Alureon.A/Generic Host Process

Question

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:42 PM, on 5/6/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\Common Files\AOL\1170205204\ee\AOLSoftware.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1170205204\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [WinCalendar] "C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe" /q /c
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [WinCalendar] "C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe /q /c"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [WinCalendar] "C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe" /q /c (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [WinCalendar] "C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe" /q /c (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c9b0d82a16fc46) (gupdate1c9b0d82a16fc46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

--
End of file - 12205 bytes

On internet live webcast last nite when "Generic Host Process for win32" popped up I clicked send rpt & finished webcast. This am had trouble getting on, slower and seemed to lock up. Then I ran a scan thru Microsoft essentials and it posted removal of Trojan:DOS/Alureon.A Items:rootkit:AlureonMbr

Still had trouble (ie referral over to advertisements this evening and locked up trouble getting out of programs) so I searched web for how to remove Alureon and did faree TDSSKiller thru Kaspersky.

Anyway to verify that this is actually gone? I apologize in advance for not being tech savvy - Thanks much for any suggestions.

grsamf · Answer

gahixon1, an Advanced Trainee in SpywareHammer Academy, will assist you with your problem.  Please be patient while he determines the proper steps to take.

gahixon1 · Answer

Hello Cromarlee,

My name is George and I will be assisting you with your problem.

Please follow all my instructions carefully in the order that I give them.

Do not install any updates until I tell you to do so. Updating an infected computer can have disastrous effects.

Do not attempt any other fixes than what I give you here. Using other tools might interfere with the cleaning process. It may also damage your computer.

Either print or save to Notepad all the instructions that I give you. If there is anything you are unsure of or any instructions you feel lack clarity, please do not hesitate to ask.

Some of the logs I may ask for are very long and complex. As is analysing these logs. My responses to you may take longer than you would expect. I assure you that I will work through your problem and a solution as quick as I can.

I am currently an advanced trainee in Malware removal at SpywareHammer Academy. My posts have to be approved by a Mentor before posting, so my responses may take longer than expected; all I ask is that you please be patient.

Did you run TDSSKiller? If so can you please post the latest log for that as well. The location of which will be on your C:\ Drive and will be named. TDSSKiller followed by the date that you run the tool last.

Step 1
ATF Cleaner
Please download ATF Cleaner by Atribune.

This program is for Windows 98/ME/2K/XP and Vista

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu.

Step 2
Run Malwarebytes

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet.

Double-click on mbam-setup.exe to install the application.

When the installation begins, follow the prompts and do not make any changes to default settings.

When installation has finished, make sure you leave both of these checked:

Update Malwarebytes' Anti-Malware

Launch Malwarebytes' Anti-Malware

Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.

If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

Make sure the "Perform Quick Scan" option is selected.

Then click on the Scan button.

If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

Click on the Show Results button to see a list of any malware that was found.

Make sure that everything is checked, and click Remove Selected.

When removal is completed, a log report will open in Notepad.

The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Step 3
OTL

Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

When the window appears, underneath Output at the top change it to Minimal Output.

Check the boxes beside LOP Check and Purity Check.

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

In your next reply can I have:
OTL.txt
Extras.txt
The MBAM log and any issues you may have had.
TDSS Killer.txt

