Announcement Banner
UNSOLVED

BS709

updated

15 years ago

B

BS709

12 Posts

0

3862

May 13th, 2011 03:00

Windows update fail error code: 80072EFE

Dear Dell Community Support,

                                                          I have been having this problem for over 3 weeks now with my windows update. I'm pretty sure it's a malware infection. I tried downloading a software and it turned out to be a bug. I've tried everything except for formatting my laptop- which is my last resource. I have followed the step mentioned by you in earlier posts about downloading DDS and letting it run a scan. Here are the log files from the scan

 

DDS

 

.

DDS (Ver_11-03-05.01) - NTFSx86  

Run by Baradwaj at 10:37:29.34 on 13/05/2011

Internet Explorer: 9.0.8112.16421

Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.44.1033.18.3032.1732 [GMT 1:00]

.

AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\WLTRYSVC.EXE

C:\Windows\System32\bcmwltry.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Windows\System32\WLTRAY.EXE

C:\Program Files\IDT\WDM\sttray.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files\AVG\AVG10\avgnsx.exe

C:\Program Files\AVG\AVG10\avgemcx.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\rundll32.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Baradwaj\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Baradwaj\Pictures\Downloads\dds.scr

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll

uURLSearchHooks: H - No File

mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll

TB: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File

TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe"

uRun: [Google Update] "c:\users\baradwaj\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide

mRun: [Apoint] "c:\program files\delltpad\Apoint.exe"

mRun: [Broadcom Wireless Manager UI] "c:\windows\system32\WLTRAY.exe"

mRun: [SysTrayApp] "%ProgramFiles%\IDT\WDM\sttray.exe"

mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe"

mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"

mRun: [Persistence] "c:\windows\system32\igfxpers.exe"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 28624]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-7-4 29736]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2010-7-4 144128]

R3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\drivers\OA009Ufd.sys [2010-6-18 144672]

R3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\drivers\OA009Vid.sys [2010-6-18 269216]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-2-3 947528]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-6-19 101120]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-21 16896]

S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2010-6-30 19968]

S4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_f6ef8056\AEstSrv.exe [2010-6-18 81920]

S4 BecHelperService;BecHelperService;c:\program files\3 mobile broadband\3connect\BecHelperService.exe [2010-6-19 1737464]

.

=============== Created Last 30 ================

.

2011-05-13 07:03:06 -------- d-----w- c:\progra~2\Skype Extras

2011-05-12 21:31:46 -------- d-----w- c:\program files\Windows Media Adapter v615

2011-05-12 21:31:46 -------- d-----w- C:\PixelMetrics Logs

2011-04-28 17:11:11 -------- d-----w- c:\progra~2\Webroot

2011-04-27 08:14:48 -------- d-----w- c:\program files\MALWAREBYTES ANTI-MALWARE

2011-04-26 15:46:34 -------- d-----w- c:\users\baradwaj\appdata\roaming\Malwarebytes

2011-04-26 15:46:23 -------- d-----w- c:\progra~2\Malwarebytes

2011-04-24 17:48:58 -------- d-----w- c:\program files\common files\Plasmoo

2011-04-24 17:48:56 -------- d-----w- c:\users\baradwaj\appdata\roaming\DVDVideoSoft

2011-04-24 17:48:55 -------- d-----w- c:\program files\DVDVideoSoft

2011-04-24 17:48:55 -------- d-----w- c:\program files\common files\DVDVideoSoft

2011-04-24 17:48:29 -------- d-----w- c:\program files\Audacity

2011-04-24 17:18:10 -------- d-----w- c:\users\baradwaj\appdata\local\PackageAware

