Need help with Win32/Nuqel.E virus

Page 1 of 3 1, 2, 3  Next

View previous topic View next topic Go down

Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 2:12 am

The Win32/Nuqel.E virus popped up on my son's computer the other day (he didn't install an anti-virus like I told him to). After some searching I was able to remove it (at least I think I got it) using "SafeReturner". I installed the AV and Malwarebytes, but when I run them, they both hang up on the "wmpeffects.dll" file. I'm at a loss as what to do next. I installed Hijackthis, and the log is posted below. Thanks for any help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:34 AM, on 8/16/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\CA\CA Internet Security Suite\ccEvtMgr.exe
C:\Program Files\WeFi\WeFi.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\tbh\base\bin\tbhSystray.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Users\Jason\Downloads\OTL.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: YSPManager - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [tbhSystray] C:\Program Files\tbh\base\bin\tbhSystray.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Turbine Download Manager Tray Icon] "C:\Program Files\Turbine\Turbine Download Manager\TurbineDownloadManagerIcon.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\casc.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files\Logitech\Logitech Vid\vid.exe" -bootmode
O4 - HKCU\..\Run: [wefi] C:\Program Files\WeFi\WeFi.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [Aim] "C:\Program Files\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: ZooskMessenger.lnk = C:\Program Files\ZooskMessenger\ZooskMessenger.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Google Sidewiki... - [You must be registered and logged in to see this link.] Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - [You must be registered and logged in to see this link.]
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - [You must be registered and logged in to see this link.]
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1ca246f1f3fdfd0) (gupdate1ca246f1f3fdfd0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: The Browser Highlighter Monitor (tbhMonitor.exe) - Unknown owner - C:\Program Files\tbh\monitor\bin\tbhMonitor.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: WeFi Engine Service (WefiEngSvc) - WeFi - C:\Program Files\WeFi\WefiEngSvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 13550 bytes

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Tue 17 Aug 2010, 10:54 am

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)



  • Press "Fix Checked"
  • Close Hijack This.

Remove the Proxy setting in Internet Explorer and/or in FireFox.

    In Internet Explorer
  1. Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox
  1. Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection > Choose "No Proxy"
  2. Click the apply button and restart that computer in normal mode.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 11:16 am

Here's the log.

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4430

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

8/16/2010 8:14:17 PM
mbam-log-2010-08-16 (20-14-17).txt

Scan type: Quick scan
Objects scanned: 136642
Time elapsed: 8 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Tue 17 Aug 2010, 11:22 am

Hello.

Download OTL by OldTimer to your Desktop.

  • Close all windows and double click OTL.exe
  • Click Run Scan and let the program run uninterrupted
  • It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  • You may need to use two posts to get it all.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 11:40 am

txt file

OTL logfile created on: 8/16/2010 8:33:34 PM - Run 3
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Users\Jason\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224.17 Gb Total Space | 166.59 Gb Free Space | 74.31% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JASON-PC
Current User Name: Jason
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/16 20:20:04 | 000,062,760 | ---- | M] () -- c:\Program Files\tbh\base\bin\tbhDaemon.exe
PRC - [2010/08/16 10:54:37 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Jason\Downloads\OTL.exe
PRC - [2010/08/15 17:01:45 | 000,396,288 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
PRC - [2010/08/14 19:45:19 | 001,721,680 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\casc.exe
PRC - [2010/08/14 19:45:17 | 001,103,184 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\ccevtmgr.exe
PRC - [2010/08/14 19:45:17 | 000,251,216 | ---- | M] (CA, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
PRC - [2010/08/14 19:45:17 | 000,206,160 | ---- | M] (Computer Associates International, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
PRC - [2010/06/16 22:33:32 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/04/12 18:46:36 | 001,135,912 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/01/11 20:07:01 | 002,935,480 | ---- | M] () -- C:\Program Files\Pando Networks\Media Booster\PMB.exe
PRC - [2009/11/20 17:09:16 | 000,212,992 | ---- | M] (Computer Associates International, Inc.) -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe
PRC - [2009/10/22 14:57:44 | 000,070,952 | ---- | M] () -- C:\Program Files\tbh\monitor\bin\tbhMonitor.exe
PRC - [2009/08/04 11:42:18 | 000,887,288 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
PRC - [2009/07/27 16:40:44 | 000,227,832 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
PRC - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/07/13 11:39:14 | 000,760,664 | ---- | M] (CA) -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
PRC - [2009/06/09 05:55:24 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/02 12:47:04 | 000,234,888 | ---- | M] () -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
PRC - [2009/04/02 12:47:02 | 000,464,264 | ---- | M] () -- C:\Program Files\AskBarDis\bar\bin\AskService.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/08/04 17:46:22 | 000,046,392 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
PRC - [2008/07/18 23:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2008/06/25 18:05:58 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxext.exe
PRC - [2008/06/02 16:26:48 | 000,505,720 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\SmoothView\SmoothView.exe
PRC - [2008/05/09 14:49:30 | 000,716,800 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
PRC - [2008/04/24 16:03:12 | 000,430,080 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
PRC - [2008/04/17 03:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2008/04/15 20:54:42 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/04/15 20:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008/04/08 18:14:50 | 006,037,504 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008/02/06 16:52:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
PRC - [2008/02/06 16:52:40 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
PRC - [2007/12/03 20:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe
PRC - [2007/11/21 20:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe
PRC - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