cromarlee · Answer

Hi George!  Thanks for your assistance - truly appreciate your help. Here's the logs you requested: 1. OTL.txt OTL logfile created on: 5/7/2011 7:48:49 PM - Run 4OTL by OldTimer - Version 3.2.22.3     Folder = C:\Documents and Settings\Marilee\DesktopWindows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1,014.00 Mb Total Physical Memory | 485.00 Mb Available Physical Memory | 48.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File freePaging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 52.71 Gb Total Space | 29.66 Gb Free Space | 56.27% Space Free | Partition Type: NTFSDrive D: | 17.96 Gb Total Space | 17.47 Gb Free Space | 97.27% Space Free | Partition Type: NTFS Computer Name: D8H9F3B1 | User Name: Marilee | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Marilee\Desktop\OTL.exe (OldTimer Tools)PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)PRC - C:\Program Files\Common Files\Real\Update_OBealsched.exe (RealNetworks, Inc.)PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe (Sapro Systems)PRC - C:\WINDOWS\system32\acs.exe (Atheros)PRC - C:\Program Files\Common Files\AOL\1170205204\ee\aolsoftware.exe (AOL LLC)PRC - C:\Program Files\AOL 9.1\waol.exe (AOL, LLC.)PRC - C:\Program Files\AOL 9.1\shellmon.exe (AOL, LLC.)PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)PRC - C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Development Company, L.P.)PRC - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe (Linksys)PRC - C:\WINDOWS\system32\dlcccoms.exe ( )PRC - C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe (Dell)PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)PRC - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe (GEMTEKS)PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)  ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\Marilee\Desktop\OTL.exe (OldTimer Tools)MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)MOD - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hookpchromebrowserrecordhelper.dll ()  ========== Win32 Services (SafeList) ========== SRV - (WUSB54GCSVC) --  File not foundSRV - (McAfee SiteAdvisor Service) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)SRV - (getPlus(R) Helper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (NOS Microsystems Ltd.)SRV - (ACS) -- C:\WINDOWS\system32\acs.exe (Atheros)SRV - (jswpsapi) -- C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe (Atheros Communications, Inc.)SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)SRV - (DSBrokerService) -- C:\Program Files\DellSupport\brkrsvc.exe ()SRV - (AOL ACS) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)SRV - (dlcc_device) -- C:\WINDOWS\System32\dlcccoms.exe ( )SRV - (WANMiniportService) WAN Miniport (ATW) -- C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)  ========== Driver Services (SafeList) ========== DRV - (MpKslcb498e05) -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A343FE86-04A1-4B1D-8366-0EC2556DD766}\MpKslcb498e05.sys (Microsoft Corporation)DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))DRV - (JSWSCIMD) -- C:\WINDOWS\system32\drivers\jswscimd.sys (Atheros Communications, Inc.)DRV - (WN111v2) -- C:\WINDOWS\system32\drivers\WN111v2.sys (Atheros Communications, Inc.)DRV - (WSIMD) -- C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)DRV - (dsunidrv) -- C:\WINDOWS\system32\drivers\dsunidrv.sys (Gteko Ltd.)DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction	riggers\DSproct.sys (Gteko Ltd.)DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)DRV - (RT73) -- C:\WINDOWS\system32\driverst73.sys (Ralink Technology, Corp.)DRV - (DLAUDFAM) -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions)DRV - (DLAUDF_M) -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions)DRV - (DLAIFS_M) -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions)DRV - (DLABOIOM) -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions)DRV - (DLAOPIOM) -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions)DRV - (DLAPoolM) -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions)DRV - (DLADResN) -- C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions)DRV - (DLACDBHM) -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions)DRV - (DLARTL_N) -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions)DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)DRV - (DNINDIS5) -- C:\WINDOWS\system32\DNINDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)  ========== Standard Registry (SafeList) ==========  ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell-inc&channel=usIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = GoogleIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieIE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not foundIE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: 'ProxyEnable' = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: 'ProxyOverride' = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: 'AOL Search'FF - prefs.js..browser.startup.homepage: 'http://www.aol.com'FF - prefs.js..keyword.URL: 'http://aolsearch.aol.com/aol/search?invocationType=client_searchbox&query=' FF - HKLM\software\mozilla\Firefox\Extensions\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/08/14 18:32:14 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\Extensions\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/05/05 20:15:06 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 2.0\extensions\Components: C:\Program Files\Mozilla Firefox\components [2011/03/24 07:12:47 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 2.0\extensions\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/01 13:04:41 | 000,000,000 | ---D | M] [2010/02/05 07:33:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Marilee\Application Data\Mozilla\Firefox\Profiles\xbwizt3x.default\extensions[2010/02/05 07:33:48 | 000,000,000 | ---D | M] (ShopAtHome Intelligent Shopping Toolbar) -- C:\Documents and Settings\Marilee\Application Data\Mozilla\Firefox\Profiles\xbwizt3x.default\extensions	oolbar@shopathome.com[2009/07/10 18:26:08 | 000,002,257 | ---- | M] () -- C:\Documents and Settings\Marilee\Application Data\Mozilla\Firefox\Profiles\xbwizt3x.default\searchplugins\askcom.xml[2010/02/12 22:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions[2008/05/19 09:20:46 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}[2008/05/19 09:20:36 | 000,000,000 | ---D | M] (Real Networks Settings) -- C:\Program Files\Mozilla Firefox\extensionseal-networks@partners.mozilla.com[2008/05/19 09:20:39 | 000,000,000 | ---D | M] (Talkback) -- C:\Program Files\Mozilla Firefox\extensions	alkback@mozilla.org[2010/02/12 22:52:03 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF[2011/05/05 20:15:06 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISORFile not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}File not found (No name found) -- C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD[2006/10/11 01:04:58 | 000,061,036 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll[2006/10/11 01:04:59 | 000,048,742 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll[2006/10/11 01:05:03 | 000,029,313 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll[2006/10/11 01:05:03 | 000,041,082 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll[2006/10/11 01:04:58 | 000,166,510 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll[2009/11/19 15:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins
pCouponPrinter.dll[2009/11/19 15:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins
pMozCouponPrinter.dll[2008/06/02 22:35:57 | 000,002,275 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\aolsearch.xml[2009/12/06 16:01:29 | 000,002,204 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml Hosts file not foundO2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IEpbrowserrecordplugin.dll (RealPlayer)O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll (Dell Inc.)O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)O4 - HKLM..\Run: []  File not foundO4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (AOL LLC)O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)O4 - HKLM..\Run: [DLCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.DLL ()O4 - HKLM..\Run: [dlccmon.exe] C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe (Dell)O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1170205204\ee\aolsoftware.exe (AOL LLC)O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OBealsched.exe (RealNetworks, Inc.)O4 - HKLM..\Run: [WinCalendar] C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe (Sapro Systems)O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL 9.1\AOL.EXE (AOL, LLC.)O4 - HKCU..\Run: [DW6]  File not foundO4 - HKCU..\Run: [WinCalendar] C:\Program Files\Sapro Systems WinCalendar\WinCalendar_SysTray.exe (Sapro Systems)O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Toolbar 5.0esources\en-us\local\search.html ()O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)O15 - HKCU\..Trusted Domains: $talisma_url$ ([]https in Trusted sites)O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.)O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab (Windows Live Safety Center Base Module)O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.7.254O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: GinaDLL - (GTGina.dll) - C:\WINDOWS\System32\GTGina.dll (Gemtek)O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2004/08/11 15:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) -  File not foundO35 - HKLM\..comfile [open] -- '%1' %*O35 - HKLM\..exefile [open] -- '%1' %*O37 - HKLM\...com [@ = ComFile] -- '%1' %*O37 - HKLM\...exe [@ = exefile] -- '%1' %* ========== Files/Folders - Created Within 30 Days ========== [2011/05/07 19:46:41 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marilee\Desktop\OTL.exe[2011/05/07 19:24:38 | 007,734,240 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Marilee\Desktop\mbam-setup.exe[2011/05/07 18:55:56 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Documents and Settings\Marilee\Desktop\ATF-Cleaner.exe[2011/05/06 19:09:39 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marilee\Desktop\AFR.com.exe[2011/05/01 19:40:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Marilee\Application Data\Yahoo![2006/06/05 21:43:48 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccserv.dll[2006/06/05 21:43:48 | 001,134,592 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccusb1.dll[2006/06/05 21:43:48 | 000,774,144 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcchbn3.dll[2006/06/05 21:43:48 | 000,704,512 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcccomc.dll[2006/06/05 21:43:48 | 000,638,976 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccpmui.dll[2006/06/05 21:43:48 | 000,491,520 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcccoms.exe[2006/06/05 21:43:48 | 000,483,328 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcclmpm.dll[2006/06/05 21:43:48 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcccomm.dll[2006/06/05 21:43:48 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccih.exe[2006/06/05 21:43:48 | 000,368,640 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcccfg.exe[2006/06/05 21:43:48 | 000,155,648 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccprox.dll[2006/06/05 21:43:48 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccpplc.dll[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/05/07 19:47:41 | 000,000,282 | ---- | M] () -- C:\WINDOWS	asks\RealUpgradeLogonTaskS-1-5-21-1414772580-2399975996-4079928975-1006.job[2011/05/07 19:47:40 | 000,000,290 | ---- | M] () -- C:\WINDOWS	asks\RealUpgradeScheduledTaskS-1-5-21-1414772580-2399975996-4079928975-1006.job[2011/05/07 19:47:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job[2011/05/07 19:46:44 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marilee\Desktop\OTL.exe[2011/05/07 19:36:57 | 000,000,426 | -H-- | M] () -- C:\WINDOWS	asks\User_Feed_Synchronization-{18353370-7C28-4CA7-BE97-6FD31F961206}.job[2011/05/07 19:28:14 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\Marilee\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2011/05/07 19:28:14 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2011/05/07 19:24:38 | 007,734,240 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Marilee\Desktop\mbam-setup.exe[2011/05/07 18:55:14 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Marilee\Desktop\ATF-Cleaner.exe[2011/05/07 17:27:17 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Marilee\Desktop\Microsoft Office Word 2003.lnk[2011/05/07 07:47:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job[2011/05/06 19:42:17 | 000,000,424 | -H-- | M] () -- C:\WINDOWS	asks\MP Scheduled Scan.job[2011/05/06 19:36:30 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2011/05/06 19:35:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2011/05/06 19:35:23 | 1063,407,616 | -HS- | M] () -- C:\hiberfil.sys[2011/05/06 19:34:24 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat[2011/05/06 19:03:30 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Marilee\Desktop\AFR.com.exe[2011/05/06 17:26:46 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\Marilee\Desktop\Microsoft Office Excel 2003.lnk[2011/04/15 03:32:07 | 000,298,048 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2011/04/15 03:14:38 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK[2011/04/15 03:11:11 | 000,494,012 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2011/04/15 03:11:11 | 000,093,076 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/05/07 19:28:14 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\Marilee\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk[2011/05/07 19:28:14 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2011/04/26 07:42:41 | 000,000,886 | ---- | C] () -- C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job[2011/04/26 07:42:40 | 000,000,882 | ---- | C] () -- C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job[2010/08/22 19:43:38 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Epefetubetog.dat[2010/08/22 19:43:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Vlatocay.bin[2010/08/06 13:04:37 | 000,000,838 | ---- | C] () -- C:\Documents and Settings\Marilee\Local Settings\Application Data\FASTWiz.html[2010/02/14 14:07:30 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe[2010/02/14 14:07:30 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe[2010/02/14 14:07:30 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe[2010/02/14 14:07:30 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe[2010/02/14 14:07:30 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe[2010/02/12 16:49:39 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat[2009/10/09 15:40:34 | 000,000,221 | ---- | C] () -- C:\WINDOWS\NCLogConfig.ini[2009/08/18 15:59:22 | 000,068,556 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe[2008/06/27 17:18:04 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll[2007/11/01 20:58:14 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache[2007/08/01 20:19:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PowerReg.dat[2007/08/01 20:05:24 | 000,000,350 | ---- | C] () -- C:\WINDOWS\ereg077.dat[2007/04/15 14:01:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI[2007/03/29 10:37:31 | 000,109,169 | ---- | C] () -- C:\WINDOWS\hpoins08.dat[2007/03/29 10:37:31 | 000,007,577 | ---- | C] () -- C:\WINDOWS\hpomdl08.dat[2007/03/29 10:06:02 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll[2006/09/29 13:36:24 | 000,000,030 | ---- | C] () -- C:\WINDOWS\Mavis12.INI[2006/09/29 13:12:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI[2006/09/28 20:03:48 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\Marilee\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2006/08/15 19:00:14 | 000,003,766 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys[2006/08/15 19:00:14 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\33776E7E6F.sys[2006/08/02 22:07:45 | 000,004,600 | ---- | C] () -- C:\WINDOWS\cdplayer.ini[2006/06/25 11:13:30 | 000,000,307 | ---- | C] () -- C:\WINDOWS\disney.ini[2006/06/25 11:13:23 | 000,000,206 | ---- | C] () -- C:\WINDOWS\disneysy.ini[2006/06/25 11:02:46 | 000,000,099 | ---- | C] () -- C:\WINDOWS\DMI.INI[2006/06/14 18:48:58 | 000,000,031 | ---- | C] () -- C:\WINDOWS\KA.INI[2006/06/10 21:55:20 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\instlsp.exe[2006/06/10 18:17:41 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll[2006/06/10 18:17:41 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32t73.bin[2006/06/10 18:17:39 | 000,002,048 | ---- | C] () -- C:\WINDOWS\System32\driverst73.bin[2006/06/10 18:17:22 | 000,001,361 | ---- | C] () -- C:\WINDOWS\System32\WLAN.INI[2006/06/10 18:15:48 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Marilee\Local Settings\Application Data\fusioncache.dat[2006/06/05 22:26:17 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2006/06/05 22:19:56 | 000,000,181 | ---- | C] () -- C:\WINDOWS\wininit.ini[2006/06/05 22:16:04 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE[2006/06/05 22:13:33 | 000,712,704 | ---- | C] () -- C:\WINDOWS\System32\DellSystemRestore.dll[2006/06/05 22:09:35 | 000,000,335 | ---- | C] () -- C:\WINDOWS
sreg.dat[2006/06/05 22:07:22 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2006/06/05 21:43:48 | 000,430,080 | ---- | C] () -- C:\WINDOWS\System32\dlccutil.dll[2006/06/05 21:43:48 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\dlccinsb.dll[2006/06/05 21:43:48 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\dlccins.dll[2006/06/05 21:43:48 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\dlccjswr.dll[2006/06/05 21:43:48 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlccinsr.dll[2006/06/05 21:43:48 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcccub.dll[2006/06/05 21:43:48 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcccu.dll[2006/06/05 21:43:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlccvs.dll[2006/06/05 21:43:48 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcccur.dll[2006/06/05 21:43:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\dlcccfg.dll[2006/06/05 21:43:24 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe[2006/06/05 21:43:06 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI[2005/11/10 06:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini[2005/08/02 12:00:16 | 000,000,611 | ---- | C] () -- C:\WINDOWS\System32\dlccplc.ini[2004/08/11 15:24:19 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini[2004/08/11 15:19:30 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat[2004/08/11 15:12:14 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat[2004/08/11 15:11:31 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini[2004/08/11 15:07:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI[2004/08/11 15:06:43 | 000,298,048 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2004/08/11 15:00:30 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat[2004/08/11 15:00:28 | 000,494,012 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat[2004/08/11 15:00:28 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat[2004/08/11 15:00:28 | 000,093,076 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat[2004/08/11 15:00:28 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat[2004/08/11 15:00:27 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat[2004/08/11 15:00:26 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin[2004/08/11 15:00:24 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32
oise.dat[2004/08/11 15:00:19 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat[2004/08/11 15:00:19 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin[2004/08/11 15:00:12 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat[2004/08/11 15:00:04 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin[2004/04/18 17:43:46 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll[2004/04/18 17:43:44 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI[2001/07/06 16:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini ========== LOP Check ========== [2006/06/11 07:53:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Individual Software[2009/11/04 13:05:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NETGEAR[2006/09/28 20:26:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems[2010/02/12 21:51:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint[2010/05/01 20:04:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}[2009/09/11 19:06:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2009/07/18 12:24:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}[2008/12/04 17:25:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\EA[2006/06/11 06:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\Individual Software[2006/06/25 11:15:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\Leadertech[2011/01/07 09:02:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\MSNInstaller[2006/09/28 20:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\Ulead Systems[2007/01/17 19:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Marilee\Application Data\Viewpoint[2011/05/06 19:42:17 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job[2011/05/07 19:36:57 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{18353370-7C28-4CA7-BE97-6FD31F961206}.job ========== Purity Check ==========  2. Extras.txt : Log did not popup in notepad - could not find the log on the c drive 3. MBAM log: on downloading popup box with 'error code: 707 (2,0) clicked okay and everything to proceeding like you said with no other issues. Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.org Database version: 6529 Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.18702 5/7/2011 7:38:50 PMmbam-log-2011-05-07 (19-38-50).txt Scan type: Quick scanObjects scanned: 171248Time elapsed: 9 minute(s), 9 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:(No malicious items detected) < End of report > 4. TDSS Killer.txt: not sure if this is what you're looking for. I did run TDSS but this is the only thing I found in the way of a report. 2011/05/07 20:23:45.0640 4416 TDSS rootkit removing tool 2.5.0.0 May  1 2011 14:20:162011/05/07 20:23:46.0187 4416 ================================================================================2011/05/07 20:23:46.0187 4416 SystemInfo:2011/05/07 20:23:46.0187 4416 2011/05/07 20:23:46.0187 4416 OS Version: 5.1.2600 ServicePack: 3.02011/05/07 20:23:46.0187 4416 Product type: Workstation2011/05/07 20:23:46.0187 4416 ComputerName: D8H9F3B12011/05/07 20:23:46.0187 4416 UserName: Marilee2011/05/07 20:23:46.0187 4416 Windows directory: C:\WINDOWS2011/05/07 20:23:46.0187 4416 System windows directory: C:\WINDOWS2011/05/07 20:23:46.0187 4416 Processor architecture: Intel x862011/05/07 20:23:46.0187 4416 Number of processors: 22011/05/07 20:23:46.0187 4416 Page size: 0x10002011/05/07 20:23:46.0187 4416 Boot type: Normal boot2011/05/07 20:23:46.0187 4416 ================================================================================2011/05/07 20:23:46.0859 4416 Initialize success2011/05/07 20:23:57.0062 6092 Deinitialize success