2011-04-20 17:02:04 -------- d-----w- c:\windows\system32\catroot2

2011-04-15 11:37:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE

2011-04-15 11:33:43 438976 ----a-w- c:\windows\system32\Mshflxgd.ocx

2011-04-15 11:33:43 244024 ----a-w- c:\windows\system32\Msflxgrd.ocx

2011-04-15 11:33:43 212240 ----a-w- c:\windows\system32\Richtx32.ocx

2011-04-15 11:33:43 139264 ----a-w- c:\windows\system32\gswin32c.exe

2011-04-15 11:33:43 117507 ----a-w- c:\windows\system32\msinet.ocx

2011-04-15 11:33:42 196608 ----a-w- c:\windows\system32\Utility.dll

2011-04-15 11:33:42 -------- d--h--w- c:\progra~2\OCRTemp

2011-04-15 11:33:42 -------- d-----w- c:\windows\system32\gs

2011-04-15 11:33:38 368912 ----a-w- c:\windows\system32\vbar332.dll

2011-04-15 11:33:38 140288 ----a-w- c:\windows\system32\COMDLG32.OCX

2011-04-15 11:33:38 -------- d-----w- C:\QuickPDFConverter

2011-04-15 10:54:43 77824 ----a-w- c:\windows\system32\EBAPI.dll

2011-04-15 10:54:43 65536 ----a-w- c:\windows\system32\EEBUtil.dll

2011-04-15 10:54:43 55808 ----a-w- c:\windows\system32\EEBSDKIF.dll

2011-04-15 10:54:43 135168 ----a-w- c:\windows\system32\EEBAPI.dll

2011-04-15 10:54:43 110592 ----a-w- c:\windows\system32\EEBDSCVR.dll

2011-04-15 10:50:20 475410 ----a-w- c:\windows\system32\ensppmon.dll

2011-04-15 10:50:20 475410 ----a-w- c:\windows\system32\enppmon.dll

2011-04-15 10:50:20 458129 ----a-w- c:\windows\system32\ensppui.dll

2011-04-15 10:50:20 458129 ----a-w- c:\windows\system32\enppui.dll

2011-04-15 10:50:20 249344 ----a-w- c:\windows\system32\enspres.dll

2011-04-15 10:50:20 249344 ----a-w- c:\windows\system32\enpres.dll

2011-04-15 10:49:20 -------- d-----w- c:\program files\EpsonNet

2011-04-15 10:48:14 15872 ----a-w- c:\windows\system32\escdev.dll

2011-04-15 10:48:14 128392 ----a-w- c:\windows\system32\esdevapp.exe

2011-04-15 10:48:13 341504 ----a-w- c:\windows\system32\esw2ud.dll

2011-04-15 10:48:07 -------- d-----w- c:\program files\epson

2011-04-15 10:45:00 -------- d-----w- c:\program files\common files\EPSON

2011-04-15 10:43:45 8192 ----a-w- c:\windows\system32\E_DCINST.DLL

2011-04-15 10:43:44 93696 ----a-w- c:\windows\system32\E_FLBGCE.DLL

2011-04-15 10:43:44 63488 ----a-w- c:\windows\system32\E_FD4BGCE.DLL

2011-04-15 10:43:30 -------- d-----w- c:\progra~2\EPSON

2011-04-15 10:00:25 33792 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\EP0LPP00.DLL

2011-04-14 20:28:18 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys

2011-04-14 10:22:01 -------- d-----w- c:\program files\PlotSoft

2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr

.

==================== Find3M  ====================

.

2011-03-10 17:03:51 1162240 ----a-w- c:\windows\system32\mfc42u.dll

2011-03-10 17:03:51 1136640 ----a-w- c:\windows\system32\mfc42.dll

2011-03-03 15:42:03 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-03 13:25:11 2041856 ----a-w- c:\windows\system32\win32k.sys

2011-03-02 15:44:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll

2011-02-22 14:13:01 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-02-22 13:33:12 1068544 ----a-w- c:\windows\system32\DWrite.dll

2011-02-22 13:33:09 797696 ----a-w- c:\windows\system32\FntCache.dll

2011-02-16 16:16:37 34304 ----a-w- c:\windows\system32\atmlib.dll

2011-02-16 14:02:23 292864 ----a-w- c:\windows\system32\atmfd.dll

.

============= FINISH: 10:40:49.87 ===============

ATTACH
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft® Windows Vista™ Home Basic 
Boot Device: \Device\HarddiskVolume1
Install Date: 18/06/2010 16:47:23
System Uptime: 13/05/2011 10:34:16 (0 hours ago)
.
Motherboard: Dell Inc. |  | 0U315R
Processor: Intel(R) Core(TM)2 Duo CPU     T6500  @ 2.10GHz | Microprocessor | 1600/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 112.936 GiB free.
D: is CDROM ()
E: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: 
Description: Ethernet Controller
Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&1B809680&0&00E2
Manufacturer: 
Name: Ethernet Controller
PNP Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&1B809680&0&00E2
Service: 
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
3Connect
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Adobe Shockwave Player 11.5
Advanced Audio FX Engine
Audacity 1.2.6
AVG 2011
AVG PC Tuneup 2011
BitTorrent
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
Dell Resource CD
Dell Touchpad
Dell Webcam Central
Dell Wireless WLAN Card Utility
Digital Line Detect
EPSON Scan
EPSON SX420W Series Printer Uninstall
EpsonNet Print
EpsonNet Setup 3.3
Free Audio Converter version 2.2.17.421
Google Chrome
Google Talk Plugin
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Huawei modem
IDT Audio
Integrated Webcam Driver (1.00.02.0825)  
Intel(R) Graphics Media Accelerator Driver
Intel(R) TV Wizard
Java Auto Updater
Java(TM) 6 Update 24
League of Legends
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Picasa 3
PowerDVD DX
Realtek USB 2.0 Card Reader
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Skype Toolbars
Skype™ 5.3
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VLC media player 1.0.0
WIDCOMM Bluetooth Software 6.2.0.6600
Winamp
Winamp Detector Plug-in
Windows Media Player Firefox Plugin
WinZip 12.1
WordWeb
.
==== End Of File ===========================
Please help!! Thanks!!
Regards,
Baradwaj