========== Modules (SafeList) ==========

MOD - [2010/08/16 10:54:37 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Jason\Downloads\OTL.exe
MOD - [2009/04/11 02:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/20 22:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/08/14 19:45:17 | 000,251,216 | ---- | M] (CA, Inc.) [On_Demand | Running] -- C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe -- (CaCCProvSP)
SRV - [2010/08/14 19:45:17 | 000,206,160 | ---- | M] (Computer Associates International, Inc.) [Auto | Running] -- C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe -- (ccSchedulerSVC)
SRV - [2010/06/19 11:13:59 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-051210-111108)
SRV - [2010/03/16 11:23:14 | 000,133,976 | ---- | M] (WeFi) [On_Demand | Stopped] -- C:\Program Files\WeFi\WefiEngSvc.exe -- (WefiEngSvc)
SRV - [2009/11/20 17:09:16 | 000,212,992 | ---- | M] (Computer Associates International, Inc.) [Auto | Running] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe -- (CAISafe)
SRV - [2009/11/06 10:18:50 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/10/22 14:57:44 | 000,070,952 | ---- | M] () [Auto | Running] -- C:\Program Files\tbh\monitor\bin\tbhMonitor.exe -- (tbhMonitor.exe)
SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/08/04 11:42:18 | 000,887,288 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe -- (UmxAgent)
SRV - [2009/07/27 16:40:44 | 000,227,832 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe -- (UmxPol)
SRV - [2009/07/24 16:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009/07/13 11:39:14 | 000,760,664 | ---- | M] (CA) [Auto | Running] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe -- (UmxCfg)
SRV - [2009/04/02 12:47:04 | 000,234,888 | ---- | M] () [Auto | Running] -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe -- (ASKUpgrade)
SRV - [2009/04/02 12:47:02 | 000,464,264 | ---- | M] () [Auto | Running] -- C:\Program Files\AskBarDis\bar\bin\AskService.exe -- (ASKService)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/04 17:46:22 | 000,046,392 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2008/07/18 23:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2008/04/17 03:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2008/04/15 20:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/02/06 16:52:40 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/03 20:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)
SRV - [2007/11/21 20:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2005/11/14 04:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\SYSPREP\Drivers\ioport.sys -- (IO_Memory)
DRV - [2009/12/23 11:29:36 | 000,132,088 | ---- | M] (CA) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\KmxAMRT.sys -- (KmxAMRT)
DRV - [2009/12/23 11:29:36 | 000,078,840 | ---- | M] (CA) [File_System | System | Running] -- C:\Windows\System32\drivers\KmxAgent.sys -- (KmxAgent)
DRV - [2009/09/30 17:51:00 | 000,239,608 | ---- | M] (CA) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KmxCfg.sys -- (KmxCfg)
DRV - [2009/07/24 16:05:24 | 000,030,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/04/30 19:03:08 | 006,754,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam 200(UVC)
DRV - [2009/04/30 19:01:36 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2009/04/30 19:00:00 | 000,114,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2009/04/30 18:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2009/04/30 18:55:34 | 000,013,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/03/27 16:27:04 | 000,598,656 | ---- | M] (Computer Associates International, Inc.) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\KmxAMVet.sys -- (KmxAMVet)
DRV - [2009/03/11 19:17:20 | 000,063,488 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTSTOR.sys -- (RTSTOR)
DRV - [2008/07/18 21:52:16 | 000,279,376 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)
DRV - [2008/06/12 21:43:16 | 002,381,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2008/04/15 20:53:44 | 000,312,344 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008/04/15 13:05:08 | 000,118,784 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/09 21:00:04 | 002,095,512 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/01/20 22:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 22:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 22:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 22:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 22:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 22:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 22:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 22:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 22:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 22:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008/01/20 22:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 22:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 22:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 22:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 22:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 22:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 22:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 22:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 22:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 22:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 22:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 22:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 22:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 22:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 22:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2008/01/18 12:22:00 | 000,009,216 | ---- | M] (Inventec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\sysprep\PEDRV.SYS -- (SVRPEDRV)
DRV - [2007/12/26 13:20:32 | 000,290,304 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2007/12/14 14:53:24 | 000,024,200 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2007/12/06 21:12:48 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007/11/09 17:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2006/11/28 18:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/20 17:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2006/11/09 02:32:00 | 000,219,264 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I)
DRV - [2006/11/09 02:31:00 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 23 A0 24 01 CB 51 4D 4A B9 92 F9 79 BD 73 AF 4B [binary data]
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Kiwee Toolbar"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {a80dfa7c-a648-47ef-8476-2393adbc92a2}:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..keyword.URL: "http://search.imgag.com/?appid=kwtb&component=UnifiedToolbarFF&c=GNKWO50020&sbs=1&sc=&f=web&vernum=3.1&uid=&did={49cf3a46-457f-451e-8f9e-25a557301c44}&q="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 01:29:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/16 17:35:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/16 17:35:01 | 000,000,000 | ---D | M]