gahixon1 · Answer

Hi cromarlee,

Can I ask what problems are still on your computer, the more detailed the quicker I will be able to grasp the situation on your computer.

The TDSSKiller report that you posted was incomplete. Is that all there is in the text document named TDSSKiller.txt. Can you see if there are any more text files on the C:\ Drive, beginning with TDSSKiller, if so can you post them all.

From your logs it is evident that you have run some speciality tools. Can I ask why? One of the tools that I see evident in your logs is Combofix. Combofix is a very advanced tool that should not be used without someone trained in it's use. Combofix is a very powerful tool and can turn your computer into an oversized paperweight if not used correctly.

If you have used combofix, I'd like to see the logfile from that which will be located on the C:\ Drive and named combofix.txt.

Can you also please run TDSSKiller. It has recently been updated to deal with a new variant of a nasty infection.

Step 1
TDSSKiller

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.

Extract its contents to your desktop.

Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

It may ask you to reboot the computer to complete the process. Click on Reboot Now.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.

If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

I would also like you to run this tool.

Step 2
aswMBR

Please double click the tool to open it (Windows Vista/7 please right click and "Run as Administrator")

Referring to the image below. please click the SCAN button and allow the scan to run to completion

Once the scan has Completed, please click the Save Log button and save the log to the desktop

Saved to the desktop will be a text file named aswMBR.txt, please copy/paste the contents of the text file back for review in your next reply

There will also be a file named MBR.dat saved to the desktop.
To do this you will have to create a .zip file. Please see here for instructions on how to do this. Zip Guide
Once you have zipped the MBR.dat, please Attach that file to your next reply.