 

  • grsamf

    38 Posts

    1345

    0

    Posted May 13th, 2011 06:00

    gahixon1, an Advanced Trainee in SpywareHammer Academy, will assist you with your problem.  Please be patient while he determines the proper steps to take.

  • BS709

    12 Posts

    1345

    0

    Posted May 13th, 2011 06:00

    Thanks!!

  • gahixon1

    62 Posts

    1347

    0

    Posted May 13th, 2011 09:00

    Hello BS709 and welcome to the Forums,

    My name is George and I will be assisting you with your problem.

    Please follow all my instructions carefully in the order that I give them.

    Please give a VERY clear description of the problem you are having. The more detailed, the quicker we will be able to work through the problem together.

    Do not install any updates until I tell you to do so. Updating an infected computer can have disastrous effects.

    Do not attempt any other fixes than what I give you here. Using other tools might interfere with the cleaning process. It may also damage your computer.

    Either print or save to Notepad all the instructions that I give you. If there is anything you are unsure of or any instructions you feel lack clarity, please do not hesitate to ask.

    Some of the logs I may ask for are very long and complex. As is analysing these logs. My responses to you may take longer than you would expect. I assure you that I will work through your problem and a solution as quick as I can.

    I am currently an advanced trainee in Malware removal at SpywareHammer Academy. My posts have to be approved by a Mentor before posting, so my responses may take longer than expected; all I ask is that you please be patient.

    Can you tell me what other problems exist, other than the error code you described, and what steps you have taken attempting to correct them?

    Use of P2P software

    I can see from your log that you have active P2P software. This must be disabled before I will continue with my help. P2P software as convenient as it may be is a breeding ground for malware, and apart from that is almost always used for downloading illegal content. SpywareHammer and other security forums have an absolute policy issue on this with no exceptions.
    Please see here

    In your case you have Bitorrent installed.

    If you adhere to the above step please continue.

    Step 1
    MBAM

    I see from your log that you have MBAM installed. If you have used this recently, can you please navigate within the interface of MBAM, find the Logs tab and post your most recent scan result here.

    Can I also ask that you run a new Quick Scan for me. Ensuring that you Update the program first.

    Step 2
    DDS

     

    • Double click on the DDS icon, allow it to run.
    • A small box will open, with an explanation about the tool.
    • When done, DDS will open two (2) logs
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop.
    • The instructions here ask you to attach the Attach.txt.
      DDS.jpg
    • Instead of attaching, please copy/paste both logs into your next reply.

       

      In your next reply can I have
      New MBAM log
      previous MBAM log(if run)
      DDS.txt
      Attach.txt
      A description of any other problems and what steps you have taken

      George

  • BS709

    12 Posts

    1347

    0

    Posted May 13th, 2011 12:00

    Dear George,

                              Thanks for your help! I appreciate it 

     

    1] MBAM log

    Malwarebytes' Anti-Malware 1.50.1.1100

    www.malwarebytes.org

     

    Database version: 6569

     

    Windows 6.0.6002 Service Pack 2

    Internet Explorer 9.0.8112.16421

     

    13/05/2011 19:52:09

    mbam-log-2011-05-13 (19-52-09).txt

     

    Scan type: Quick scan

    Objects scanned: 149005

    Time elapsed: 7 minute(s), 6 second(s)

     

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

     

    Memory Processes Infected:

    (No malicious items detected)

     

    Memory Modules Infected:

    (No malicious items detected)

     

    Registry Keys Infected:

    (No malicious items detected)

     

    Registry Values Infected:

    (No malicious items detected)

     

    Registry Data Items Infected:

    (No malicious items detected)

     

    Folders Infected:

    (No malicious items detected)

     

    Files Infected:

    (No malicious items detected)

     