[2009/10/30 17:33:38 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\Mozilla\Extensions
[2009/10/30 17:33:38 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2010/08/16 02:22:42 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions
[2009/09/04 12:55:17 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/08/10 03:36:59 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/01/13 03:35:32 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions\{a80dfa7c-a648-47ef-8476-2393adbc92a2}
[2009/09/21 14:16:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/03/19 22:27:24 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\extensions\browserhighlighter@ebay.com
[2009/12/28 04:26:11 | 000,002,069 | ---- | M] () -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\searchplugins\kiwee-toolbar.xml
[2009/09/28 21:46:40 | 000,002,160 | ---- | M] () -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\enrk1ksp.default\searchplugins\MySpace.xml
[2010/07/21 02:43:51 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/01 00:01:03 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/01/11 20:06:56 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe (CA, Inc.)
O4 - HKLM..\Run: [cfFncEnabler.exe] File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [tbhSystray] C:\Program Files\tbh\base\bin\tbhSystray.exe (eBay)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Turbine Download Manager Tray Icon] C:\Program Files\Turbine\Turbine Download Manager\TurbineDownloadManagerIcon.exe File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [TOSCDSPD] File not found
O4 - HKCU..\Run: [wefi] C:\Program Files\WeFi\WeFi.exe (WeFi)
O4 - Startup: C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk = C:\Program Files\ZooskMessenger\ZooskMessenger.exe File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\VetRedir.dll (Computer Associates International, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} [You must be registered and logged in to see this link.] (Checkers Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_06)
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} [You must be registered and logged in to see this link.] (MySpace Uploader Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} [You must be registered and logged in to see this link.] (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_06)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} [You must be registered and logged in to see this link.] (get_atlcom Class)
O16 - DPF: CabBuilder [You must be registered and logged in to see this link.] (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\PFW: DllName - UmxWnp.Dll - C:\Windows\System32\UmxWNP.dll (CA)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\toshiba_1920x1200-3.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\toshiba_1920x1200-3.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{ad86cb4b-a7d6-11df-9cfc-001e33c5be97}\Shell - "" = AutoRun
O33 - MountPoints2\{ad86cb4b-a7d6-11df-9cfc-001e33c5be97}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 11:40 am