Please DO NOT copy/paste the contents of the .dat file as it will become unreadable

In your next reply can I have:
TDSSKiller.txt
the previous TDSSKiller log
Combofix.txt (If you have run it)
aswMBR.txt
The answer to my initial questions
Any problems you may have had.

cromarlee · Answer

George, Hi! In answering your questions my initial problem was the popup error msg of Generic Host Process Win32 and that I started to get the inappropriate advertisement referrals. I ran Microsoft Essentials and it came up with the Alureon A and said it deleted it...I was still having problems with advertisements/programs locking up so thats when I went to TDSS it said it removed it.  I'm still having some advertisements pop up (only a few) and it seems to be running slow so I'm not sure if Alureon has really been removed, or if I have something else; but I can't say that I've noticed anything else going on but I've tried to stay off the internet until I'm sure the system is ok.  I was using McAfee but let it expired because it didn't seem like it was scanning/removing anything and have been relying mainly on Microsoft Essentials.  Don't know how I keep picking up Alureon but any suggestions that might help prevent it in the future would be appreciated - I know it's an old system but I've been out of work and only recently started a part-time job but it comes with very few hours so I simply can't afford to purchase a new computer system at this time. The Combofix has not been run recently - A little over a year ago I had a problem (several things but I can't remember what they were but think one of them was Alureon.H?) and Combofix was one of the programs you folks at Dell had me go through.) I wasn't aware that I even had it still on the computer. Any way - since I had such a hard time a year ago getting rid of the spyware/malware I'm a little leary that it's actually been removed so easly this time with just running the TDSS.  Enclosed is the initial TDSS (05.06.11) and the version from today (05.09.11): 2011/05/06 19:28:49.0500 0508 TDSS rootkit removing tool 2.5.0.0 May  1 2011 14:20:162011/05/06 19:28:50.0062 0508 ================================================================================2011/05/06 19:28:50.0062 0508 SystemInfo:2011/05/06 19:28:50.0062 0508 2011/05/06 19:28:50.0062 0508 OS Version: 5.1.2600 ServicePack: 3.02011/05/06 19:28:50.0062 0508 Product type: Workstation2011/05/06 19:28:50.0062 0508 ComputerName: D8H9F3B12011/05/06 19:28:50.0062 0508 UserName: Marilee2011/05/06 19:28:50.0062 0508 Windows directory: C:\WINDOWS2011/05/06 19:28:50.0062 0508 System windows directory: C:\WINDOWS2011/05/06 19:28:50.0062 0508 Processor architecture: Intel x862011/05/06 19:28:50.0062 0508 Number of processors: 22011/05/06 19:28:50.0062 0508 Page size: 0x10002011/05/06 19:28:50.0062 0508 Boot type: Normal boot2011/05/06 19:28:50.0062 0508 ================================================================================2011/05/06 19:28:51.0187 0508 Initialize success2011/05/06 19:30:17.0000 2700 ================================================================================2011/05/06 19:30:17.0000 2700 Scan started2011/05/06 19:30:17.0000 2700 Mode: Manual; 2011/05/06 19:30:17.0000 2700 ================================================================================2011/05/06 19:30:17.0375 2700 abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS2011/05/06 19:30:17.0437 2700 ACPI            (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys2011/05/06 19:30:17.0500 2700 ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys2011/05/06 19:30:17.0546 2700 adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys2011/05/06 19:30:17.0718 2700 aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys2011/05/06 19:30:17.0796 2700 AegisP          (2f7f3e8da380325866e566f5d5ec23d5) C:\WINDOWS\system32\DRIVERS\AegisP.sys2011/05/06 19:30:17.0906 2700 AFD             (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys2011/05/06 19:30:17.0984 2700 agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys2011/05/06 19:30:18.0109 2700 agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys2011/05/06 19:30:18.0171 2700 Aha154x         (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys2011/05/06 19:30:18.0203 2700 aic78u2         (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys2011/05/06 19:30:18.0234 2700 aic78xx         (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys2011/05/06 19:30:18.0281 2700 AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys2011/05/06 19:30:18.0296 2700 alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys2011/05/06 19:30:18.0312 2700 amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys2011/05/06 19:30:18.0343 2700 amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys2011/05/06 19:30:18.0375 2700 asc             (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys2011/05/06 19:30:18.0390 2700 asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys2011/05/06 19:30:18.0406 2700 asc3550         (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys2011/05/06 19:30:18.0484 2700 AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys2011/05/06 19:30:18.0515 2700 atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys2011/05/06 19:30:18.0546 2700 Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys2011/05/06 19:30:18.0609 2700 audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys2011/05/06 19:30:18.0640 2700 Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys2011/05/06 19:30:18.0890 2700 cbidf           (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys2011/05/06 19:30:18.0906 2700 cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys2011/05/06 19:30:18.0937 2700 CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys2011/05/06 19:30:18.0968 2700 cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys2011/05/06 19:30:18.0984 2700 Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys2011/05/06 19:30:19.0015 2700 Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys2011/05/06 19:30:19.0046 2700 Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys2011/05/06 19:30:19.0109 2700 CmdIde          (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys2011/05/06 19:30:19.0140 2700 Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys2011/05/06 19:30:19.0171 2700 dac2w2k         (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys2011/05/06 19:30:19.0312 2700 dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys2011/05/06 19:30:19.0343 2700 Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys2011/05/06 19:30:19.0390 2700 DLABOIOM        (e2d0de31442390c35e3163c87cb6a9eb) C:\WINDOWS\system32\DLA\DLABOIOM.SYS2011/05/06 19:30:19.0421 2700 DLACDBHM        (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS2011/05/06 19:30:19.0515 2700 DLADResN        (83545593e297f50a8e2524b4c071a153) C:\WINDOWS\system32\DLA\DLADResN.SYS2011/05/06 19:30:19.0531 2700 DLAIFS_M        (96e01d901cdc98c7817155cc057001bf) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS2011/05/06 19:30:19.0578 2700 DLAOPIOM        (0a60a39cc5e767980a31ca5d7238dfa9) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS2011/05/06 19:30:19.0609 2700 DLAPoolM        (9fe2b72558fc808357f427fd83314375) C:\WINDOWS\system32\DLA\DLAPoolM.SYS2011/05/06 19:30:19.0671 2700 DLARTL_N        (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS2011/05/06 19:30:19.0781 2700 DLAUDFAM        (f08e1dafac457893399e03430a6a1397) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS2011/05/06 19:30:19.0812 2700 DLAUDF_M        (e7d105ed1e694449d444a9933df8e060) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS2011/05/06 19:30:19.0968 2700 dmboot          (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys2011/05/06 19:30:20.0015 2700 dmio            (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys2011/05/06 19:30:20.0046 2700 dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys2011/05/06 19:30:20.0109 2700 DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys2011/05/06 19:30:20.0187 2700 DNINDIS5        (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS2011/05/06 19:30:20.0375 2700 dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys2011/05/06 19:30:20.0421 2700 drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys2011/05/06 19:30:20.0484 2700 DRVMCDB         (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS2011/05/06 19:30:20.0546 2700 DRVNDDM         (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS2011/05/06 19:30:21.0062 2700 DSproct         (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction	riggers\DSproct.sys2011/05/06 19:30:21.0218 2700 dsunidrv        (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys2011/05/06 19:30:21.0312 2700 E100B           (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys2011/05/06 19:30:21.0406 2700 Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys2011/05/06 19:30:21.0468 2700 Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys2011/05/06 19:30:21.0531 2700 Fips            (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys2011/05/06 19:30:21.0656 2700 Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys2011/05/06 19:30:21.0718 2700 FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys2011/05/06 19:30:21.0765 2700 Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys2011/05/06 19:30:21.0812 2700 Ftdisk          (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys2011/05/06 19:30:21.0859 2700 GearAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys2011/05/06 19:30:21.0921 2700 Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys2011/05/06 19:30:21.0968 2700 HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys2011/05/06 19:30:22.0078 2700 HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys2011/05/06 19:30:22.0125 2700 hpn             (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys2011/05/06 19:30:22.0203 2700 HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys2011/05/06 19:30:22.0250 2700 HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys2011/05/06 19:30:22.0296 2700 HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys2011/05/06 19:30:22.0343 2700 HSFHWBS2        (77e4ff0b73bc0aeaaf39bf0c8104231f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys2011/05/06 19:30:22.0531 2700 HSF_DP          (60e1604729a15ef4a3b05f298427b3b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys2011/05/06 19:30:22.0687 2700 HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys2011/05/06 19:30:22.0781 2700 i2omgmt         (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys2011/05/06 19:30:22.0828 2700 i2omp           (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys2011/05/06 19:30:22.0843 2700 i8042prt        (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys2011/05/06 19:30:22.0953 2700 ialm            (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys2011/05/06 19:30:23.0156 2700 Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys2011/05/06 19:30:23.0218 2700 ini910u         (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys2011/05/06 19:30:23.0281 2700 IntelIde        (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys2011/05/06 19:30:23.0328 2700 intelppm        (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys2011/05/06 19:30:23.0359 2700 Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys2011/05/06 19:30:23.0453 2700 IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys2011/05/06 19:30:23.0500 2700 IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys2011/05/06 19:30:23.0546 2700 IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys2011/05/06 19:30:23.0578 2700 IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys2011/05/06 