asked on

Can not access or ping microsoft.com or windows update

Hello

One of our computers contracted a bunch of infections. I have been able to remove most of the infections but something is still lingering or damaged and I really need some help. Here are the facts:

- I'm running Windows XP SP3.
- I cannot access Windows updates. When I go to Windows updates from the start menus I get this error:
Internet Explorer cannot display the webpage
- I can access microsoft.com from a Web browser
- If I click on "Get windows updates" link on the microsoft.com homepage I eventually get this error:
[Error number: 0x80072EFF]
The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
- I cannot ping microsoft.com or windowsupdate.microsoft.com
- I have issues accessing othe rmicrosoft sites (community, technet) from this computer
- I do not have issues connecting to any other Web sites or pinging them. I can ping Google.com and yahoo.com as well as access them through a Web browser.
- I cannot access the sames Microsoft sites in Internet Explorer or Firefox, changing browser does not provide a work around.
- I have uninstalled and reinstalled Internet Explorer 8 several times. I have also reset all the IE setting and restored defaults.

I have run the following programs/fixes - all of which are not returning any infections:

AVG Free
Spybot S&D
Malwarebytes
Super AntiSpyware
PCTools Spyware Doctor
OneCare
Microsoft MRT
Windows Defender
Smitfraud
Combofix
DialAFix
Symantec Conficker removal tool
Symantec Mydoom removal tool
LSP Fix

Here is the latest HiJackThis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:23:57 PM, on 4/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\slpservice.exe
C:\WINDOWS\system32\slpmonx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\Seiko\slpcap.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=2071010
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=2071010
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: Telephony Toolbar Services - {431A60E6-675F-4b9f-B3F0-66E0FECC8B34} - C:\Program Files\XO\XO Anywhere Toolbar\bin\BW_Assistant_Enterprise_IE_S.dll
O2 - BHO: Telephony Toolbar Call Control - {8F1FF1A7-C048-4d6b-B052-56E42CE427CB} - C:\Program Files\XO\XO Anywhere Toolbar\bin\BW_Assistant_Enterprise_IE_CC.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Telephony Toolbar Call Control - {6F6690B9-C5DB-4F08-8833-F2EF4DEE956B} - C:\Program Files\XO\XO Anywhere Toolbar\bin\BW_Assistant_Enterprise_IE_CC.dll
O3 - Toolbar: Telephony Toolbar Services - {F10D927F-D3DF-4734-98AB-DD258253F5FD} - C:\Program Files\XO\XO Anywhere Toolbar\bin\BW_Assistant_Enterprise_IE_S.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe ûhide
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-842925246-2146491731-682003330-1136\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'tgettmann')
O4 - HKUS\S-1-5-21-842925246-2146491731-682003330-1136\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'tgettmann')
O4 - Global Startup: AddsUp.lnk = C:\WINDOWS\system32\AddsUp.exe
O4 - Global Startup: SmartCapture.lnk = C:\WINDOWS\Seiko\slpcap.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://eagent.farmersinsurance.com/PLA/eAgent/eAuto/commonActiveX/smsx.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.accelerater.net/au/13751/Full/setup.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192731896253
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe

--
End of file - 8725 bytes

Please let me know if you can help me out.

webbster20

try pinging the following:

74.125.113.104

10.57. 53. 23

xactdesign

ASKER

I got a reply on 74.125.113.104 but not 10.57.53.23 - are you sure the second one is a valid IP?

webbster20

Yes, I was verifying something.

You need to look into DNS to see if you can fix that.

Try

ipconfig /flushdns.

xactdesign

ASKER

I have already done that several times.

webbster20

For a work-around, but not true fix, you can try a hosts file entry:

http://accs-net.com/hosts/how_to_use_hosts.html
--

optoma

Post Combofix's logfile

Also run Hitmanpro + write down anything detected
http://www.surfright.nl/en/hitmanpro

xactdesign

ASKER

I just figured out you can't ping microsoft.com or any other Microsoft site from anywhere:

I just tested it from network-tools.com

Ping microsoft.com
Ping 207.46.197.32
[microsoft.com]
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Average time over 10 pings: 0 ms

windowsupdate.microsoft.com
Ping 207.46.225.221
[windowsupdate.microsoft.com]
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out
Timed out

Average time over 10 pings: 0 ms

xactdesign

ASKER

ComboFix 10-04-10.02 - tgettmann 04/11/2010 16:54:13.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1516 [GMT -4:00]
Running from: c:\documents and settings\tgettmann\My Documents\Downloads\ComboFix.exe
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((( Files Created from 2010-03-11 to 2010-04-11 )))))))))))))))))))))))))))))))
.