part 2

========== Files/Folders - Created Within 30 Days ==========

[2010/08/15 17:01:45 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/08/15 12:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2010/08/15 12:32:31 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2010/08/15 12:32:30 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2010/08/15 12:32:30 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2010/08/15 12:32:02 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2010/08/15 12:32:01 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2010/08/15 12:32:00 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
[2010/08/15 12:32:00 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2010/08/15 12:32:00 | 000,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2010/08/15 12:32:00 | 000,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2010/08/15 12:32:00 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2010/08/15 12:32:00 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2010/08/15 12:32:00 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2010/08/15 12:32:00 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2010/08/15 12:32:00 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2010/08/15 12:32:00 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2010/08/15 12:32:00 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2010/08/15 12:32:00 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2010/08/15 12:32:00 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2010/08/15 12:31:59 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2010/08/15 12:31:59 | 001,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2010/08/15 12:31:59 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2010/08/15 12:31:59 | 000,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2010/08/15 12:31:59 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2010/08/15 12:31:59 | 000,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2010/08/15 12:31:59 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2010/08/15 12:31:59 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2010/08/15 12:31:59 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2010/08/15 12:31:59 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2010/08/15 12:31:21 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2010/08/15 12:31:21 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2010/08/15 12:31:19 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2010/08/15 12:31:15 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2010/08/15 12:31:15 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdMtpUS.dll
[2010/08/15 12:31:15 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdConns.dll
[2010/08/15 12:31:14 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2010/08/15 12:31:14 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2010/08/15 12:31:14 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WpdMtp.dll
[2010/08/15 12:31:14 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2010/08/15 12:31:14 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2010/08/15 12:31:14 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2010/08/15 12:30:12 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2010/08/15 12:30:11 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2010/08/15 12:28:25 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2010/08/15 12:28:18 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010/08/15 02:07:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2010/08/14 23:31:45 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2010/08/14 23:31:45 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2010/08/14 23:31:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2010/08/14 23:12:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2010/08/14 23:08:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Office Genuine Advantage
[2010/08/14 22:58:39 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010/08/14 22:58:38 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010/08/14 22:58:37 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010/08/14 22:58:37 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010/08/14 22:58:36 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010/08/14 22:58:36 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010/08/14 22:58:36 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010/08/14 22:58:36 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010/08/14 22:58:35 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010/08/14 22:58:35 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010/08/14 22:58:35 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010/08/14 22:58:35 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010/08/14 22:58:34 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010/08/14 22:58:34 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010/08/14 22:58:34 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010/08/14 22:57:12 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2010/08/14 22:57:12 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2010/08/14 22:57:11 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2010/08/14 22:57:11 | 000,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2010/08/14 22:57:11 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2010/08/14 22:57:11 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2010/08/14 22:57:11 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll
[2010/08/14 22:57:10 | 000,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2010/08/14 22:57:10 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2010/08/14 22:57:10 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2010/08/14 22:57:10 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2010/08/14 22:57:10 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010/08/14 22:57:09 | 000,208,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe
[2010/08/14 22:57:09 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2010/08/14 22:57:09 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2010/08/14 22:57:09 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2010/08/14 22:57:08 | 000,445,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010/08/14 22:57:08 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2010/08/14 22:57:07 | 003,698,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2010/08/14 22:57:07 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010/08/14 22:57:07 | 000,169,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2010/08/14 22:57:07 | 000,109,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PDMSetup.exe
[2010/08/14 22:57:07 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2010/08/14 22:57:07 | 000,107,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2010/08/14 22:57:07 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetDepNx.exe
[2010/08/14 19:45:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/08/14 19:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/08/14 18:35:15 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010/08/14 18:03:21 | 000,000,000 | ---D | C] -- C:\ProgramData\CA
[2010/08/14 17:38:36 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\Malwarebytes
[2010/08/14 17:38:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/08/14 17:38:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/08/14 17:38:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/14 17:38:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/08/14 17:33:23 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Jason\Desktop\mbam-setup-1.46.exe
[2010/08/14 17:33:20 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Users\Jason\Desktop\spybotsd162.exe
[2010/08/14 16:48:48 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\SafeReturner
[2010/08/14 16:48:43 | 000,000,000 | ---D | C] -- C:\Program Files\Safe Returner
[2010/08/14 16:44:40 | 003,121,552 | ---- | C] (SafeReturner Anti-Malware Studio ) -- C:\Users\Jason\Desktop\safereturner.exe
[2010/08/14 15:29:26 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/08/14 12:15:05 | 000,201,968 | ---- | C] (CA, Inc.) -- C:\Windows\System32\Isafprod.dll
[2010/08/14 12:15:05 | 000,128,240 | ---- | C] (Computer Associates International, Inc.) -- C:\Windows\System32\Isafeif.dll
[2010/08/14 12:15:05 | 000,095,472 | ---- | C] (Computer Associates International, Inc.) -- C:\Windows\System32\Vetredir.dll
[2010/08/14 12:15:05 | 000,000,000 | -H-D | C] -- C:\Config.msi
[2010/08/14 12:14:02 | 000,000,000 | ---D | C] -- C:\Program Files\CA
[2010/08/14 01:50:25 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\vlc