19:30:23.0625 2700 IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys2011/05/06 19:30:23.0671 2700 isapnp          (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys2011/05/06 19:30:23.0828 2700 JSWSCIMD        (ad67795900aa8c05cc4570f5349e0639) C:\WINDOWS\system32\DRIVERS\jswscimd.sys2011/05/06 19:30:23.0906 2700 Kbdclass        (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys2011/05/06 19:30:23.0921 2700 kbdhid          (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys2011/05/06 19:30:23.0953 2700 kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys2011/05/06 19:30:24.0015 2700 KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys2011/05/06 19:30:24.0234 2700 mdmxsdk         (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys2011/05/06 19:30:24.0281 2700 mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys2011/05/06 19:30:24.0359 2700 Modem           (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys2011/05/06 19:30:24.0375 2700 MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys2011/05/06 19:30:24.0437 2700 Mouclass        (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys2011/05/06 19:30:24.0593 2700 mouhid          (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys2011/05/06 19:30:24.0656 2700 MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys2011/05/06 19:30:24.0718 2700 MpFilter        (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys2011/05/06 19:30:24.0968 2700 MpKsl03a5c3a9   (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{262734BD-C078-4BDF-9C38-80290A732FE4}\MpKsl03a5c3a9.sys2011/05/06 19:30:25.0046 2700 MpKsl04fdaada   (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{262734BD-C078-4BDF-9C38-80290A732FE4}\MpKsl04fdaada.sys2011/05/06 19:30:25.0156 2700 MpKsla1054d12   (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{262734BD-C078-4BDF-9C38-80290A732FE4}\MpKsla1054d12.sys2011/05/06 19:30:25.0218 2700 MpKslca49d5cf   (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{262734BD-C078-4BDF-9C38-80290A732FE4}\MpKslca49d5cf.sys2011/05/06 19:30:25.0421 2700 mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys2011/05/06 19:30:25.0531 2700 MREMP50         (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS2011/05/06 19:30:25.0593 2700 MRESP50         (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS2011/05/06 19:30:25.0656 2700 MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys2011/05/06 19:30:25.0843 2700 MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys2011/05/06 19:30:25.0984 2700 MSDV            (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys2011/05/06 19:30:26.0109 2700 Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys2011/05/06 19:30:26.0187 2700 MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys2011/05/06 19:30:26.0250 2700 MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys2011/05/06 19:30:26.0281 2700 MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys2011/05/06 19:30:26.0328 2700 mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys2011/05/06 19:30:26.0375 2700 MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys2011/05/06 19:30:26.0500 2700 Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys2011/05/06 19:30:26.0593 2700 NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys2011/05/06 19:30:26.0656 2700 NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys2011/05/06 19:30:26.0687 2700 NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys2011/05/06 19:30:26.0734 2700 NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys2011/05/06 19:30:26.0781 2700 Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys2011/05/06 19:30:26.0859 2700 NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys2011/05/06 19:30:26.0921 2700 NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys2011/05/06 19:30:27.0000 2700 NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys2011/05/06 19:30:27.0031 2700 NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys2011/05/06 19:30:27.0078 2700 Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys2011/05/06 19:30:27.0109 2700 Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys2011/05/06 19:30:27.0156 2700 Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys2011/05/06 19:30:27.0265 2700 nv              (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS
v4_mini.sys2011/05/06 19:30:27.0421 2700 NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys2011/05/06 19:30:27.0468 2700 NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys2011/05/06 19:30:27.0515 2700 Parport         (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys2011/05/06 19:30:27.0562 2700 PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys2011/05/06 19:30:27.0593 2700 ParVdm          (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys2011/05/06 19:30:27.0718 2700 PCI             (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys2011/05/06 19:30:27.0796 2700 PCIIde          (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys2011/05/06 19:30:27.0828 2700 Pcmcia          (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys2011/05/06 19:30:27.0937 2700 perc2           (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys2011/05/06 19:30:27.0968 2700 perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys2011/05/06 19:30:28.0046 2700 Point32         (e552d6598670b1e7655cb73d562e0cd9) C:\WINDOWS\system32\DRIVERS\point32.sys2011/05/06 19:30:28.0234 2700 PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys2011/05/06 19:30:28.0281 2700 PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys2011/05/06 19:30:28.0296 2700 Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys2011/05/06 19:30:28.0343 2700 PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys2011/05/06 19:30:28.0390 2700 ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys2011/05/06 19:30:28.0421 2700 Ql10wnt         (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys2011/05/06 19:30:28.0437 2700 ql12160         (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys2011/05/06 19:30:28.0453 2700 ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys2011/05/06 19:30:28.0609 2700 ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys2011/05/06 19:30:28.0656 2700 RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys2011/05/06 19:30:28.0718 2700 Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys2011/05/06 19:30:28.0765 2700 RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys2011/05/06 19:30:28.0796 2700 Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys2011/05/06 19:30:28.0843 2700 Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys2011/05/06 19:30:28.0890 2700 RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys2011/05/06 19:30:28.0937 2700 rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys2011/05/06 19:30:29.0000 2700 RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys2011/05/06 19:30:29.0125 2700 redbook         (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERSedbook.sys2011/05/06 19:30:29.0250 2700 RT73            (cb20f16afdba63707fb971e0922edec1) C:\WINDOWS\system32\DRIVERSt73.sys2011/05/06 19:30:29.0312 2700 Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys2011/05/06 19:30:29.0375 2700 serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys2011/05/06 19:30:29.0406 2700 Serial          (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys2011/05/06 19:30:29.0515 2700 Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys2011/05/06 19:30:29.0609 2700 sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys2011/05/06 19:30:29.0640 2700 SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys2011/05/06 19:30:29.0703 2700 SONYPVU1        (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS2011/05/06 19:30:29.0718 2700 Sparrow         (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys2011/05/06 19:30:29.0781 2700 splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys2011/05/06 19:30:29.0937 2700 sr              (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys2011/05/06 19:30:30.0015 2700 Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys2011/05/06 19:30:30.0234 2700 STHDA           (2a2dc39623adef8ab3703ab9fac4b440) C:\WINDOWS\system32\drivers\sthda.sys2011/05/06 19:30:30.0406 2700 streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys2011/05/06 19:30:30.0468 2700 swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys2011/05/06 19:30:30.0500 2700 swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys2011/05/06 19:30:30.0562 2700 symc810         (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys2011/05/06 19:30:30.0593 2700 symc8xx         (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys2011/05/06 19:30:30.0609 2700 sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys2011/05/06 19:30:30.0703 2700 sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys2011/05/06 19:30:30.0781 2700 sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys2011/05/06 19:30:30.0859 2700 Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys2011/05/06 19:30:30.0937 2700 TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys2011/05/06 19:30:30.0968 2700 TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys2011/05/06 19:30:31.0015 2700 TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\TERMDD.SYS2011/05/06 19:30:31.0171 2700 TosIde          (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS	oside.sys2011/05/06 19:30:31.0218 2700 Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys2011/05/06 19:30:31.0281 2700 ultra           (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys2011/05/06 19:30:31.0343 2700 Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys2011/05/06 19:30:31.0546 2700 usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys2011/05/06 19:30:31.0625 2700 usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys2011/05/06 19:30:31.0656 2700 usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys2011/05/06 19:30:31.0703 2700 usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys2011/05/06 19:30:31.0734 2700 usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys2011/05/06 19:30:31.0765 2700 usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys2011/05/06 19:30:31.0812 2700 USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS2011/05/06 19:30:31.0843 2700 usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys2011/05/06 19:30:31.0859 2700 VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys2011/05/06 19:30:31.0921 2700 viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys2011/05/06 19:30:32.0062 2700 ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys2011/05/06 19:30:32.0109 2700 VolSnap         (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys2011/05/06 19:30:32.0156 2700 Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys2011/05/06 19:30:32.0234 2700 wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys2011/05/06 19:30:32.0281 2700 wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys2011/05/06 19:30:32.0343 2700 winachsf        (f59ed5a43b988a18ef582bb07b2327a7) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys2011/05/06 19:30:32.0562 2700 WN111v2         (93ea7d94959bef66d0e4adbc8ce4e073) C:\WINDOWS\system32\DRIVERS\WN111v2.sys2011/05/06 19:30:32.0625 2700 WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys2011/05/06 19:30:32.0671 2700 WSIMD           (43f767d59bfc25d8f4fc2eb42043ec1e) C:\WINDOWS\system32\DRIVERS\wsimd.sys2011/05/06 19:30:32.0734 2700 WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS2011/05/06 19:30:32.0828 2700 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)2011/05/06 19:30:32.0828 2700 ================================================================================2011/05/06 19:30:32.0828 