    2] DDS.txt 
    .
    DDS (Ver_11-03-05.01) - NTFSx86  
    Run by Baradwaj at 10:37:29.34 on 13/05/2011
    Internet Explorer: 9.0.8112.16421
    Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.44.1033.18.3032.1732 [GMT 1:00]
    .
    AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\WLTRYSVC.EXE
    C:\Windows\System32\bcmwltry.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\DellTPad\Apoint.exe
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\Windows\System32\WLTRAY.EXE
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\AVG\AVG10\avgemcx.exe
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\DellTPad\ApMsgFwd.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\rundll32.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Baradwaj\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
    C:\Users\Baradwaj\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Baradwaj\Pictures\Downloads\dds.scr
    C:\Windows\system32\conime.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uSearch Bar = hxxp://www.google.com/ie
    uDefault_Search_URL = hxxp://www.google.com/ie
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    uURLSearchHooks: H - No File
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    TB: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
    TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
    uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe"
    uRun: [Google Update] "c:\users\baradwaj\appdata\local\google\update\GoogleUpdate.exe" /c
    mRun: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
    mRun: [Apoint] "c:\program files\delltpad\Apoint.exe"
    mRun: [Broadcom Wireless Manager UI] "c:\windows\system32\WLTRAY.exe"
    mRun: [SysTrayApp] "%ProgramFiles%\IDT\WDM\sttray.exe"
    mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe"
    mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"
    mRun: [Persistence] "c:\windows\system32\igfxpers.exe"
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: igfxcui - igfxdev.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 28624]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-7-4 29736]
    R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2010-7-4 144128]
    R3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\drivers\OA009Ufd.sys [2010-6-18 144672]
    R3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\drivers\OA009Vid.sys [2010-6-18 269216]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-2-3 947528]
    S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-6-19 101120]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-21 16896]
    S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2010-6-30 19968]
    S4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_f6ef8056\AEstSrv.exe [2010-6-18 81920]
    S4 BecHelperService;BecHelperService;c:\program files\3 mobile broadband\3connect\BecHelperService.exe [2010-6-19 1737464]
    .
    =============== Created Last 30 ================
    .
    2011-05-13 07:03:06 -------- d-----w- c:\progra~2\Skype Extras
    2011-05-12 21:31:46 -------- d-----w- c:\program files\Windows Media Adapter v615
    2011-05-12 21:31:46 -------- d-----w- C:\PixelMetrics Logs
    2011-04-28 17:11:11 -------- d-----w- c:\progra~2\Webroot
    2011-04-27 08:14:48 -------- d-----w- c:\program files\MALWAREBYTES ANTI-MALWARE
    2011-04-26 15:46:34 -------- d-----w- c:\users\baradwaj\appdata\roaming\Malwarebytes
    2011-04-26 15:46:23 -------- d-----w- c:\progra~2\Malwarebytes
    2011-04-24 17:48:58 -------- d-----w- c:\program files\common files\Plasmoo
    2011-04-24 17:48:56 -------- d-----w- c:\users\baradwaj\appdata\roaming\DVDVideoSoft
    2011-04-24 17:48:55 -------- d-----w- c:\program files\DVDVideoSoft
    2011-04-24 17:48:55 -------- d-----w- c:\program files\common files\DVDVideoSoft
    2011-04-24 17:48:29 -------- d-----w- c:\program files\Audacity
    2011-04-24 17:18:10 -------- d-----w- c:\users\baradwaj\appdata\local\PackageAware
    2011-04-20 17:02:04 -------- d-----w- c:\windows\system32\catroot2
    2011-04-15 11:37:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
    2011-04-15 11:33:43 438976 ----a-w- c:\windows\system32\Mshflxgd.ocx
    2011-04-15 11:33:43 244024 ----a-w- c:\windows\system32\Msflxgrd.ocx
    2011-04-15 11:33:43 212240 ----a-w- c:\windows\system32\Richtx32.ocx
    2011-04-15 11:33:43 139264 ----a-w- c:\windows\system32\gswin32c.exe
    2011-04-15 11:33:43 117507 ----a-w- c:\windows\system32\msinet.ocx
    2011-04-15 11:33:42 196608 ----a-w- c:\windows\system32\Utility.dll
    2011-04-15 11:33:42 -------- d--h--w- c:\progra~2\OCRTemp
    2011-04-15 11:33:42 -------- d-----w- c:\windows\system32\gs
    2011-04-15 11:33:38 368912 ----a-w- c:\windows\system32\vbar332.dll
    2011-04-15 11:33:38 140288 ----a-w- c:\windows\system32\COMDLG32.OCX
    2011-04-15 11:33:38 -------- d-----w- C:\QuickPDFConverter