[2010/08/14 00:20:51 | 000,000,000 | ---D | C] -- C:\Users\Jason\Documents\Graboid
[2010/08/14 00:19:17 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Local\Graboid_Inc
[2010/08/14 00:19:12 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\MozillaControl
[2010/08/14 00:19:11 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Local\Graboid
[2010/08/14 00:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla ActiveX Control v1.7.12
[2010/08/14 00:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2010/08/14 00:17:55 | 000,000,000 | ---D | C] -- C:\Program Files\Graboid
[2010/08/13 12:37:17 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Local\fpignxftt
[2010/08/11 16:05:10 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010/08/11 16:02:23 | 002,037,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010/08/11 16:02:21 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010/08/11 16:02:18 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010/08/11 16:02:16 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010/08/02 15:31:41 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Local\Yahoo!
[2010/08/01 13:06:05 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2010/08/01 13:05:59 | 000,000,000 | ---D | C] -- C:\Program Files\ZooskMessenger
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/16 20:33:47 | 002,621,440 | -HS- | M] () -- C:\Users\Jason\NTUSER.DAT
[2010/08/16 20:24:33 | 000,764,178 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/08/16 20:24:33 | 000,646,540 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/08/16 20:24:33 | 000,121,468 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/08/16 20:20:21 | 000,000,294 | ---- | M] () -- C:\Windows\tasks\WefiStartup.job
[2010/08/16 20:20:11 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/16 20:20:00 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/16 20:20:00 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/16 20:19:58 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/16 20:19:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/16 20:19:51 | 2009,067,520 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/16 20:19:07 | 000,004,791 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k0
[2010/08/16 20:19:07 | 000,000,209 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k1
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k7
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k6
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k5
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k4
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k3
[2010/08/16 20:19:07 | 000,000,081 | ---- | M] () -- C:\Windows\System32\drivers\kmxcfg.u2k2
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k7
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k6
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k5
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k4
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k3
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k2
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k1
[2010/08/16 20:19:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\drivers\kmxzone.u2k0
[2010/08/16 20:18:36 | 000,524,288 | -HS- | M] () -- C:\Users\Jason\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/08/16 20:18:36 | 000,065,536 | -HS- | M] () -- C:\Users\Jason\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/08/16 20:18:10 | 003,913,518 | -H-- | M] () -- C:\Users\Jason\AppData\Local\IconCache.db
[2010/08/16 19:54:25 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/16 11:13:27 | 000,000,799 | ---- | M] () -- C:\Users\Jason\Desktop\OTL - Shortcut.lnk
[2010/08/15 17:01:45 | 000,001,845 | ---- | M] () -- C:\Users\Jason\Desktop\HijackThis.lnk
[2010/08/15 12:35:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2010/08/15 12:35:36 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010/08/14 23:36:15 | 000,326,088 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/08/14 23:07:43 | 000,000,914 | ---- | M] () -- C:\Users\Jason\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/14 19:45:42 | 000,001,050 | ---- | M] () -- C:\Users\Jason\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/08/14 19:45:42 | 000,001,026 | ---- | M] () -- C:\Users\Jason\Desktop\Spybot - Search & Destroy.lnk
[2010/08/14 19:32:40 | 225,241,099 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/08/14 17:38:25 | 000,000,829 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/14 17:30:38 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Jason\Desktop\mbam-setup-1.46.exe
[2010/08/14 16:48:45 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\Safe Returner.lnk
[2010/08/14 16:43:37 | 000,000,859 | ---- | M] () -- C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk
[2010/08/14 16:39:52 | 003,121,552 | ---- | M] (SafeReturner Anti-Malware Studio ) -- C:\Users\Jason\Desktop\safereturner.exe
[2010/08/14 16:00:13 | 000,036,864 | ---- | M] () -- C:\Windows\System32\umstartup.etl
[2010/08/14 14:23:17 | 000,001,356 | ---- | M] () -- C:\Users\Jason\AppData\Local\d3d9caps.dat
[2010/08/14 02:32:06 | 000,064,512 | ---- | M] () -- C:\Users\Jason\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/13 17:32:38 | 000,016,031 | ---- | M] () -- C:\Users\Jason\Documents\allies.docx
[2010/08/13 17:14:08 | 000,002,627 | ---- | M] () -- C:\Users\Jason\Desktop\Microsoft Office Word 2007.lnk
[2010/08/12 20:38:41 | 000,001,982 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/08/02 15:31:50 | 000,524,288 | -HS- | M] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TMContainer00000000000000000002.regtrans-ms
[2010/08/02 15:31:50 | 000,524,288 | -HS- | M] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TMContainer00000000000000000001.regtrans-ms
[2010/08/02 15:31:50 | 000,262,144 | ---- | M] () -- C:\ProgramData\ntuser.dat
[2010/08/02 15:31:50 | 000,065,536 | -HS- | M] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TM.blf
[2010/08/02 15:30:50 | 000,000,975 | ---- | M] () -- C:\Users\Jason\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/08/02 15:30:50 | 000,000,951 | ---- | M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/16 11:13:27 | 000,000,799 | ---- | C] () -- C:\Users\Jason\Desktop\OTL - Shortcut.lnk
[2010/08/15 17:01:45 | 000,001,845 | ---- | C] () -- C:\Users\Jason\Desktop\HijackThis.lnk
[2010/08/15 12:35:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2010/08/15 12:35:36 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010/08/14 22:58:35 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2010/08/14 19:45:42 | 000,001,050 | ---- | C] () -- C:\Users\Jason\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/08/14 19:45:42 | 000,001,026 | ---- | C] () -- C:\Users\Jason\Desktop\Spybot - Search & Destroy.lnk
[2010/08/14 19:21:11 | 000,004,791 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k0
[2010/08/14 19:21:11 | 000,000,209 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k1
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k7
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k6
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k5
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k4
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k3
[2010/08/14 19:21:11 | 000,000,081 | ---- | C] () -- C:\Windows\System32\drivers\kmxcfg.u2k2
[2010/08/14 18:34:46 | 225,241,099 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/08/14 18:34:43 | 2009,067,520 | -HS- | C] () -- C:\hiberfil.sys
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k7
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k6
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k5
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k4
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k3
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k2
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k1
[2010/08/14 18:17:28 | 000,000,045 | ---- | C] () -- C:\Windows\System32\drivers\kmxzone.u2k0
[2010/08/14 17:38:25 | 000,000,829 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/14 16:48:45 | 000,000,808 | ---- | C] () -- C:\Users\Public\Desktop\Safe Returner.lnk
[2010/08/13 17:14:32 | 000,016,031 | ---- | C] () -- C:\Users\Jason\Documents\allies.docx
[2010/08/02 15:31:49 | 000,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TMContainer00000000000000000002.regtrans-ms
[2010/08/02 15:31:49 | 000,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TMContainer00000000000000000001.regtrans-ms
[2010/08/02 15:31:49 | 000,262,144 | ---- | C] () -- C:\ProgramData\ntuser.dat
[2010/08/02 15:31:49 | 000,065,536 | -HS- | C] () -- C:\ProgramData\ntuser.dat{61978eed-9e59-11df-8736-001e33c5be97}.TM.blf