2010-04-11 20:37 . 2010-04-11 20:48 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-04-11 20:37 . 2010-04-11 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-04-11 20:37 . 2010-04-11 20:37 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-04-11 19:44 . 2010-04-11 19:44 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 19:44 . 2010-04-11 19:45 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 19:44 . 2010-04-11 19:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-04-11 19:03 . 2010-04-11 19:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-11 18:00 . 2010-04-11 18:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-11 17:57 . 2010-04-11 17:57 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-04-11 17:56 . 2010-04-11 17:56 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
2010-04-11 16:31 . 2010-04-11 16:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-04-11 16:16 . 2010-04-11 16:16 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\Threat Expert
2010-04-11 16:09 . 2010-02-02 14:13 59664 --s---w- c:\windows\system32\drivers\TfSysMon.sys
2010-04-11 16:09 . 2010-02-02 14:13 51984 --s---w- c:\windows\system32\drivers\TfFsMon.sys
2010-04-11 16:09 . 2010-02-02 14:13 33552 --s---w- c:\windows\system32\drivers\TfNetMon.sys
2010-04-11 15:16 . 2010-04-11 15:16 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-04-11 15:16 . 2010-04-11 15:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\BroadSoft
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\LogMeIn
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ATI
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-11 13:00 . 2010-04-11 14:03 -------- d-----w- c:\program files\Windows Live Safety Center
2010-04-11 05:23 . 2009-06-18 16:55 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys
2010-04-11 04:55 . 2010-04-11 04:55 -------- d-----w- c:\program files\Sophos
2010-04-11 04:41 . 2010-04-11 20:53 -------- d-----w- c:\windows\system32\CatRoot2
2010-04-11 00:39 . 2010-04-11 00:39 0 ----a-w- c:\windows\nsreg.dat
2010-04-11 00:39 . 2010-04-11 00:39 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\Mozilla
2010-04-10 23:17 . 2010-04-10 23:17 -------- d-----w- c:\program files\Windows Defender
2010-04-10 23:10 . 2010-04-10 23:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-10 22:45 . 2010-04-11 05:59 -------- dc-h--w- c:\windows\ie8
2010-04-10 15:36 . 2010-04-11 15:58 -------- d-----w- c:\windows\LMIC.tmp
2010-04-10 15:29 . 2010-04-10 15:29 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\ICS
2010-04-10 15:29 . 2010-04-10 20:03 -------- d-----w- c:\windows\LMIE0.tmp
2010-04-10 14:36 . 2010-04-10 14:36 52224 ----a-w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-10 14:36 . 2010-04-10 14:36 117760 ----a-w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com
2010-04-09 19:25 . 2010-04-09 19:25 388096 ----a-r- c:\documents and settings\tgettmann\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-09 18:44 . 2010-04-09 18:44 -------- d-----w- c:\documents and settings\tgettmann\Application Data\ElevatedDiagnostics
2010-04-09 15:21 . 2010-04-09 15:21 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-09 14:15 . 2010-04-09 14:15 -------- d-----w- c:\documents and settings\tgettmann\Application Data\Malwarebytes
2010-04-09 14:14 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-09 14:14 . 2010-04-09 15:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-09 14:14 . 2010-04-09 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-09 14:14 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-09 13:57 . 2008-04-14 00:12 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-04-09 13:57 . 2001-08-18 02:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-04-09 13:57 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-04-09 13:57 . 2001-08-18 02:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-04-09 13:57 . 2001-08-18 02:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-04-09 13:56 . 2001-08-18 02:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2010-04-09 13:56 . 2001-08-17 16:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-04-09 13:56 . 2004-08-04 02:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-04-09 13:56 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-04-09 13:56 . 2004-08-04 02:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-04-09 13:56 . 2008-04-14 00:12 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2010-04-09 13:56 . 2008-04-13 18:36 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-04-09 13:56 . 2004-08-04 02:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-04-09 13:56 . 2001-08-17 16:12 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-04-09 13:54 . 2001-08-17 17:28 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2010-04-09 13:53 . 2001-08-17 18:01 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys
2010-04-09 13:52 . 2001-08-18 02:36 24660 ----a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-04-09 13:51 . 2001-08-18 02:36 238592 ----a-w- c:\windows\system32\dllcache\sisgrv.dll
2010-04-09 13:50 . 2001-08-17 18:56 179264 ----a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-04-09 13:49 . 2008-04-14 00:12 363520 ----a-w- c:\windows\system32\dllcache\psisdecd.dll
2010-04-09 13:48 . 2001-08-18 02:36 116736 ----a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-04-09 13:47 . 2001-08-17 16:50 13664 ----a-w- c:\windows\system32\dllcache\n9i128.sys
2010-04-09 13:47 . 2001-08-17 18:56 35392 ----a-w- c:\windows\system32\dllcache\n9i128.dll
2010-04-09 13:47 . 2001-08-17 16:11 128000 ----a-w- c:\windows\system32\dllcache\n100325.sys
2010-04-09 13:47 . 2001-08-17 16:11 52255 ----a-w- c:\windows\system32\dllcache\n1000nt5.sys
2010-04-08 19:11 . 2004-08-04 09:00 34304 ----a-w- c:\windows\system32\dllcache\migisol.exe
2010-04-08 19:10 . 2004-08-04 09:00 6144 ----a-w- c:\windows\system32\dllcache\kbd101a.dll
2010-04-08 19:09 . 2001-08-17 17:28 44863 ----a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-04-08 19:08 . 2001-08-17 16:15 455680 ----a-w- c:\windows\system32\dllcache\fus2base.sys
2010-04-08 19:07 . 2001-08-17 16:10 26141 ----a-w- c:\windows\system32\dllcache\el589nd5.sys
2010-04-08 19:06 . 2001-08-17 16:19 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys
2010-04-08 19:05 . 2001-08-17 17:53 7424 ----a-w- c:\windows\system32\dllcache\adicvls.sys
2010-04-08 19:03 . 2010-04-08 19:00 3296 ----a-w- C:\fixshell.bat
2010-04-08 18:13 . 2008-04-14 00:12 171008 ----a-w- c:\windows\system32\dllcache\srsvc.dll
2010-04-08 18:13 . 2008-04-14 00:12 171008 ------w- c:\windows\system32\srsvc.dll
2010-04-08 17:09 . 2010-04-08 17:09 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-03-15 10:57 . 2010-03-15 10:57 0 ----a-w- c:\windows\system32\atiicdxx.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-11 21:02 . 2009-02-04 00:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-11 20:49 . 2010-04-11 16:05 -------- d-----w- c:\program files\Spyware Doctor
2010-04-11 18:00 . 2007-10-18 17:13 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-11 16:57 . 2009-02-04 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
.