    2011-04-15 10:54:43 77824 ----a-w- c:\windows\system32\EBAPI.dll
    2011-04-15 10:54:43 65536 ----a-w- c:\windows\system32\EEBUtil.dll
    2011-04-15 10:54:43 55808 ----a-w- c:\windows\system32\EEBSDKIF.dll
    2011-04-15 10:54:43 135168 ----a-w- c:\windows\system32\EEBAPI.dll
    2011-04-15 10:54:43 110592 ----a-w- c:\windows\system32\EEBDSCVR.dll
    2011-04-15 10:50:20 475410 ----a-w- c:\windows\system32\ensppmon.dll
    2011-04-15 10:50:20 475410 ----a-w- c:\windows\system32\enppmon.dll
    2011-04-15 10:50:20 458129 ----a-w- c:\windows\system32\ensppui.dll
    2011-04-15 10:50:20 458129 ----a-w- c:\windows\system32\enppui.dll
    2011-04-15 10:50:20 249344 ----a-w- c:\windows\system32\enspres.dll
    2011-04-15 10:50:20 249344 ----a-w- c:\windows\system32\enpres.dll
    2011-04-15 10:49:20 -------- d-----w- c:\program files\EpsonNet
    2011-04-15 10:48:14 15872 ----a-w- c:\windows\system32\escdev.dll
    2011-04-15 10:48:14 128392 ----a-w- c:\windows\system32\esdevapp.exe
    2011-04-15 10:48:13 341504 ----a-w- c:\windows\system32\esw2ud.dll
    2011-04-15 10:48:07 -------- d-----w- c:\program files\epson
    2011-04-15 10:45:00 -------- d-----w- c:\program files\common files\EPSON
    2011-04-15 10:43:45 8192 ----a-w- c:\windows\system32\E_DCINST.DLL
    2011-04-15 10:43:44 93696 ----a-w- c:\windows\system32\E_FLBGCE.DLL
    2011-04-15 10:43:44 63488 ----a-w- c:\windows\system32\E_FD4BGCE.DLL
    2011-04-15 10:43:30 -------- d-----w- c:\progra~2\EPSON
    2011-04-15 10:00:25 33792 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\EP0LPP00.DLL
    2011-04-14 20:28:18 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
    2011-04-14 10:22:01 -------- d-----w- c:\program files\PlotSoft
    2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    .
    ==================== Find3M  ====================
    .
    2011-03-10 17:03:51 1162240 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-10 17:03:51 1136640 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-03 15:42:03 739328 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-03 13:25:11 2041856 ----a-w- c:\windows\system32\win32k.sys
    2011-03-02 15:44:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-02-22 14:13:01 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-22 13:33:12 1068544 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-22 13:33:09 797696 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-16 16:16:37 34304 ----a-w- c:\windows\system32\atmlib.dll
    2011-02-16 14:02:23 292864 ----a-w- c:\windows\system32\atmfd.dll
    .
    ============= FINISH: 10:40:49.87 ===============
    3] ATTACH.TXT
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft® Windows Vista™ Home Basic 
    Boot Device: \Device\HarddiskVolume1
    Install Date: 18/06/2010 16:47:23
    System Uptime: 13/05/2011 10:34:16 (0 hours ago)
    .
    Motherboard: Dell Inc. |  | 0U315R
    Processor: Intel(R) Core(TM)2 Duo CPU     T6500  @ 2.10GHz | Microprocessor | 1600/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 233 GiB total, 112.936 GiB free.
    D: is CDROM ()
    E: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: 
    Description: Ethernet Controller
    Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&1B809680&0&00E2
    Manufacturer: 
    Name: Ethernet Controller
    PNP Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&1B809680&0&00E2
    Service: 
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    3Connect
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X (10.0.1)
    Adobe Shockwave Player 11.5
    Advanced Audio FX Engine
    Audacity 1.2.6
    AVG 2011
    AVG PC Tuneup 2011
    BitTorrent
    Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    Compatibility Pack for the 2007 Office system
    Dell Resource CD
    Dell Touchpad
    Dell Webcam Central
    Dell Wireless WLAN Card Utility
    Digital Line Detect
    EPSON Scan
    EPSON SX420W Series Printer Uninstall
    EpsonNet Print
    EpsonNet Setup 3.3
    Free Audio Converter version 2.2.17.421
    Google Chrome
    Google Talk Plugin
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Huawei modem
    IDT Audio
    Integrated Webcam Driver (1.00.02.0825)  
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) TV Wizard
    Java Auto Updater
    Java(TM) 6 Update 24
    League of Legends
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Picasa 3
    PowerDVD DX
    Realtek USB 2.0 Card Reader
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio Update Manager
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Skype Toolbars
    Skype™ 5.3
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    VLC media player 1.0.0
    WIDCOMM Bluetooth Software 6.2.0.6600
    Winamp
    Winamp Detector Plug-in
    Windows Media Player Firefox Plugin
    WinZip 12.1
    WordWeb
    .
    ==== End Of File ===========================