2700 Scan finished2011/05/06 19:30:32.0828 2700 ================================================================================2011/05/06 19:30:32.0859 0472 Detected object count: 12011/05/06 19:32:01.0296 0472 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot2011/05/06 19:32:01.0296 0472 \HardDisk0 - ok2011/05/06 19:32:01.0296 0472 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure 2011/05/06 19:33:30.0875 3068 Deinitialize success 2011/05/09 16:48:01.0625 5936 TDSS rootkit removing tool 2.5.0.0 May  1 2011 14:20:162011/05/09 16:48:02.0171 5936 ================================================================================2011/05/09 16:48:02.0171 5936 SystemInfo:2011/05/09 16:48:02.0171 5936 2011/05/09 16:48:02.0171 5936 OS Version: 5.1.2600 ServicePack: 3.02011/05/09 16:48:02.0171 5936 Product type: Workstation2011/05/09 16:48:02.0171 5936 ComputerName: D8H9F3B12011/05/09 16:48:02.0171 5936 UserName: Marilee2011/05/09 16:48:02.0171 5936 Windows directory: C:\WINDOWS2011/05/09 16:48:02.0171 5936 System windows directory: C:\WINDOWS2011/05/09 16:48:02.0171 5936 Processor architecture: Intel x862011/05/09 16:48:02.0171 5936 Number of processors: 22011/05/09 16:48:02.0171 5936 Page size: 0x10002011/05/09 16:48:02.0171 5936 Boot type: Normal boot2011/05/09 16:48:02.0171 5936 ================================================================================2011/05/09 16:48:02.0703 5936 Initialize success2011/05/09 16:48:04.0421 5200 ================================================================================2011/05/09 16:48:04.0421 5200 Scan started2011/05/09 16:48:04.0421 5200 Mode: Manual; 2011/05/09 16:48:04.0421 5200 ================================================================================2011/05/09 16:48:05.0343 5200 abp480n5        (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS2011/05/09 16:48:05.0390 5200 ACPI            (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys2011/05/09 16:48:05.0437 5200 ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys2011/05/09 16:48:05.0500 5200 adpu160m        (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys2011/05/09 16:48:05.0546 5200 aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys2011/05/09 16:48:05.0593 5200 AegisP          (2f7f3e8da380325866e566f5d5ec23d5) C:\WINDOWS\system32\DRIVERS\AegisP.sys2011/05/09 16:48:05.0703 5200 AFD             (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys2011/05/09 16:48:05.0750 5200 agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys2011/05/09 16:48:05.0765 5200 agpCPQ          (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys2011/05/09 16:48:05.0812 5200 Aha154x         (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys2011/05/09 16:48:05.0828 5200 aic78u2         (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys2011/05/09 16:48:05.0843 5200 aic78xx         (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys2011/05/09 16:48:05.0875 5200 AliIde          (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys2011/05/09 16:48:05.0906 5200 alim1541        (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys2011/05/09 16:48:05.0921 5200 amdagp          (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys2011/05/09 16:48:05.0937 5200 amsint          (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys2011/05/09 16:48:05.0984 5200 asc             (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys2011/05/09 16:48:06.0000 5200 asc3350p        (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys2011/05/09 16:48:06.0015 5200 asc3550         (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys2011/05/09 16:48:06.0078 5200 AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys2011/05/09 16:48:06.0109 5200 atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys2011/05/09 16:48:06.0140 5200 Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys2011/05/09 16:48:06.0187 5200 audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys2011/05/09 16:48:06.0234 5200 Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys2011/05/09 16:48:06.0343 5200 cbidf           (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys2011/05/09 16:48:06.0359 5200 cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys2011/05/09 16:48:06.0375 5200 CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys2011/05/09 16:48:06.0421 5200 cd20xrnt        (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys2011/05/09 16:48:06.0437 5200 Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys2011/05/09 16:48:06.0484 5200 Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys2011/05/09 16:48:06.0531 5200 Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys2011/05/09 16:48:06.0625 5200 CmdIde          (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys2011/05/09 16:48:06.0656 5200 Cpqarray        (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys2011/05/09 16:48:06.0687 5200 dac2w2k         (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys2011/05/09 16:48:06.0718 5200 dac960nt        (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys2011/05/09 16:48:06.0750 5200 Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys2011/05/09 16:48:06.0796 5200 DLABOIOM        (e2d0de31442390c35e3163c87cb6a9eb) C:\WINDOWS\system32\DLA\DLABOIOM.SYS2011/05/09 16:48:06.0843 5200 DLACDBHM        (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS2011/05/09 16:48:06.0859 5200 DLADResN        (83545593e297f50a8e2524b4c071a153) C:\WINDOWS\system32\DLA\DLADResN.SYS2011/05/09 16:48:06.0890 5200 DLAIFS_M        (96e01d901cdc98c7817155cc057001bf) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS2011/05/09 16:48:06.0921 5200 DLAOPIOM        (0a60a39cc5e767980a31ca5d7238dfa9) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS2011/05/09 16:48:06.0968 5200 DLAPoolM        (9fe2b72558fc808357f427fd83314375) C:\WINDOWS\system32\DLA\DLAPoolM.SYS2011/05/09 16:48:07.0000 5200 DLARTL_N        (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS2011/05/09 16:48:07.0015 5200 DLAUDFAM        (f08e1dafac457893399e03430a6a1397) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS2011/05/09 16:48:07.0046 5200 DLAUDF_M        (e7d105ed1e694449d444a9933df8e060) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS2011/05/09 16:48:07.0125 5200 dmboot          (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys2011/05/09 16:48:07.0187 5200 dmio            (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys2011/05/09 16:48:07.0234 5200 dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys2011/05/09 16:48:07.0265 5200 DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys2011/05/09 16:48:07.0296 5200 DNINDIS5        (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS2011/05/09 16:48:07.0406 5200 dpti2o          (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys2011/05/09 16:48:07.0468 5200 drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys2011/05/09 16:48:07.0562 5200 DRVMCDB         (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS2011/05/09 16:48:07.0781 5200 DRVNDDM         (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS2011/05/09 16:48:07.0875 5200 DSproct         (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction	riggers\DSproct.sys2011/05/09 16:48:07.0937 5200 dsunidrv        (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys2011/05/09 16:48:07.0968 5200 E100B           (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys2011/05/09 16:48:08.0031 5200 Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys2011/05/09 16:48:08.0062 5200 Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys2011/05/09 16:48:08.0093 5200 Fips            (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys2011/05/09 16:48:08.0109 5200 Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys2011/05/09 16:48:08.0156 5200 FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys2011/05/09 16:48:08.0171 5200 Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys2011/05/09 16:48:08.0218 5200 Ftdisk          (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys2011/05/09 16:48:08.0265 5200 GearAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys2011/05/09 16:48:08.0343 5200 Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys2011/05/09 16:48:08.0421 5200 HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys2011/05/09 16:48:08.0468 5200 HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys2011/05/09 16:48:08.0500 5200 hpn             (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys2011/05/09 16:48:08.0625 5200 HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys2011/05/09 16:48:08.0671 5200 HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys2011/05/09 16:48:08.0703 5200 HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys2011/05/09 16:48:08.0750 5200 HSFHWBS2        (77e4ff0b73bc0aeaaf39bf0c8104231f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys2011/05/09 16:48:08.0843 5200 HSF_DP          (60e1604729a15ef4a3b05f298427b3b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys2011/05/09 16:48:08.0953 5200 HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys2011/05/09 16:48:09.0062 5200 i2omgmt         (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys2011/05/09 16:48:09.0093 5200 i2omp           (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys2011/05/09 16:48:09.0125 5200 i8042prt        (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys2011/05/09 16:48:09.0187 5200 ialm            (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys2011/05/09 16:48:09.0265 5200 Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys2011/05/09 16:48:09.0359 5200 ini910u         (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys2011/05/09 16:48:09.0421 5200 IntelIde        (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys2011/05/09 16:48:09.0484 5200 intelppm        (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys2011/05/09 16:48:09.0531 5200 Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys2011/05/09 16:48:09.0578 5200 IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys2011/05/09 16:48:09.0656 5200 IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys2011/05/09 16:48:09.0703 5200 IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys2011/05/09 16:48:09.0750 5200 IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys2011/05/09 16:48:09.0781 5200 IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys2011/05/09 16:48:09.0828 5200 isapnp          (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys2011/05/09 16:48:09.0875 5200 JSWSCIMD        (ad67795900aa8c05cc4570f5349e0639) C:\WINDOWS\system32\DRIVERS\jswscimd.sys2011/05/09 16:48:09.0953 5200 Kbdclass        (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys2011/05/09 16:48:09.0968 5200 kbdhid          (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys2011/05/09 16:48:10.0000 5200 kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys2011/05/09 16:48:10.0046 5200 KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys2011/05/09 16:48:10.0156 5200 mdmxsdk         (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys2011/05/09 16:48:10.0187 5200 mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys2011/05/09 16:48:10.0218 5200 Modem           (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys2011/05/09 16:48:10.0281 5200 MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys2011/05/09 16:48:10.0328 5200 Mouclass        (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys2011/05/09 16:48:10.0406 5200 mouhid          (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys2011/05/09 16:48:10.0484 5200 MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys2011/05/09 16:48:10.0531 5200 MpFilter        (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys2011/05/09 16:48:10.0781 5200 MpKslb8e8b405   (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{77887E55-998E-4E2B-8DC6-A6F19C6C48CE}\MpKslb8e8b405.sys2011/05/09 16:48:10.0937 5200 mraid35x        (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys2011/05/09 16:48:11.0015 5200 MREMP50         (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS2011/05/09 16:48:11.0078 5200 MRESP50         (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS2011/05/09 16:48:11.0140 5200 MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys2011/05/09 16:48:11.0281 5200 MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys2011/05/09 16:48:11.0406 5200 MSDV            (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys2011/05/09 16:48:11.0484 5200 Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys2011/05/09 16:48:11.0562 5200 MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys2011/05/09 16:48:11.0609 5200 MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys2011/05/09 16:48:11.0640 5200 MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys2011/05/09 16:48:11.0687 5200 mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys2011/05/09 16:48:11.0796 5200 MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys2011/05/09 16:48:11.0828 5200 Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys2011/05/09 16:48:11.0890 5200 NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys2011/05/09 16:48:11.0937 5200 NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys2011/05/09 16:48:11.0968 5200 NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys2011/05/09 16:48:12.0000 5200 NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys2011/05/09 16:48:12.0031 5200 Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys2011/05/09 16:48:12.0109 5200 NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys2011/05/09 16:48:12.0140 5200 NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys2011/05/09 16:48:12.0218 5200 NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys2011/05/09 16:48:12.0250 5200 NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys2011/05/09 16:48:12.0312 5200 Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys2011/05/09 16:48:12.0343 5200 Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys2011/05/09 16:48:12.0390 5200 Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys2011/05/09 16:48:12.0468 5200 nv              (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS
v4_mini.sys2011/05/09 16:48:12.0640 5200 NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys2011/05/09 16:48:12.0718 5200 NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys2011/05/09 16:48:12.0765 5200 Parport         (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys2011/05/09 16:48:12.0796 5200 PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys2011/05/09 16:48:12.0828 5200 ParVdm          (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys2011/05/09 16:48:12.0921 5200 PCI             (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys2011/05/09 16:48:12.0984 5200 PCIIde          (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys2011/05/09 16:48:13.0031 5200 Pcmcia          (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys2011/05/09 16:48:13.0140 5200 perc2           (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys2011/05/09 16:48:13.0171 5200 perc2hib        (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys2011/05/09 16:48:13.0250 5200 Point32         (e552d6598670b1e7655cb73d562e0cd9) C:\WINDOWS\system32\DRIVERS\point32.sys2011/05/09 16:48:13.0390 5200 PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys2011/05/09 16:48:13.0437 5200 PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys2011/05/09 16:48:13.0453 5200 Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys2011/05/09 16:48:13.0500 5200 PxHelp20        (86724469cd077901706854974cd13c3e) C:\WINDOWS\system32\Drivers\PxHelp20.sys2011/05/09 16:48:13.0578 5200 ql1080          (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys2011/05/09 16:48:13.0765 5200 Ql10wnt         (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys2011/05/09 16:48:13.0875 5200 ql12160         (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys2011/05/09 16:48:13.0906 5200 ql1240          (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys2011/05/09 16:48:13.0968 5200 ql1280          (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys2011/05/09 16:48:14.0000 5200 RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys2011/05/09 16:48:14.0062 5200 Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys2011/05/09 16:48:14.0093 5200 RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys2011/05/09 16:48:14.0125 5200 Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys2011/05/09 16:48:14.0171 5200 Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys2011/05/09 16:48:14.0187 5200 RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys2011/05/09 16:48:14.0250 5200 rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys2011/05/09 16:48:14.0328 5200 RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys2011/05/09 16:48:14.0375 5200 redbook         (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERSedbook.sys2011/05/09 16:48:14.0515 5200 RT73            (cb20f16afdba63707fb971e0922edec1) C:\WINDOWS\system32\DRIVERSt73.sys2011/05/09 16:48:14.0593 5200 Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys2011/05/09 16:48:14.0703 5200 serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys2011/05/09 16:48:14.0734 5200 Serial          (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys2011/05/09 16:48:14.0812 5200 Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys2011/05/09 16:48:14.0890 5200 sisagp          (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys2011/05/09 16:48:14.0921 5200 SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys2011/05/09 16:48:15.0015 5200 SONYPVU1        (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS2011/05/09 16:48:15.0046 5200 Sparrow         (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys2011/05/09 16:48:15.0109 5200 splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys2011/05/09 16:48:15.0156 5200 sr              (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys2011/05/09 16:48:15.0218 5200 Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys2011/05/09 16:48:15.0312 5200 STHDA           (2a2dc39623adef8ab3703ab9fac4b440) C:\WINDOWS\system32\drivers\sthda.sys2011/05/09 16:48:15.0437 5200 streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys2011/05/09 16:48:15.0500 5200 swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys2011/05/09 16:48:15.0546 5200 swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys2011/05/09 16:48:15.0609 5200 symc810         (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys2011/05/09 16:48:15.0640 5200 symc8xx         (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys2011/05/09 16:48:15.0718 5200 sym_hi          (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys2011/05/09 16:48:15.0750 5200 sym_u3          (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys2011/05/09 16:48:15.0781 5200 sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys2011/05/09 16:48:15.0843 5200 Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys2011/05/09 16:48:15.0921 5200 TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys2011/05/09 16:48:16.0031 5200 TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys2011/05/09 16:48:16.0078 5200 TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\TERMDD.SYS2011/05/09 16:48:16.0171 5200 TosIde          (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS	oside.sys2011/05/09 16:48:16.0218 5200 Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys2011/05/09 16:48:16.0281 5200 ultra           (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys2011/05/09 16:48:16.0375 5200 Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys2011/05/09 16:48:16.0453 5200 usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys2011/05/09 16:48:16.0484 5200 usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys2011/05/09 16:48:16.0515 5200 usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys2011/05/09 16:48:16.0562 5200 usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys2011/05/09 16:48:16.0656 5200 usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys2011/05/09 16:48:16.0687 5200 usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys2011/05/09 16:48:16.0718 5200 USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS2011/05/09 16:48:16.0750 5200 usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys2011/05/09 16:48:16.0765 5200 VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys2011/05/09 16:48:16.0812 5200 viaagp          (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys2011/05/09 16:48:16.0843 5200 ViaIde          (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys2011/05/09 16:48:16.0890 5200 VolSnap         (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys2011/05/09 16:48:16.0937 5200 Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys2011/05/09 16:48:17.0046 5200 wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys2011/05/09 16:48:17.0125 5200 wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys2011/05/09 16:48:17.0171 5200 winachsf        (f59ed5a43b988a18ef582bb07b2327a7) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys2011/05/09 16:48:17.0281 5200 WN111v2         (93ea7d94959bef66d0e4adbc8ce4e073) C:\WINDOWS\system32\DRIVERS\WN111v2.sys2011/05/09 16:48:17.0453 5200 WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys2011/05/09 16:48:17.0484 5200 WSIMD           (43f767d59bfc25d8f4fc2eb42043ec1e) C:\WINDOWS\system32\DRIVERS\wsimd.sys2011/05/09 16:48:17.0578 5200 WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS2011/05/09 16:48:17.0640 5200 ================================================================================2011/05/09 16:48:17.0640 5200 Scan finished2011/05/09 16:48:17.0640 5200 ================================================================================2011/05/09 16:48:35.0718 0944 Deinitialize success Here is the aswMBR report (please note: could not download from your link - went off internet -  the aswMBR.txt file saved to desktop; but nowhere can I find the MBR.dat file you wanted - not sure if I did something wrong? Says it was stored in D&S desktop but I don't see it) .aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST SoftwareRun date: 2011-05-09 17:04:11-----------------------------17:04:11.343    OS Version: Windows 5.1.2600 Service Pack 317:04:11.343    Number of processors: 2 586 0x40917:04:11.343    ComputerName: D8H9F3B1  UserName: Marilee17:04:12.046    Initialize success17:04:58.109    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e17:04:58.109    Disk 0 Vendor: HDS728080PLA380 PF2OA63A Size: 76293MB BusType: 317:05:00.125    Disk 0 MBR read successfully17:05:00.125    Disk 0 MBR scan17:05:00.125    Disk 0 unknown MBR code17:05:02.125    Disk 0 scanning sectors +15624819017:05:02.156    Disk 0 scanning C:\WINDOWS\system32\drivers17:05:07.781    Service scanning17:05:08.890    Disk 0 trace - called modules:17:05:08.906    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 17:05:08.906    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d77ab8]17:05:08.906    3 CLASSPNP.SYS[f75fefd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x86d9ad98]17:05:08.906    Scan finished successfully17:06:02.953    Disk 0 MBR has been saved successfully to 'C:\Documents and Settings\Marilee\Desktop\MBR.dat'17:06:02.953    The log file has been saved successfully to 'C:\Documents and Settings\Marilee\Desktop\aswMBR.txt'

Bugbatter · Answer

Please pardon the intrusion, folks. I just wanted to comment on the ComboFix situation.

The Combofix has not been run recently - A little over a year ago I had a problem (several things but I can't remember what they were but think one of them was Alureon.H?) and Combofix was one of the programs you folks at Dell had me go through.) I wasn't aware that I even had it still on the computer.

Reference: http://en.community.dell.com/support-forums/virus-spyware/f/3521/t/19320274.aspx

ComboFix should have been removed by running the CleanUp component of OTL - if those instructions were followed.

gahixon1 · Answer

EDIT: DELETE

gahixon1 · Answer

Hi Cromarlee,

Thanks for such a detailed response that has helped me a lot to understand your situation. From your logs it looks like Alureon has definitely gone. I would like you to follow the instructions below, after these steps we will see what other issues remain and go from there.

Can I also ask how this computer connects to the internet. Do you use a wireless connection through a router,or, does your computer plug directly into a modem?

Can you explain the nature of the pop-ups you are receiving, are they still inappropriate in content. If not can you give me an example of what they contain.

Step 1
OTL Fix
Run OTL.exe

Copy/paste the following text written inside of the quote box into the Custom Scans/Fixes box located at the bottom of OTL

Quote:

:OTL
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
[2010/02/05 07:33:48 | 000,000,000 | ---D | M] (ShopAtHome Intelligent Shopping Toolbar) -- C:\Documents and Settings\Marilee\Application Data\Mozilla\Firefox\Profiles\xbwizt3x.default\extensions\toolbar@shopathome.com
O4 - HKLM..\Run: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKCU\..Trusted Domains: $talisma_url$ ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.)

:Files
C:\WINDOWS\PEV.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\zip.exe
C:\Documents and Settings\Marilee\Application Data\Yahoo!

:Commands
[emptytemp]
[emptyflash]
[resethosts]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
After rebooting, please post the OTL you are presented with on startup.

Step 3
ESET Scan

Lets see if anything is left over from your initial infection.

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.

Tick the box next to Yes, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats and the option Scan unwanted applications is checked

Click Scan
Wait for the scan to finish

Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic

In you next reply can I have:
OTL.txt
Results of the ESET scan
The answer to my initial questions RE: your router/pop-ups.
Any problems that still persist after running these steps.

cromarlee · Answer

Okay now I'm totally confused . Am I supposed to assume that I did something wrong and didn't follow instructions on 7th May when I ran OTL? Or I screwed something up by not following instructions a year ago? and exactly how does that now relate with the removal of Alureon A?

Oh please let me know what I didn't do and I will proceed with trying to follow the directions a little better.

gahixon1 · Answer

Hi Cromarlee,

Don't worry you haven't done anything wrong. With the majority of tools we use to clean your computer, the first scan is a diagnostic one. Most of these tools then have a 2nd stage were a fix can be applied. The fix script I asked you to do previously was the follow up to my initial diagnostic scan with OTL. This script is removing left over items that could help your computer run better.

Now, can I ask that you please read my previous post very carefully and follow all the instuctions within. If there is anything you don't understand please let me know and I will try to assist to make the instructions clearer.

Another thing I'd like to know is how do you connect to the internet. Does your computer connect through a router? Is it wireless or a wired connection. If you don't know, don't worry I can give you instructions that will allow you to tell me.

I know this process can be very daunting but I can assure you we are making good progress

George

Virus & Spyware

Alureon.A/Generic Host Process

Was this post helpful?