((((((((((((((((((((((((((((( SnapShot@2010-04-11_01.57.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 06:19 . 2007-11-07 06:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2010-04-11 21:02 . 2010-04-11 21:02 16384 c:\windows\temp\Perflib_Perfdata_62c.dat
+ 2004-08-11 21:12 . 2008-04-14 00:12 32256 c:\windows\system32\wups.dll
+ 2010-04-11 16:05 . 2010-02-05 13:25 70408 c:\windows\system32\drivers\pctplsg.sys
+ 2010-04-11 16:05 . 2009-11-23 17:54 88040 c:\windows\system32\drivers\PCTAppEvent.sys
+ 2007-10-18 17:12 . 2010-04-11 14:14 47632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
+ 2010-04-11 05:59 . 2008-04-14 00:12 93184 c:\windows\ie8\iexplore.exe
+ 2010-04-11 05:59 . 2008-04-14 00:11 38912 c:\windows\ie8\hmmapi.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 120320 c:\windows\system32\wuweb.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 112640 c:\windows\system32\wucltui.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 111104 c:\windows\system32\wuauclt.exe
+ 2004-08-11 21:12 . 2008-04-14 00:12 430592 c:\windows\system32\wuapi.dll
+ 2010-04-11 16:05 . 2010-02-05 13:17 233136 c:\windows\system32\drivers\pctgntdi.sys
+ 2010-04-11 16:05 . 2010-03-10 15:36 217032 c:\windows\system32\drivers\PCTCore.sys
+ 2010-04-11 16:05 . 2010-01-22 13:56 149456 c:\windows\SGDetectionTool.dll
+ 2010-04-11 16:05 . 2010-01-22 13:56 165840 c:\windows\PCTBDRes.dll
+ 2010-04-11 16:05 . 2010-04-11 16:05 228352 c:\windows\Installer\64637.msi
+ 2009-10-15 02:32 . 2010-02-06 00:52 464272 c:\windows\Downloaded Program Files\wlscBase.dll
+ 2010-04-11 16:05 . 2010-01-22 13:55 767952 c:\windows\BDTSupport.dll
+ 2009-02-25 11:06 . 2008-07-09 17:08 382840 c:\windows\$hf_mig$\KB967715\update\updspapi.dll
- 2009-02-25 11:06 . 2008-07-09 07:38 382840 c:\windows\$hf_mig$\KB967715\update\updspapi.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 1135616 c:\windows\system32\wuaueng.dll
+ 2010-04-11 16:05 . 2010-01-22 13:56 1652688 c:\windows\PCTBDCore.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-26 1015808]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-04-11 5650240]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
"NoFavoritesMenu"= 01000000

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-29 00:34 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 01:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 15:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-07-17 17:23 162328 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2007-07-12 20:36 178712 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-07-17 17:23 141848 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 20:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 20:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2006-10-20 21:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-07-17 17:23 137752 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 13:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ThreatFire"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"WinDefend"=2 (0x2)
"ose"=3 (0x3)
"idsvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [04/11/2010 12:05 PM 217032]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [04/11/2010 12:09 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [04/11/2010 12:09 PM 59664]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [04/11/2010 12:05 PM 233136]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [02/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [02/17/2010 11:15 AM 66632]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [04/11/2010 1:23 AM 18816]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [04/11/2010 12:05 PM 112592]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [08/11/2008 1:41 PM 12856]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/03/2006 7:19 PM 13592]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\5.tmp --> c:\windows\system32\5.tmp [?]
S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [04/11/2010 12:05 PM 70408]
S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [07/24/2008 6:45 PM 12192]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [02/17/2010 11:15 AM 12872]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [04/11/2010 12:05 PM 366840]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [04/11/2010 12:09 PM 33552]
S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?]
S4 LkWebLink;Inter-Tel Collaboration Remote Client;c:\documents and settings\tgettmann\My Documents\Inter-Tel\Collaboration Client 2.0\lkWebLink.exe [09/20/2007 5:10 PM 32768]
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\User_Feed_Synchronization-{AFC0CDFF-EFCC-40C9-8F0E-A96F4007D05A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: aig4auto.com\www
Trusted Zone: aigwebrater.com\www
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: travelers.com
Trusted Zone: travelerspc.com
Trusted Zone: windowsupdate.com
FF - ProfilePath - c:\documents and settings\tgettmann\Application Data\Mozilla\Firefox\Profiles\jon9fgt9.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-11 17:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys >>UNKNOWN [0x89B88AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f5fcb8
\Driver\atapi -> atapi.sys @ 0xb9ef1852
\Driver\iaStor -> iaStor.sys @ 0xb9e5ebb8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom NetXtreme 57xx Gigabit Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9ce6bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9cf3a21
SendHandler -> NDIS.sys @ 0xb9cd187b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\5.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\napagent]
"ServiceDll"="%SystemRoot%\System32\qagentrt.old"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(508)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'lsass.exe'(568)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