  • gahixon1

    62 Posts

    1347

    0

    Posted May 14th, 2011 07:00

    Hi BS709,

    From your logs I can still see that Bitorent is installed. I cannot assist you any further until you have removed this software. Please read my previous post and the link that explains the situation regarding P2P.

    Once this software has been removed I will continue to assist you. This policy is absolute.

    George

  • BS709

    12 Posts

    1347

    0

    Posted May 14th, 2011 14:00

    Hello George,

                                 Sorry about that! I have now uninstalled bitorrent from my system

     

    Regards,

    Birdie

  • gahixon1

    62 Posts

    1347

    0

    Posted May 14th, 2011 16:00

    Hi Birdie,

    From the logs that you have posted so far, I can't see anything that may be causing your problems. In order for me to get a better grasp of the situation, I need to know what other problems you may have. Depending on what you tell me I may be able to see what else I can do. So therefore I need a VERY clear description of the problems you are having apart from the window update issue. Can I also ask what software you downloaded that was a bug that you mentioned in the first post. Please follow the next step.

    Step 1
    RKUnhooker

    Please download Rootkit Unhooker and save it on your desktop.
    http://www.kernelmode.info/ARKs/RKUnhookerLE.EXE

     

    • Temporarily disable your antivirus and antimalware real-time protection before performing a scan by following the directions that apply HERE
    • Double-click RKUnhookerLE.EXE to run the program
    • Click the Report tab, then click Scan
    • Check Drivers, and Stealth Code
    • UNCheck the rest of the scan options, then click OK
    • Wait until the scanner has finished then select File > Save Report
    • Save the report somewhere you can find it. Click Close
    • Re-enable your security programs
    • Copy the entire contents of the report and paste it in your next reply.

     

    Note: You may get this warning. If so, please ignore it.
    "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?"

    In your next reply can I have:
    RKU.txt
    your current problems

    Thanks

    George

  • BS709

    12 Posts

    1347

    0

    Posted May 15th, 2011 02:00

    Dear George,

                              Thanks for your reply!

    I’m not sure what I downloaded; I think it was a keygen for installing Espon printer at my office that has caused the problem.

     

    I’ve been having the following issues with my system

    1] Windows explorer crashes and I get a dialog box saying “Host process for windowns and was closed. A problem caused the application to stop working.  Windows will notify you if a solution is available.”

    2] When I click Close, Another dialog box opens asking me to run windows update but then windows update fails with the error code 80072EFE

    3] When I open Google Chrome, sometimes Windows shuts down and I get a blue screen with a lot of instructions and a countdown with “Dump files into memory” or something of that sorts. It counts until 45 and then restarts windows

    4] Anytime I download a programme or software, I’m unable to autorun it. I need to restart the computer for it to work.

     

    Here is the log file from Rootkit Unhooker

     

    RkU Version: 3.8.388.590, Type LE (SR2)

    ==============================================

    OS Name: Windows Vista

    Version 6.0.6002 (Service Pack 2)

    Number of processors #2

    ==============================================

    >Drivers

    ==============================================

    0x8E20C000 C:\Windows\system32\DRIVERS\igdkmd32.sys 9428992 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)

    0x82017000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System)

    0x82017000 PnpManager 3907584 bytes

    0x82017000 RAW 3907584 bytes

    0x82017000 WMIxWDM 3907584 bytes

    0x814D0000 Win32k 2113536 bytes

    0x814D0000 C:\Windows\System32\win32k.sys 2113536 bytes (Microsoft Corporation, Multi-User Win32 Driver)

    0x8EC98000 C:\Windows\system32\DRIVERS\bcmwl6.sys 1220608 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver)

    0x8280A000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)

    0x8267B000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)

    0x8F20A000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)

    0x804D2000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)

    0xAD67C000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)

    0xABC01000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)

    0x8EB0A000 C:\Windows\System32\drivers\dxgkrnl.sys 655360 bytes (Microsoft Corporation, DirectX Graphics Kernel)

    0x8EC0B000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)

    0x93761000 C:\Windows\system32\drivers\btwaudio.sys 528384 bytes (Broadcom Corporation., Bluetooth Audio Device)

