successfully.
deltalima
November 2, 2010, 1:59 PM UTC
Hi Deogee,

The infection that you have is stored in the boot section of your hard disk. Failure of this "MBR" to do its job properly would result in a machine that could not boot up at all, so any changes to the MBR have to be done very carefully.

In your case, a replacement of the MBR with a standard one would most likely work, but is not without risk. If you have no install disks and the only way to recover the computer is from a recovery partition then you would loose the ability to do so even if the fix worked.

If you understand the risks involved and are prepared (and have the disks) to reinstall the operating system if things go wrong we can proceed.

The only other alternative is to reinstall from the recovery partition (if one is present on the computer).

Please let me know what you would like to do or ask if you have any questions.
Deogee
November 2, 2010, 2:42 PM UTC
deltalima,

I believe I have the proper disks to reinstall my OS, so whats the next step in this process.
deltalima
November 2, 2010, 3:07 PM UTC
Hi Deogee,

Run Combofix

Temporarily disable any antispyware, antivirus and or antimalware real-time protection as they may interfere with running of ComboFix.

Download ComboFix from here to your Desktop.

For more information about Combofix please see here.

Close all programs.

Double click combofix.exe and follow the prompts.

If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures, if not, then follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Once installed, you should see the following message:

The recovery console was successfuly installed.
Click ‘YES’ to continue scanning for malware
Click ‘NO’ for exit

Click the YES button.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your “drive access” light. If it is flashing, Combofix is still at work.

When finished ComboFix will produce a log file. Please post the contents of this log in your next reply.