- - - - - - - > 'explorer.exe'(2912)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\Seiko\slpcap.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2010-04-11 17:10:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-11 21:10
ComboFix2.txt 2010-04-11 02:01
ComboFix3.txt 2010-04-08 18:25

Pre-Run: 142,126,129,152 bytes free
Post-Run: 142,214,348,800 bytes free

- - End Of File - - 501E459A6E9251970DC7AC90236660D0
ComboFix 10-04-10.02 - tgettmann 04/11/2010 16:54:13.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1516 [GMT -4:00]
Running from: c:\documents and settings\tgettmann\My Documents\Downloads\ComboFix.exe
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((( Files Created from 2010-03-11 to 2010-04-11 )))))))))))))))))))))))))))))))
.

2010-04-11 20:37 . 2010-04-11 20:48 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-04-11 20:37 . 2010-04-11 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-04-11 20:37 . 2010-04-11 20:37 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-04-11 19:44 . 2010-04-11 19:44 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 19:44 . 2010-04-11 19:45 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 19:44 . 2010-04-11 19:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-04-11 19:03 . 2010-04-11 19:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-11 18:00 . 2010-04-11 18:00 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-11 17:57 . 2010-04-11 17:57 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-04-11 17:56 . 2010-04-11 17:56 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
2010-04-11 16:31 . 2010-04-11 16:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-04-11 16:16 . 2010-04-11 16:16 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\Threat Expert
2010-04-11 16:09 . 2010-02-02 14:13 59664 --s---w- c:\windows\system32\drivers\TfSysMon.sys
2010-04-11 16:09 . 2010-02-02 14:13 51984 --s---w- c:\windows\system32\drivers\TfFsMon.sys
2010-04-11 16:09 . 2010-02-02 14:13 33552 --s---w- c:\windows\system32\drivers\TfNetMon.sys
2010-04-11 15:16 . 2010-04-11 15:16 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-04-11 15:16 . 2010-04-11 15:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\BroadSoft
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\LogMeIn
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ATI
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI
2010-04-11 15:13 . 2010-04-11 15:13 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-04-11 13:00 . 2010-04-11 14:03 -------- d-----w- c:\program files\Windows Live Safety Center
2010-04-11 05:23 . 2009-06-18 16:55 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys
2010-04-11 04:55 . 2010-04-11 04:55 -------- d-----w- c:\program files\Sophos
2010-04-11 04:41 . 2010-04-11 20:53 -------- d-----w- c:\windows\system32\CatRoot2
2010-04-11 00:39 . 2010-04-11 00:39 0 ----a-w- c:\windows\nsreg.dat
2010-04-11 00:39 . 2010-04-11 00:39 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\Mozilla
2010-04-10 23:17 . 2010-04-10 23:17 -------- d-----w- c:\program files\Windows Defender
2010-04-10 23:10 . 2010-04-10 23:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-10 22:45 . 2010-04-11 05:59 -------- dc-h--w- c:\windows\ie8
2010-04-10 15:36 . 2010-04-11 15:58 -------- d-----w- c:\windows\LMIC.tmp
2010-04-10 15:29 . 2010-04-10 15:29 -------- d-----w- c:\documents and settings\tgettmann\Local Settings\Application Data\ICS
2010-04-10 15:29 . 2010-04-10 20:03 -------- d-----w- c:\windows\LMIE0.tmp
2010-04-10 14:36 . 2010-04-10 14:36 52224 ----a-w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-10 14:36 . 2010-04-10 14:36 117760 ----a-w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-10 14:36 . 2010-04-10 14:36 -------- d-----w- c:\documents and settings\tgettmann\Application Data\SUPERAntiSpyware.com
2010-04-09 19:25 . 2010-04-09 19:25 388096 ----a-r- c:\documents and settings\tgettmann\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-09 18:44 . 2010-04-09 18:44 -------- d-----w- c:\documents and settings\tgettmann\Application Data\ElevatedDiagnostics
2010-04-09 15:21 . 2010-04-09 15:21 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-09 14:15 . 2010-04-09 14:15 -------- d-----w- c:\documents and settings\tgettmann\Application Data\Malwarebytes
2010-04-09 14:14 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-09 14:14 . 2010-04-09 15:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-09 14:14 . 2010-04-09 14:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-09 14:14 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-09 13:57 . 2008-04-14 00:12 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-04-09 13:57 . 2001-08-18 02:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-04-09 13:57 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-04-09 13:57 . 2001-08-18 02:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-04-09 13:57 . 2001-08-18 02:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-04-09 13:56 . 2001-08-18 02:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2010-04-09 13:56 . 2001-08-17 16:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-04-09 13:56 . 2004-08-04 02:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-04-09 13:56 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-04-09 13:56 . 2004-08-04 02:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-04-09 13:56 . 2008-04-14 00:12 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2010-04-09 13:56 . 2008-04-13 18:36 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-04-09 13:56 . 2004-08-04 02:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-04-09 13:56 . 2001-08-17 16:12 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-04-09 13:54 . 2001-08-17 17:28 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2010-04-09 13:53 . 2001-08-17 18:01 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys
2010-04-09 13:52 . 2001-08-18 02:36 24660 ----a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-04-09 13:51 . 2001-08-18 02:36 238592 ----a-w- c:\windows\system32\dllcache\sisgrv.dll
2010-04-09 13:50 . 2001-08-17 18:56 179264 ----a-w- c:\windows\system32\dllcache\s3sav3d.dll
2010-04-09 13:49 . 2008-04-14 00:12 363520 ----a-w- c:\windows\system32\dllcache\psisdecd.dll
2010-04-09 13:48 . 2001-08-18 02:36 116736 ----a-w- c:\windows\system32\dllcache\ovcodec2.dll
2010-04-09 13:47 . 2001-08-17 16:50 13664 ----a-w- c:\windows\system32\dllcache\n9i128.sys
2010-04-09 13:47 . 2001-08-17 18:56 35392 ----a-w- c:\windows\system32\dllcache\n9i128.dll
2010-04-09 13:47 . 2001-08-17 16:11 128000 ----a-w- c:\windows\system32\dllcache\n100325.sys
2010-04-09 13:47 . 2001-08-17 16:11 52255 ----a-w- c:\windows\system32\dllcache\n1000nt5.sys
2010-04-08 19:11 . 2004-08-04 09:00 34304 ----a-w- c:\windows\system32\dllcache\migisol.exe
2010-04-08 19:10 . 2004-08-04 09:00 6144 ----a-w- c:\windows\system32\dllcache\kbd101a.dll
2010-04-08 19:09 . 2001-08-17 17:28 44863 ----a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-04-08 19:08 . 2001-08-17 16:15 455680 ----a-w- c:\windows\system32\dllcache\fus2base.sys
2010-04-08 19:07 . 2001-08-17 16:10 26141 ----a-w- c:\windows\system32\dllcache\el589nd5.sys
2010-04-08 19:06 . 2001-08-17 16:19 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys
2010-04-08 19:05 . 2001-08-17 17:53 7424 ----a-w- c:\windows\system32\dllcache\adicvls.sys
2010-04-08 19:03 . 2010-04-08 19:00 3296 ----a-w- C:\fixshell.bat
2010-04-08 18:13 . 2008-04-14 00:12 171008 ----a-w- c:\windows\system32\dllcache\srsvc.dll
2010-04-08 18:13 . 2008-04-14 00:12 171008 ------w- c:\windows\system32\srsvc.dll
2010-04-08 17:09 . 2010-04-08 17:09 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-03-15 10:57 . 2010-03-15 10:57 0 ----a-w- c:\windows\system32\atiicdxx.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-11 21:02 . 2009-02-04 00:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-11 20:49 . 2010-04-11 16:05 -------- d-----w- c:\program files\Spyware Doctor
2010-04-11 18:00 . 2007-10-18 17:13 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-11 16:57 . 2009-02-04 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
.