    0x93605000 C:\Windows\System32\Drivers\bthport.sys 524288 bytes (Microsoft Corporation, Bluetooth Bus Driver)

    0x80609000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)

    0x936EE000 C:\Windows\system32\drivers\btwavdt.sys 471040 bytes (Broadcom Corporation., Broadcom Bluetooth AVDT Service)

    0x8260A000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

    0x80408000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library)

    0xABD08000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)

    0x8F006000 C:\Windows\system32\DRIVERS\stwrt.sys 413696 bytes (IDT, Inc., IDT PC Audio)

    0xAD60F000 C:\Windows\System32\DRIVERS\srv.sys 323584 bytes (Microsoft Corporation, Server driver)

    0x8073B000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)

    0x8F3B2000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

    0x8F339000 C:\Windows\system32\DRIVERS\avgtdix.sys 290816 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)

    0x80692000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)

    0x8F692000 C:\Windows\system32\DRIVERS\OA009Vid.sys 270336 bytes (Creative Technology Ltd., Video Capture Device Driver)

    0x80491000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)

    0x8EEAC000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)

    0x8EBC1000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

    0x8F608000 C:\Windows\system32\DRIVERS\avgldx86.sys 245760 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)

    0x8F186000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

    0x827B1000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)

    0x8F7A2000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)

    0x8291A000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

    0x8EFC8000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)

    0x823D1000 ACPI_HAL 208896 bytes

    0x8EE00000 C:\Windows\system32\DRIVERS\Apfiltr.sys 208896 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)

    0x823D1000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

    0x805B2000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

    0x8F380000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)

    0x8EE7D000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)

    0x8F06B000 C:\Windows\system32\DRIVERS\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

    0x82786000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)

    0x8EF87000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)

    0xABCC1000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)

    0x93685000 C:\Windows\system32\DRIVERS\rfcomm.sys 167936 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver)

    0x8F724000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver)

    0x829D7000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)

    0x8296A000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)

    0x806E9000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

    0x8F098000 C:\Windows\system32\DRIVERS\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

    0x8F6F8000 C:\Windows\system32\DRIVERS\CtClsFlt.sys 147456 bytes (Creative Technology Ltd., Video Class Upper Filter Driver)

    0x8F6D4000 C:\Windows\system32\DRIVERS\OA009Ufd.sys 147456 bytes (Creative Technology Ltd., Video Class Upper Filter Driver)

    0x8EF1A000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

    0x829A2000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)

    0xABDC0000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

    0x8F0FC000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)

    0xAD775000 C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys 131072 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Driver.)

    0xABDE1000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

    0x8079D000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)

    0xABD75000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)

    0x8F2F4000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)

    0x8F787000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)

    0x936B8000 C:\Windows\system32\DRIVERS\bthpan.sys 106496 bytes (Microsoft Corporation, Bluetooth Personal Area Networking)

    0xABD92000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)

    0x8EE49000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

    0x8F7DB000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)

    0x8F1C2000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)

    0x8EEF8000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

    0x8F67B000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)

    0xAD7C9000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)

    0x8F14F000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)

    0x8F30F000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)

    0xABDAB000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)

    0x8EF60000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)

    0xAD795000 C:\Windows\system32\DRIVERS\WUDFRd.sys 86016 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector)

    0x8EF4C000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

    0x8F325000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)

    0x8EDC2000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)

    0xABCF5000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)

    0x8F644000 C:\Windows\system32\drivers\RTSTOR.SYS 77824 bytes (Realtek Semiconductor Corp., Realtek USB Mass Storage Driver for Vista)

    0x8F173000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

    0xAD7AA000 C:\Windows\system32\DRIVERS\WUDFPf.sys 73728 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)

    0x82991000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)

    0x8EDD5000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)

    0x80478000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)

    0x807D3000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)

    0x8F662000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)

    0xABCB1000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)

    0x80785000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)

    0x8EF75000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)

    0x936D2000 C:\Windows\system32\DRIVERS\bthmodem.sys 61440 bytes (Microsoft Corporation, Bluetooth Communications Driver)

    0x8EE6E000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)

    0x8F778000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)

    0x8295B000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)

    0x80710000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)

    0x8EF3D000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

    0x807ED000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

    0x8072C000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)

    0x81710000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)

    0x8F165000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)

    0x8F138000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)

    0x807C5000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

    0xAD7BC000 C:\Windows\System32\Drivers\BTHUSB.sys 53248 bytes (Microsoft Corporation, Bluetooth Miniport Driver)