[2010/08/02 15:31:49 | 000,005,120 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG1
[2010/08/02 15:31:49 | 000,000,000 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG2
[2010/08/02 15:30:50 | 000,000,975 | ---- | C] () -- C:\Users\Jason\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/08/02 15:30:50 | 000,000,951 | ---- | C] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2010/08/01 13:06:05 | 000,000,859 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk
[2010/02/18 16:50:22 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2010/02/18 16:50:22 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2010/02/18 16:50:22 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2010/02/02 20:02:05 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\IirfY.vbs
[2010/02/02 04:40:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\tRxNDkISECVRd.vbs
[2010/02/02 03:19:08 | 000,870,128 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\mcs.rma
[2010/02/02 03:19:08 | 000,000,004 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\45CC84
[2010/02/01 23:57:57 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\0W9S6.vbs
[2010/02/01 17:30:47 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\qQPyxGAPjIBcbuX.vbs
[2010/02/01 05:06:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\HYdsaD5oDMJwh.vbs
[2010/02/01 01:07:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\9mF0fPz.vbs
[2010/01/31 20:54:55 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\RDO8smxxFzvjCLd.vbs
[2010/01/31 02:26:10 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xwZPPuMx3wWuL.vbs
[2010/01/30 22:16:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\brr0ZlenhK13NTk.vbs
[2010/01/30 01:47:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WPNiA2l.vbs
[2010/01/29 21:42:37 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\pFzRBvV.vbs
[2010/01/29 16:42:40 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\APnDd.vbs
[2010/01/28 04:20:20 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\7v9X5czq3mM9H.vbs
[2010/01/27 14:13:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\zA3ZCEn.vbs
[2010/01/27 03:22:36 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\t9dNHZU.vbs
[2010/01/26 18:11:41 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Mt4It8EDExTES.vbs
[2010/01/26 15:32:02 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\OxqZCUR4LG6uF.vbs
[2010/01/25 21:59:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\4FoYJ87fC4ZuK.vbs
[2010/01/24 00:49:08 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\PONJQmBsEOTqOo6.vbs
[2010/01/23 06:08:17 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\JvXqPnElBI0QE.vbs
[2010/01/23 05:17:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\9gSdB.vbs
[2010/01/22 17:17:45 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WMWj2GlbEwyqIIe.vbs
[2010/01/22 04:57:00 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\cARDFVBpDlvDq.vbs
[2010/01/21 06:44:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\2onVXjYLFUeqCXf.vbs
[2010/01/21 06:44:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\0Olqv.vbs
[2010/01/20 18:43:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\QOtva.vbs
[2010/01/20 18:43:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\atv4Gwoli9qJk.vbs
[2010/01/20 05:35:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\SIBzWe9utQLI0.vbs
[2010/01/20 05:35:19 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\KbN3i.vbs
[2010/01/20 00:23:47 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Cs4URr7BorEti.vbs
[2010/01/20 00:23:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\XtgQN.vbs
[2010/01/19 18:07:17 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\TH1h88628XpQN.vbs
[2010/01/19 18:07:13 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\h4vlvuS.vbs
[2010/01/19 16:08:48 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\VZs5sBh6RXh3SeO.vbs
[2010/01/19 16:08:22 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\1dTQgXo.vbs
[2010/01/19 01:09:06 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\zFmkdgk.vbs
[2010/01/19 01:08:49 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xXDZM.vbs
[2010/01/18 16:08:38 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\gmaQL6SR3txbB.vbs
[2010/01/18 15:09:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\jgXEMiJ.vbs
[2010/01/18 03:00:48 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WAELFHyRghgcR.vbs
[2010/01/18 02:56:53 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\GN86Hdu3c1PwLkh.vbs
[2010/01/18 01:59:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\gMMuFxw.vbs
[2010/01/18 01:59:13 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\JZUjN.vbs
[2010/01/17 00:29:07 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\C9jfdAd.vbs
[2010/01/17 00:29:03 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\2AJg4.vbs
[2010/01/16 16:30:51 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\iAhJwhY.vbs
[2010/01/16 16:30:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\wMLIu7TkMeXZz.vbs
[2010/01/16 03:35:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\EfhS8p6AWf7yp7L.vbs
[2010/01/16 03:34:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\I20iVziRlPSLRIV.vbs
[2010/01/16 02:07:35 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\7kcfrKI.vbs
[2010/01/16 02:07:14 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xEvAuEFNfHRiI.vbs
[2010/01/14 08:01:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\HKZQnByfpPjZ4XJ.vbs
[2010/01/14 08:01:25 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\S0na9V2K0kz6R.vbs
[2010/01/13 19:59:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\s7NKL.vbs
[2010/01/13 04:02:36 | 000,000,093 | ---- | C] () -- C:\Users\Jason\AppData\Local\fusioncache.dat
[2010/01/12 17:31:03 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\reI3d.vbs
[2010/01/12 05:27:49 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\mJdvRu7xijDZX.vbs
[2010/01/11 17:23:06 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\yZS99.vbs
[2010/01/11 17:23:05 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\1CtAIYj.vbs
[2010/01/10 22:56:09 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Qyd1E.vbs
[2010/01/10 22:54:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\hMT6yqSAhlIt4aw.vbs
[2010/01/10 20:14:43 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\714da.vbs
[2010/01/10 20:14:23 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\peSyAQl.vbs
[2009/12/13 21:37:05 | 000,002,035 | -HS- | C] () -- C:\Users\Jason\AppData\Roaming\02000000e68d2b95716P.manifest
[2009/12/13 21:37:05 | 000,001,100 | -HS- | C] () -- C:\Users\Jason\AppData\Roaming\02000000e68d2b95716O.manifest
[2009/12/13 21:37:05 | 000,000,344 | -HS- | C] () -- C:\Users\Jason\AppData\Roaming\02000000e68d2b95716C.manifest
[2009/12/13 21:37:05 | 000,000,011 | -HS- | C] () -- C:\Users\Jason\AppData\Roaming\02000000e68d2b95716S.manifest
[2009/11/29 22:33:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/10/23 02:43:30 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/10/11 04:41:26 | 000,001,356 | ---- | C] () -- C:\Users\Jason\AppData\Local\d3d9caps.dat
[2009/09/23 23:20:34 | 000,064,512 | ---- | C] () -- C:\Users\Jason\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/18 12:12:11 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/26 16:03:43 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2009/08/07 13:17:36 | 000,000,013 | RHS- | C] () -- C:\Windows\System32\drivers\fbd.sys
[2009/08/07 13:17:34 | 000,000,004 | RHS- | C] () -- C:\Windows\System32\drivers\taishop.sys
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/06/09 05:25:37 | 000,131,072 | ---- | C] () -- C:\Windows\System32\EnumDevLib.dll
[2009/06/09 05:18:46 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2009/06/09 05:18:46 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2009/06/09 05:18:46 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2009/06/09 05:18:46 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2008/08/18 14:36:20 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008/08/18 14:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008/08/18 14:07:48 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008/08/18 14:07:48 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008/08/18 14:07:48 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008/08/18 14:07:48 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008/08/18 14:07:48 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008/06/12 21:59:22 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/03/09 12:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 11:42 am