((((((((((((((((((((((((((((( SnapShot@2010-04-11_01.57.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 06:19 . 2007-11-07 06:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 10:07 . 2008-07-29 10:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2010-04-11 21:02 . 2010-04-11 21:02 16384 c:\windows\temp\Perflib_Perfdata_62c.dat
+ 2004-08-11 21:12 . 2008-04-14 00:12 32256 c:\windows\system32\wups.dll
+ 2010-04-11 16:05 . 2010-02-05 13:25 70408 c:\windows\system32\drivers\pctplsg.sys
+ 2010-04-11 16:05 . 2009-11-23 17:54 88040 c:\windows\system32\drivers\PCTAppEvent.sys
+ 2007-10-18 17:12 . 2010-04-11 14:14 47632 c:\windows\system32\config\systemprofile\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
+ 2010-04-11 05:59 . 2008-04-14 00:12 93184 c:\windows\ie8\iexplore.exe
+ 2010-04-11 05:59 . 2008-04-14 00:11 38912 c:\windows\ie8\hmmapi.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 07:54 . 2008-07-29 07:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 120320 c:\windows\system32\wuweb.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 112640 c:\windows\system32\wucltui.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 111104 c:\windows\system32\wuauclt.exe
+ 2004-08-11 21:12 . 2008-04-14 00:12 430592 c:\windows\system32\wuapi.dll
+ 2010-04-11 16:05 . 2010-02-05 13:17 233136 c:\windows\system32\drivers\pctgntdi.sys
+ 2010-04-11 16:05 . 2010-03-10 15:36 217032 c:\windows\system32\drivers\PCTCore.sys
+ 2010-04-11 16:05 . 2010-01-22 13:56 149456 c:\windows\SGDetectionTool.dll
+ 2010-04-11 16:05 . 2010-01-22 13:56 165840 c:\windows\PCTBDRes.dll
+ 2010-04-11 16:05 . 2010-04-11 16:05 228352 c:\windows\Installer\64637.msi
+ 2009-10-15 02:32 . 2010-02-06 00:52 464272 c:\windows\Downloaded Program Files\wlscBase.dll
+ 2010-04-11 16:05 . 2010-01-22 13:55 767952 c:\windows\BDTSupport.dll
+ 2009-02-25 11:06 . 2008-07-09 17:08 382840 c:\windows\$hf_mig$\KB967715\update\updspapi.dll
- 2009-02-25 11:06 . 2008-07-09 07:38 382840 c:\windows\$hf_mig$\KB967715\update\updspapi.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 12:05 . 2008-07-29 12:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2004-08-11 21:12 . 2008-04-14 00:12 1135616 c:\windows\system32\wuaueng.dll
+ 2010-04-11 16:05 . 2010-01-22 13:56 1652688 c:\windows\PCTBDCore.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-26 1015808]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-04-11 5650240]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
"NoFavoritesMenu"= 01000000

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-29 00:34 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 01:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 15:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-07-17 17:23 162328 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2007-07-12 20:36 178712 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-07-17 17:23 141848 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 20:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 20:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2006-10-20 21:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-07-17 17:23 137752 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 13:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ThreatFire"=3 (0x3)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"WinDefend"=2 (0x2)
"ose"=3 (0x3)
"idsvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [04/11/2010 12:05 PM 217032]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [04/11/2010 12:09 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [04/11/2010 12:09 PM 59664]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [04/11/2010 12:05 PM 233136]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [02/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [02/17/2010 11:15 AM 66632]
R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [04/11/2010 1:23 AM 18816]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [04/11/2010 12:05 PM 112592]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [08/11/2008 1:41 PM 12856]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/03/2006 7:19 PM 13592]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\5.tmp --> c:\windows\system32\5.tmp [?]
S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [04/11/2010 12:05 PM 70408]
S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [07/24/2008 6:45 PM 12192]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [02/17/2010 11:15 AM 12872]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [04/11/2010 12:05 PM 366840]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [04/11/2010 12:09 PM 33552]
S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?]
S4 LkWebLink;Inter-Tel Collaboration Remote Client;c:\documents and settings\tgettmann\My Documents\Inter-Tel\Collaboration Client 2.0\lkWebLink.exe [09/20/2007 5:10 PM 32768]
.
Contents of the 'Scheduled Tasks' folder

2010-04-11 c:\windows\Tasks\User_Feed_Synchronization-{AFC0CDFF-EFCC-40C9-8F0E-A96F4007D05A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: aig4auto.com\www
Trusted Zone: aigwebrater.com\www
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: travelers.com
Trusted Zone: travelerspc.com
Trusted Zone: windowsupdate.com
FF - ProfilePath - c:\documents and settings\tgettmann\Application Data\Mozilla\Firefox\Profiles\jon9fgt9.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-11 17:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys >>UNKNOWN [0x89B88AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f5fcb8
\Driver\atapi -> atapi.sys @ 0xb9ef1852
\Driver\iaStor -> iaStor.sys @ 0xb9e5ebb8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom NetXtreme 57xx Gigabit Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9ce6bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9cf3a21
SendHandler -> NDIS.sys @ 0xb9cd187b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\5.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\napagent]
"ServiceDll"="%SystemRoot%\System32\qagentrt.old"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(508)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'lsass.exe'(568)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

- - - - - - - > 'explorer.exe'(2912)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\Seiko\slpcap.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2010-04-11 17:10:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-11 21:10
ComboFix2.txt 2010-04-11 02:01
ComboFix3.txt 2010-04-08 18:25

Pre-Run: 142,126,129,152 bytes free
Post-Run: 142,214,348,800 bytes free

- - End Of File - - 501E459A6E9251970DC7AC90236660D0

xactdesign

ASKER

And HitMan pro found no threats

optoma

Just to rule out a rootkit run this other scanner> TDsskiller
http://support.kaspersky.com/viruses/solutions?qid=208280684

Can you access anti virus sites like norton, mc afee?

optoma

Sorry missed that you ran symantec removal tools :(

xactdesign

ASKER

OK I ran TDsskiller and it returned the following:

TDSS rootkit removing tool, Kaspersky Lab, 2010
version 2.2.8.1 Mar 22 2010 10:43:04
Scanning Services ...
Scanning Kernel memory ...
Driver "iaStor" infected by TDSS rootkit!
File "C:\WINDOWS\system32\drivers\iaStor.sys" infected by TDSS rootkit ... will
be cured on next reboot

Completed

Results:
Memory objects infected / cured / cured on reboot: 1 / 0 / 0
Registry objects infected / cured / cured on reboot: 0 / 0 / 0
File objects infected / cured / cured on reboot: 1 / 0 / 1

To finalize removal of infection and avoid loosing of data program will
reboot your PC now.
Close all programs and choose Y to restart or N to continue

I pressed Y and rebooted the PC. Re-ran tdsskiller and got the same result. Rebooted and the same happened a third time. I then logged in using the PCs local admin account and ran it and the same thing happened.

So it looks like I still have something in the iaStor.sys file but how do I remove it if tdsskiller can't?

optoma

Can you remove that drive and slave it in another machine?
If not booting to a live cd like Knoppix will do the following

If so:
Delete iastor.sys from system32\drivers and system32\dllcache
Then copy iastor.sys from host machine into both locations

>Has worked for me before but get an image backup first!

xactdesign

ASKER

I put the drive in an external case. Hooked it up to another XP machine. Deleted the iastor.sys file from the drive and copied one from another machine. Ran a virus scan on the drive, came up clean.

Put it back in the system, booted up. Ran TDSSKiller again and got the same message about iastor.sys being infected.

ASKER CERTIFIED SOLUTION

optoma

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

TrustWise

It sounds like you just need to backup the data and reload the OS. you have been working with some of the best in this field and still don't have a fix. It will save you a lot of time.

xactdesign

ASKER

Trustwise - I am starting to lean in that direction. There are just a lot of programs I have to reinstall on the machine so I am willing to spend anothe 2 hours on it before I pull the plug. I am "one of the best" on the field as well and rarely have to ask questioon but this one is just rediculous. From what I am reading this rootkit is undetectable by pretty much everything out there.

xactdesign

ASKER

Here is the virustotal result: Im not sure what it means but as an FYI the file size is the same. The previous file size was 300K and the file size from the other system is around 830 K.

File iaStor.sys received on 2010.04.04 13:53:51 (UTC)
Current status: finished
Result: 1/42 (2.38%)

Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.04.04 -
AhnLab-V3 5.0.0.2 2010.04.03 -
AntiVir 7.10.6.24 2010.04.03 -
Antiy-AVL 2.0.3.7 2010.04.02 -
Authentium 5.2.0.5 2010.04.04 -
Avast 4.8.1351.0 2010.04.04 -
Avast5 5.0.332.0 2010.04.04 -
AVG 9.0.0.787 2010.04.04 -
BitDefender 7.2 2010.04.04 -
CAT-QuickHeal 10.00 2010.04.03 -
ClamAV 0.96.0.0-git 2010.04.03 -
Comodo 4497 2010.04.04 -
DrWeb 5.0.2.03300 2010.04.04 -
eSafe 7.0.17.0 2010.04.01 -
eTrust-Vet 35.2.7405 2010.04.02 -
F-Prot 4.5.1.85 2010.04.04 -
F-Secure 9.0.15370.0 2010.04.03 -
Fortinet 4.0.14.0 2010.04.04 -
GData 19 2010.04.04 -
Ikarus T3.1.1.80.0 2010.04.04 -
Jiangmin 13.0.900 2010.04.04 -
K7AntiVirus 7.10.1004 2010.03.22 -
Kaspersky 7.0.0.125 2010.04.04 -
McAfee 5937 2010.03.31 -
McAfee+Artemis 5937 2010.03.31 -
McAfee-GW-Edition 6.8.5 2010.04.03 Heuristic.LooksLike.Trojan.Patched.S
Microsoft 1.5605 2010.04.04 -
NOD32 4998 2010.04.04 -
Norman 6.04.10 2010.04.03 -
nProtect 2009.1.8.0 2010.04.04 -
Panda 10.0.2.2 2010.04.04 -
PCTools 7.0.3.5 2010.04.04 -
Prevx 3.0 2010.04.04 -
Rising 22.41.04.05 2010.04.02 -
Sophos 4.52.0 2010.04.04 -
Sunbelt 6136 2010.04.04 -
Symantec 20091.2.0.41 2010.04.04 -
TheHacker 6.5.2.0.252 2010.04.04 -
TrendMicro 9.120.0.1004 2010.04.04 -
VBA32 3.12.12.4 2010.04.02 -
ViRobot 2010.4.3.2259 2010.04.04 -
VirusBuster 5.0.27.0 2010.04.04 -
Additional information
File size: 874240 bytes
MD5 : 309c4d86d989fb1fcf64bd30dc81c51b
SHA1 : 38b6e9d3377719098b415bd1e34080c06a24d96e
SHA256: 90412120b005d5178e27efd09d52005be6ce1965e5cbb59612ead02c5896a8a7
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x3692
timedatestamp.....: 0x434D5EDE (Wed Oct 12 21:07:10 2005)
machinetype.......: 0x14C (Intel I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x414A4 0x41500 6.58 8d7fd7d87581c7f0fdb974b8828df050
.rdata 0x41800 0x1310 0x1380 5.09 a9788d0f740f3affbfcfc3f365e8bb2f
.data 0x42B80 0x8F3FC 0x8F400 0.05 3f9d36e7b15701212a8c2ba9b0431575
INIT 0xD1F80 0xD54 0xD80 5.62 f6ac5570096445e09a182da1cdaa997e
.rsrc 0xD2D00 0x440 0x480 3.17 0c93346b36ae1ec322f290c6dc854527
.reloc 0xD3180 0x250A 0x2580 5.60 f25d77a77c6f9731aa1024ab80c363de
( 2 imports )
> hal.dll: ExReleaseFastMutex, KfReleaseSpinLock, KfAcquireSpinLock, KeGetCurrentIrql, READ_PORT_ULONG, WRITE_PORT_ULONG, WRITE_PORT_BUFFER_ULONG, READ_PORT_BUFFER_ULONG, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR, READ_PORT_UCHAR, KeStallExecutionProcessor, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, ExAcquireFastMutex
> ntoskrnl.exe: memmove, _vsnprintf, KeInsertQueueDpc, MmAllocateNonCachedMemory, KeInitializeSpinLock, KefAcquireSpinLockAtDpcLevel, KefReleaseSpinLockFromDpcLevel, IoInvalidateDeviceRelations, IoFreeWorkItem, IoRequestDeviceEject, IoQueueWorkItem, IoAllocateWorkItem, ExInterlockedPopEntrySList, ExInterlockedPushEntrySList, IofCompleteRequest, IofCallDriver, IoGetDmaAdapter, RtlAnsiStringToUnicodeString, RtlInitAnsiString, ZwCreateKey, swprintf, KeWaitForSingleObject, KeInitializeEvent, IoDisconnectInterrupt, IoGetConfigurationInformation, IoDeleteDevice, ExDeleteNPagedLookasideList, KeCancelTimer, IoFreeIrp, KeLeaveCriticalRegion, KeEnterCriticalRegion, IoDetachDevice, IoDeleteSymbolicLink, IoConnectInterrupt, IoReleaseRemoveLockAndWaitEx, strstr, strncat, sprintf, IoBuildDeviceIoControlRequest, PoSetPowerState, PoRegisterDeviceForIdleDetection, RtlCompareMemory, KeClearEvent, IoInitializeRemoveLockEx, ObfReferenceObject, KeSetTimer, KeBugCheckEx, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, IoAcquireRemoveLockEx, IoReleaseRemoveLockEx, RtlCopyUnicodeString, ObfDereferenceObject, IoGetAttachedDeviceReference, IoAllocateIrp, IoInvalidateDeviceState, strncpy, strncmp, PoRequestPowerIrp, IoFreeMdl, MmProbeAndLockPages, IoAllocateMdl, _local_unwind2, MmMapLockedPagesSpecifyCache, KeBugCheck, KeInitializeDpc, KeInitializeTimer, KeRemoveQueueDpc, KeQuerySystemTime, PsTerminateSystemThread, KeWaitForMultipleObjects, KeSetPriorityThread, ObReferenceObjectByHandle, PsCreateSystemThread, ExInitializeNPagedLookasideList, MmMapIoSpace, ExRegisterCallback, ExCreateCallback, IoReportResourceForDetection, ExUnregisterCallback, MmUnmapIoSpace, RtlCheckRegistryKey, IoAttachDeviceToDeviceStack, IoCreateSymbolicLink, IoCreateDevice, RtlUnicodeStringToInteger, wcsncpy, wcsstr, _wcsupr, IoGetDeviceProperty, ZwCreateDirectoryObject, READ_REGISTER_ULONG, PsGetVersion, _alldiv, PoStartNextPowerIrp, PoCallDriver, _purecall, ExSystemTimeToLocalTime, KeDelayExecutionThread, _except_handler3, RtlCreateRegistryKey, DbgPrint, ZwOpenKey, ZwClose, ZwQueryValueKey, RtlWriteRegistryValue, RtlInitUnicodeString, wcslen, ExAllocatePoolWithTag, RtlAppendUnicodeToString, RtlAppendUnicodeStringToString, RtlQueryRegistryValues, ExFreePoolWithTag, MmGetPhysicalAddress, KeSetEvent, WRITE_REGISTER_ULONG
( 0 exports )

TrID : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 6144:eR1e3k4VhBilrpCEmc5iEAoDDgf6wucAHGJ1DWZGvrgDm:y1lMhBi1pxmcs+DmtucHJ1DWZGvrgq
sigcheck: publisher....: Intel Corporation
copyright....: Copyright(C) Intel Corporation 1994-2005
product......: Intel Matrix Storage Manager driver
description..: Intel Matrix Storage Manager driver
original name: iaStor.sys
internal name: iaStor.sys
file version.: 5.5.0.1035
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned

PEiD : -
RDS : NSRL Reference Data Set

xactdesign

ASKER

Also, I ran the Kaspersky online scanner last night before I went to bed. When I woke up the scanner completed and found nothing. However, the status of the network cable said a cable was unplugged but there was network cable plugged into it. I had to reboot the computer.
Additionally I tried to download Web cureit to that machine and the download kept failing. I was able to download it to another machine with out problems.
I'm wondering if the NIC card is going bad or the infection has done something to the systems network interface.

xactdesign

ASKER

Here is what Web Cureit Found: (quick scan)
Process in memory: C:\WINDOWS\System32\svchost.exe:964;;BackDoor.Tdss.565;Eradicated.;
termdd.sys;C:\WINDOWS\system32\drivers;BackDoor.Tdss.2459;Will be cured after restart.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
termdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;

Performing a full scan with this now.

ullsa001

Try the following:
Open up IE and under Internet Options click on >Connections>Click on LAN settings, and make sure no box is checked there. Normally spyware puts proxy information there. Clear any boxes there and try again.

xactdesign

ASKER

The computer was infect with a TDSS rootkit and Cureit was able to detect and clean the rest of the system from all infections. I can now access all Microsoft Web sites and the computer is running great.

optoma

To be on the safe side can you download a new TdssKiller and run it.
If it detects it again, the system is not clean yet :(

optoma

Hi again,
could you possibly attach Cureit's logfile with those cleansed threats

xactdesign

ASKER

I dont think I am still infected...Why do you think otherwise.
Here is the TDSS Killer:

TDSS rootkit removing tool, Kaspersky Lab, 2010
version 2.2.8.1 Mar 22 2010 10:43:04
Scanning Services ...
Scanning Kernel memory ...
Completed
Results:
Memory objects infected / cured / cured on reboot: 0 / 0 / 0
Registry objects infected / cured / cured on reboot: 0 / 0 / 0
File objects infected / cured / cured on reboot: 0 / 0 / 0
Press any key to continue . . .