    0x8F74C000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)

    0x936E1000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)

    0x8EFBB000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)

    0x80685000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)

    0x8F0BD000 C:\Windows\system32\DRIVERS\avgmfx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)

    0xAD764000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)

    0x8F0F0000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

    0x8EBAA000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)

    0x8F759000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes

    0x8EE3E000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)

    0x8EE33000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)

    0x8F12D000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)

    0x8EF0F000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

    0x8EEED000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)

    0x827EC000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

    0x8EBB6000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

    0x80722000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)

    0x936AE000 C:\Windows\system32\DRIVERS\BthEnum.sys 40960 bytes (Microsoft Corporation, Bluetooth Bus Extender)

    0x937E2000 C:\Windows\system32\DRIVERS\btwl2cap.sys 40960 bytes (Broadcom Corporation., Broadcom Bluetooth L2CAP Service)

    0x8F764000 C:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes

    0x8F76E000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)

    0x807BB000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)

    0x8EFB1000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)

    0xABCEB000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)

    0x8F200000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)

    0x807E3000 C:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

    0xAD75A000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)

    0x829C3000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)

    0x8F0C9000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)

    0x8F659000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

    0x8F672000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver)

    0x937EF000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

    0x8F146000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

    0x816F0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)

    0x82800000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

    0x8EE65000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)

    0x806D8000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

    0x80795000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)

    0x80489000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)

    0x8F71C000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)

    0x806E1000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)

    0x8F11D000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

    0x8F125000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

    0x82953000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)

    0x829CC000 C:\Windows\system32\DRIVERS\avgrkx86.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)

    0x8F0D9000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)

    0x8F0E9000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

    0x8F0D2000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)

    0xAD676000 C:\Windows\system32\DRIVERS\AVGIDSShim.Sys 24576 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Loader Driver.)

    0xAD770000 C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Filter Driver.)

    0x829D3000 C:\Windows\system32\DRIVERS\AVGIDSEH.Sys 16384 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)

    0x8EE61000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)

    0x937EC000 C:\Windows\system32\DRIVERS\btwrchid.sys 12288 bytes (Broadcom Corporation., Bluetooth Remote Control HID Minidriver)

    0x8071F000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)

    0x86915000 C:\Windows\system32\kdcom.dll 12288 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

    0x8EF85000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

    0x8F657000 C:\Windows\system32\drivers\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

    ==============================================

    >Stealth

    ==============================================

    0x05CC0000 Hidden Image-->WLTRAY.EXE [ EPROCESS 0xA97CF630 ] PID: 1908, 3952640 bytes

    0x01B20000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0xA97CF630 ] PID: 1908, 77824 bytes

    0x02560000 Hidden Image-->bcmwlrmt.dll [ EPROCESS 0xAF1FB4E8 ] PID: 3316, 77824 bytes

     

     

    !!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

     

    Thanks!

     

    Regards,

    Birdie

  • gahixon1

    62 Posts

    1347

    0

    Posted May 15th, 2011 11:00

    Hi Birdie,

    Thanks a lot for the great description of the problems you are having that was most helpful. However, it also raised a few issues. Can I ask do you own this computer or is it a work computer.

    Next you mention you used a keygen for a printer. Can I ask why. Nearly all printers provide free downloadable drivers from the manufactures website. Keygen's are used to pirate software by creating serial numbers. This is an illegal activity that we do not condone. Also we do not help out with computers with pirated software. I'd like you to run this scan next.

    Step 1
    CKScanner

    Download CKScanner from here

    Important : Save it to your desktop.

    Double-click CKScanner.exe and click Search For Files.
    After a very short time, when the cursor hourglass disappears, click Save List To File
    A message box will verify that the file is saved.
    Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

    In you next reply
    CKFiles.txt
    printer keygen explanation
    ownership of the computer

  • BS709

    12 Posts

    822

    0

    Posted May 15th, 2011 12:00

    Hello George,

                              Thanks once again for your help!

     

    1] CKScanner.txt

     

    CKScanner - Additional Security Risks - These are not necessarily bad

    scanner sequence 3.MN.11

     ----- EOF ----- 

    2] Printer Keygen: At office we had this new printer installed. Epson..lala edition. I was trying to install it through bluetooth but it kept asking me for the printer driver cd. My boss didn't have the cd with him, so I thought I'll find the driver online. But in the process also downloaded a keygen following wwhich the problems started. I was unable to physically locate the files. In the end I found the right driver and the printer was installed.
    3] I own this laptop. It's my own personal laptop
    Thanks!
    Regards,
    Birdie