it didn't save a extras file.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Tue 17 Aug 2010, 11:44 am

Hello.

  • Download combofix from here
    Link 1
1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to svchost as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See HERE for how to disable your AV.
  • Double click on svchost.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 1:38 pm

Having trouble with combofix. It seems to be hanging up. I'm gonna try it again.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 2:22 pm

no luck. I did notice that as soon as I click on combofix, the name changes from svchost back to combofix. Is that right?

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Tue 17 Aug 2010, 3:34 pm

No luck with Combofix. Is there anything else I can do?

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Wed 18 Aug 2010, 3:18 am

Hello.

Please run OTL.exe.

  • Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


    :OTL
    [2010/02/02 20:02:05 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\IirfY.vbs
    [2010/02/02 04:40:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\tRxNDkISECVRd.vbs
    [2010/02/02 03:19:08 | 000,870,128 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\mcs.rma
    [2010/02/02 03:19:08 | 000,000,004 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\45CC84
    [2010/02/01 23:57:57 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\0W9S6.vbs
    [2010/02/01 17:30:47 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\qQPyxGAPjIBcbuX.vbs
    [2010/02/01 05:06:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\HYdsaD5oDMJwh.vbs
    [2010/02/01 01:07:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\9mF0fPz.vbs
    [2010/01/31 20:54:55 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\RDO8smxxFzvjCLd.vbs
    [2010/01/31 02:26:10 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xwZPPuMx3wWuL.vbs
    [2010/01/30 22:16:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\brr0ZlenhK13NTk.vbs
    [2010/01/30 01:47:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WPNiA2l.vbs
    [2010/01/29 21:42:37 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\pFzRBvV.vbs
    [2010/01/29 16:42:40 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\APnDd.vbs
    [2010/01/28 04:20:20 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\7v9X5czq3mM9H.vbs
    [2010/01/27 14:13:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\zA3ZCEn.vbs
    [2010/01/27 03:22:36 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\t9dNHZU.vbs
    [2010/01/26 18:11:41 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Mt4It8EDExTES.vbs
    [2010/01/26 15:32:02 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\OxqZCUR4LG6uF.vbs
    [2010/01/25 21:59:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\4FoYJ87fC4ZuK.vbs
    [2010/01/24 00:49:08 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\PONJQmBsEOTqOo6.vbs
    [2010/01/23 06:08:17 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\JvXqPnElBI0QE.vbs
    [2010/01/23 05:17:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\9gSdB.vbs
    [2010/01/22 17:17:45 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WMWj2GlbEwyqIIe.vbs
    [2010/01/22 04:57:00 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\cARDFVBpDlvDq.vbs
    [2010/01/21 06:44:16 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\2onVXjYLFUeqCXf.vbs
    [2010/01/21 06:44:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\0Olqv.vbs
    [2010/01/20 18:43:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\QOtva.vbs
    [2010/01/20 18:43:54 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\atv4Gwoli9qJk.vbs
    [2010/01/20 05:35:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\SIBzWe9utQLI0.vbs
    [2010/01/20 05:35:19 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\KbN3i.vbs
    [2010/01/20 00:23:47 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Cs4URr7BorEti.vbs
    [2010/01/20 00:23:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\XtgQN.vbs
    [2010/01/19 18:07:17 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\TH1h88628XpQN.vbs
    [2010/01/19 18:07:13 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\h4vlvuS.vbs
    [2010/01/19 16:08:48 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\VZs5sBh6RXh3SeO.vbs
    [2010/01/19 16:08:22 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\1dTQgXo.vbs
    [2010/01/19 01:09:06 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\zFmkdgk.vbs
    [2010/01/19 01:08:49 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xXDZM.vbs
    [2010/01/18 16:08:38 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\gmaQL6SR3txbB.vbs
    [2010/01/18 15:09:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\jgXEMiJ.vbs
    [2010/01/18 03:00:48 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\WAELFHyRghgcR.vbs
    [2010/01/18 02:56:53 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\GN86Hdu3c1PwLkh.vbs
    [2010/01/18 01:59:33 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\gMMuFxw.vbs
    [2010/01/18 01:59:13 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\JZUjN.vbs
    [2010/01/17 00:29:07 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\C9jfdAd.vbs
    [2010/01/17 00:29:03 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\2AJg4.vbs
    [2010/01/16 16:30:51 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\iAhJwhY.vbs
    [2010/01/16 16:30:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\wMLIu7TkMeXZz.vbs
    [2010/01/16 03:35:21 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\EfhS8p6AWf7yp7L.vbs
    [2010/01/16 03:34:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\I20iVziRlPSLRIV.vbs
    [2010/01/16 02:07:35 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\7kcfrKI.vbs
    [2010/01/16 02:07:14 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\xEvAuEFNfHRiI.vbs
    [2010/01/14 08:01:50 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\HKZQnByfpPjZ4XJ.vbs
    [2010/01/14 08:01:25 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\S0na9V2K0kz6R.vbs
    [2010/01/13 19:59:15 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\s7NKL.vbs
    [2010/01/13 04:02:36 | 000,000,093 | ---- | C] () -- C:\Users\Jason\AppData\Local\fusioncache.dat
    [2010/01/12 17:31:03 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\reI3d.vbs
    [2010/01/12 05:27:49 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\mJdvRu7xijDZX.vbs
    [2010/01/11 17:23:06 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\yZS99.vbs
    [2010/01/11 17:23:05 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\1CtAIYj.vbs
    [2010/01/10 22:56:09 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\Qyd1E.vbs
    [2010/01/10 22:54:34 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\hMT6yqSAhlIt4aw.vbs
    [2010/01/10 20:14:43 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\714da.vbs
    [2010/01/10 20:14:23 | 000,001,372 | ---- | C] () -- C:\Users\Jason\AppData\Roaming\peSyAQl.vbs


  • Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.

  • Click the red Run Fix button.
  • A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTL.exe
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Wed 18 Aug 2010, 3:55 am

Did you want me to run a scan first before pasting those files into OTL?

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Wed 18 Aug 2010, 4:00 am

Here's the log

========== OTL ==========
C:\Users\Jason\AppData\Roaming\IirfY.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\tRxNDkISECVRd.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\mcs.rma moved successfully.
C:\Users\Jason\AppData\Roaming\45CC84 moved successfully.
C:\Users\Jason\AppData\Roaming\0W9S6.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\qQPyxGAPjIBcbuX.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\HYdsaD5oDMJwh.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\9mF0fPz.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\RDO8smxxFzvjCLd.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\xwZPPuMx3wWuL.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\brr0ZlenhK13NTk.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\WPNiA2l.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\pFzRBvV.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\APnDd.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\7v9X5czq3mM9H.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\zA3ZCEn.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\t9dNHZU.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\Mt4It8EDExTES.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\OxqZCUR4LG6uF.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\4FoYJ87fC4ZuK.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\PONJQmBsEOTqOo6.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\JvXqPnElBI0QE.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\9gSdB.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\WMWj2GlbEwyqIIe.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\cARDFVBpDlvDq.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\2onVXjYLFUeqCXf.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\0Olqv.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\QOtva.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\atv4Gwoli9qJk.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\SIBzWe9utQLI0.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\KbN3i.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\Cs4URr7BorEti.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\XtgQN.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\TH1h88628XpQN.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\h4vlvuS.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\VZs5sBh6RXh3SeO.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\1dTQgXo.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\zFmkdgk.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\xXDZM.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\gmaQL6SR3txbB.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\jgXEMiJ.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\WAELFHyRghgcR.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\GN86Hdu3c1PwLkh.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\gMMuFxw.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\JZUjN.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\C9jfdAd.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\2AJg4.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\iAhJwhY.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\wMLIu7TkMeXZz.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\EfhS8p6AWf7yp7L.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\I20iVziRlPSLRIV.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\7kcfrKI.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\xEvAuEFNfHRiI.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\HKZQnByfpPjZ4XJ.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\S0na9V2K0kz6R.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\s7NKL.vbs moved successfully.
C:\Users\Jason\AppData\Local\fusioncache.dat moved successfully.
C:\Users\Jason\AppData\Roaming\reI3d.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\mJdvRu7xijDZX.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\yZS99.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\1CtAIYj.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\Qyd1E.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\hMT6yqSAhlIt4aw.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\714da.vbs moved successfully.
C:\Users\Jason\AppData\Roaming\peSyAQl.vbs moved successfully.

OTL by OldTimer - Version 3.2.10.0 log created on 08172010_125924

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Wed 18 Aug 2010, 11:46 am

Can you run Combofix now?


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Wed 18 Aug 2010, 12:44 pm

I'll try it now.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Wed 18 Aug 2010, 1:40 pm

it's still hanging up.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Belahzur on Thu 19 Aug 2010, 8:49 am

Hello.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any
"<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Thu 19 Aug 2010, 10:46 am

Ran GMER twice and all I got was this.

GMER 1.0.15.15281 - [You must be registered and logged in to see this link.]
Rootkit scan 2010-08-18 19:41:40
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Jason\AppData\Local\Temp\pwlcypoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x88550480, 0x3C939, 0xE8000020]
.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x88591900, 0x3CA, 0x48000040]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Thu 19 Aug 2010, 11:52 am

Ran it again. Here's the new log

GMER 1.0.15.15281 - [You must be registered and logged in to see this link.]
Rootkit scan 2010-08-18 20:51:18
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Jason\AppData\Local\Temp\pwlcypoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x8855C480, 0x3C939, 0xE8000020]
.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8859D900, 0x3CA, 0x48000040]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Pando Networks\Media Booster\PMB.exe[4716] kernel32.dll!SetUnhandledExceptionFilter 7645A84F 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Sneakyone on Fri 20 Aug 2010, 2:16 pm

Hi.

Could you please go into Safe Mode with Networking and run this:

To get into Safe Mode with Networking please restart your computer and rapidly tap F8 until it asks what mode you want to boot into, please choose Safe Mode with Networking, then download and run the following:

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  • Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console


Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.


I'm livin' life in the fast lane.


Sneakyone

Tech Officer
Tech Officer

Posts : 2707
Joined : 2010-01-10
Operating System : Windows 7 Ultimate 64-bit

View user profile http://twitter.com/AVerySneakyone

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Fri 20 Aug 2010, 10:53 pm

I'll do it tonight after work. Thanks for the help.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Sneakyone on Sat 21 Aug 2010, 2:34 pm

Hi.

Alrighty, I await your logs.


I'm livin' life in the fast lane.


Sneakyone

Tech Officer
Tech Officer

Posts : 2707
Joined : 2010-01-10
Operating System : Windows 7 Ultimate 64-bit

View user profile http://twitter.com/AVerySneakyone

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Groundhog9 on Sun 22 Aug 2010, 4:08 am

Ok, while Combofix was running, a mesage popped up about PEV.exe file being corupt. I didn't do anything about it. Combofix continued running and after completing stage 2 the computer shut down. Gonna try it again.

Groundhog9

Newbie Surfer
Newbie Surfer

Posts : 35
Joined : 2010-08-17
Operating System : Windows Vista

View user profile

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Sneakyone on Sun 22 Aug 2010, 4:35 am

Hi.

Did you run it in Safe Mode?


I'm livin' life in the fast lane.


Sneakyone

Tech Officer
Tech Officer

Posts : 2707
Joined : 2010-01-10
Operating System : Windows 7 Ultimate 64-bit

View user profile http://twitter.com/AVerySneakyone

Back to top Go down

Re: Need help with Win32/Nuqel.E virus

Post by Sponsored content Today at 11:05 am


Sponsored content


Back to top Go down

Page 1 of 3 1, 2, 3  Next

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum