# The pipe state is invalid etc etc etc



## SalopHatter (Mar 9, 2011)

Hi there - new on here so hope this makes sense.

For some time I've had problems with my laptop - it's a Fujitsu Siemens running Vista HP and I've got AVG Free, Malwarebytes, SBS&D, Prevx; I use Firefox. Symptoms include: Windows Security Centre randomly turning itself off; unable to connect to the internet at start up and 'connect to' and 'control panel' commands frozen, requiring removal of the battery, start up in safe mode and system restore; odd looking AVG 'threat detected' messages whilst browsing (and Firefox trying to open unsolicited tabs at the same time); everything running really slowly at times; last week Windows unable to find my desktop requiring another safe mode start up and, eventually, start up repair; and now when I try and run Malwarebytes I get "The pipe state is invalid" message. I'm getting the same message trying to run DDS and GMER although i just about managed to get a HJT log (but only after both Notepad and Firefox stopped running at different times in the process). I've pasted it below.

I'm convinced I've got some sort of malware; can anybody offer any help? Thanks a million in anticipation... Kev

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:09:48, on 09/03/2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
C:\Users\Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Kev\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en&source=iglk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SafeOnline BHO - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\Windows\system32\PxSecure.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [recinfo256] c:\RecInfo\RecInfo.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User '?')
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User '?')
O4 - HKUS\S-1-5-21-3255520129-3243831887-3903598575-1000\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - S-1-5-21-3255520129-3243831887-3903598575-1000 Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe (User '?')
O4 - S-1-5-21-3255520129-3243831887-3903598575-1000 Startup: Dropbox.lnk = Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe (User '?')
O4 - Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
O4 - Startup: Dropbox.lnk = Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

--
End of file - 8927 bytes


----------



## SalopHatter (Mar 9, 2011)

Further update from this morning. Couldn't launch Firefox or IE - the IE window opened but froze without connecting and couldn't be closed); went to Control Panel, unable to launch Security Centre (and couldn't close the box once opened); couldn't open Windows Defender; had to do (yet another) system restore (no restore points listed since 25/2/11 - don't know if that's relevant). Once restored I got a message saying Windows Explorer had stopped working; I cancelled it off and I'm now back to my desktop BUT Windows Security Centre is saying that Windows Defender is turned off but when i try turning it on it's saying "The program will not run. The service cannot accept control messages at this time." It's also saying it can't find any anti-virus software on the computer. Also... sounds daft but the 'look' of my taskbar along the bottom of my desktop has changed - slightly thinner font and all a bit smaller than it was.

And finally... also getting a message saying "Host Process for Windows Services stopped working and was closed. A problem caused the application to stop working correctly. Windows will notify you if a solution is available."

Getting to the end of my tether with this... :-(


----------



## dvk01 (Dec 14, 2002)

Run tdss killer from http://support.kaspersky.com/viruses/solutions?qid=208280684

let it cure anything it fnds ( except SPTD.SYS, which should be ignored) & then reboot

post back with its log


----------



## SalopHatter (Mar 9, 2011)

Ok, did that and it re-booted and, miraculously, everything seems fine. Not sure how to get the log..?


----------



## dvk01 (Dec 14, 2002)

By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder.
Logs have names like: UtilityName.Version_Date_Time_log.txt.
E.g. C:\TDSSKiller.2.4.7_23.07.2010_15.31.43_log.txt


----------



## SalopHatter (Mar 9, 2011)

Ah, thanks. Got it - here it is:-

2011/03/10 20:14:15.0994 4688 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/10 20:14:17.0008 4688 ================================================================================
2011/03/10 20:14:17.0008 4688 SystemInfo:
2011/03/10 20:14:17.0008 4688 
2011/03/10 20:14:17.0008 4688 OS Version: 6.0.6000 ServicePack: 0.0
2011/03/10 20:14:17.0008 4688 Product type: Workstation
2011/03/10 20:14:17.0008 4688 ComputerName: HOME-LAPTOP
2011/03/10 20:14:17.0008 4688 UserName: Kev
2011/03/10 20:14:17.0008 4688 Windows directory: C:\Windows
2011/03/10 20:14:17.0008 4688 System windows directory: C:\Windows
2011/03/10 20:14:17.0008 4688 Processor architecture: Intel x86
2011/03/10 20:14:17.0008 4688 Number of processors: 2
2011/03/10 20:14:17.0008 4688 Page size: 0x1000
2011/03/10 20:14:17.0008 4688 Boot type: Normal boot
2011/03/10 20:14:17.0008 4688 ================================================================================
2011/03/10 20:14:17.0928 4688 Initialize success
2011/03/10 20:14:21.0625 3600 ================================================================================
2011/03/10 20:14:21.0625 3600 Scan started
2011/03/10 20:14:21.0625 3600 Mode: Manual; 
2011/03/10 20:14:21.0625 3600 ================================================================================
2011/03/10 20:14:22.0187 3600 ACPI (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys
2011/03/10 20:14:22.0280 3600 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/03/10 20:14:22.0343 3600 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/03/10 20:14:22.0390 3600 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/03/10 20:14:22.0436 3600 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/03/10 20:14:22.0546 3600 AFD (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/03/10 20:14:22.0655 3600 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/03/10 20:14:22.0748 3600 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/10 20:14:22.0795 3600 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/03/10 20:14:22.0858 3600 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/03/10 20:14:22.0904 3600 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/03/10 20:14:22.0951 3600 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/03/10 20:14:23.0014 3600 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/03/10 20:14:23.0092 3600 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/03/10 20:14:23.0138 3600 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/03/10 20:14:23.0201 3600 AsyncMac (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/10 20:14:23.0263 3600 atapi (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys
2011/03/10 20:14:23.0404 3600 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\Windows\System32\Drivers\avgldx86.sys
2011/03/10 20:14:23.0528 3600 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\Windows\System32\Drivers\avgmfx86.sys
2011/03/10 20:14:23.0591 3600 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\Windows\System32\Drivers\avgtdix.sys
2011/03/10 20:14:23.0684 3600 Beep (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/03/10 20:14:23.0872 3600 bowser (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/10 20:14:23.0934 3600 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/10 20:14:23.0996 3600 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/10 20:14:24.0043 3600 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/10 20:14:24.0106 3600 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/10 20:14:24.0168 3600 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/10 20:14:24.0230 3600 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/10 20:14:24.0277 3600 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/10 20:14:24.0371 3600 cdfs (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/10 20:14:24.0418 3600 cdrom (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/10 20:14:24.0511 3600 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/03/10 20:14:24.0589 3600 CLFS (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/03/10 20:14:24.0667 3600 CmBatt (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/03/10 20:14:24.0730 3600 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/03/10 20:14:24.0776 3600 Compbatt (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/03/10 20:14:24.0808 3600 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/03/10 20:14:24.0854 3600 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/03/10 20:14:24.0964 3600 DfsC (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/03/10 20:14:25.0104 3600 disk (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/03/10 20:14:25.0182 3600 drmkaud (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/03/10 20:14:25.0229 3600 DXGKrnl (b95202efd0464d226e7542c1e319c028) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/10 20:14:25.0276 3600 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/10 20:14:25.0354 3600 Ecache (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys
2011/03/10 20:14:25.0447 3600 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/03/10 20:14:25.0541 3600 fastfat (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/03/10 20:14:25.0603 3600 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/10 20:14:25.0666 3600 FileInfo (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/03/10 20:14:25.0712 3600 Filetrace (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/03/10 20:14:25.0759 3600 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/10 20:14:25.0790 3600 FltMgr (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/03/10 20:14:25.0868 3600 Fs_Rec (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/10 20:14:25.0915 3600 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/10 20:14:26.0024 3600 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2011/03/10 20:14:26.0180 3600 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/10 20:14:26.0243 3600 HDAudBus (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/10 20:14:26.0290 3600 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/10 20:14:26.0321 3600 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/03/10 20:14:26.0414 3600 HidUsb (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/10 20:14:26.0446 3600 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/03/10 20:14:26.0524 3600 HTTP (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys
2011/03/10 20:14:26.0586 3600 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/03/10 20:14:26.0680 3600 i8042prt (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/10 20:14:26.0773 3600 iaStor (fd7f9d74c2b35dbda400804a3f5ed5d8) C:\Windows\system32\DRIVERS\iaStor.sys
2011/03/10 20:14:26.0820 3600 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/03/10 20:14:26.0976 3600 igfx (c134e69ce901422d1f2d7ea8d69098fe) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/03/10 20:14:27.0179 3600 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/10 20:14:27.0335 3600 IntcAzAudAddService (89a57c23e9abcd37321457bd51d48a63) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/10 20:14:27.0506 3600 intelide (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys
2011/03/10 20:14:27.0569 3600 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/10 20:14:27.0647 3600 IpFilterDriver (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/10 20:14:27.0725 3600 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/10 20:14:27.0772 3600 IPNAT (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/10 20:14:27.0834 3600 IRENUM (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/03/10 20:14:27.0896 3600 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/03/10 20:14:27.0959 3600 iScsiPrt (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/10 20:14:28.0021 3600 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/10 20:14:28.0052 3600 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/10 20:14:28.0115 3600 JRAID (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/03/10 20:14:28.0193 3600 kbdclass (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/10 20:14:28.0255 3600 kbdhid (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
2011/03/10 20:14:28.0349 3600 KSecDD (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/10 20:14:28.0427 3600 lltdio (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/10 20:14:28.0489 3600 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/10 20:14:28.0536 3600 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/10 20:14:28.0598 3600 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/10 20:14:28.0630 3600 luafv (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/03/10 20:14:28.0676 3600 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/03/10 20:14:28.0739 3600 Modem (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/03/10 20:14:28.0770 3600 monitor (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/10 20:14:28.0817 3600 mouclass (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/10 20:14:28.0864 3600 mouhid (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/10 20:14:28.0895 3600 MountMgr (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/03/10 20:14:28.0957 3600 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/03/10 20:14:29.0020 3600 mpsdrv (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/10 20:14:29.0066 3600 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/10 20:14:29.0113 3600 MRxDAV (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys
2011/03/10 20:14:29.0191 3600 mrxsmb (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/10 20:14:29.0238 3600 mrxsmb10 (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/10 20:14:29.0285 3600 mrxsmb20 (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/10 20:14:29.0378 3600 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/03/10 20:14:29.0410 3600 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/03/10 20:14:29.0488 3600 Msfs (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/03/10 20:14:29.0566 3600 msisadrv (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys
2011/03/10 20:14:29.0628 3600 MSKSSRV (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/10 20:14:29.0675 3600 MSPCLOCK (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/10 20:14:29.0737 3600 MSPQM (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/03/10 20:14:29.0768 3600 MsRPC (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/03/10 20:14:29.0846 3600 mssmbios (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/10 20:14:29.0909 3600 MSTEE (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/03/10 20:14:29.0956 3600 Mup (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/03/10 20:14:30.0080 3600 NativeWifiP (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/10 20:14:30.0143 3600 NDIS (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys
2011/03/10 20:14:30.0174 3600 NdisTapi (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/10 20:14:30.0221 3600 Ndisuio (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/10 20:14:30.0283 3600 NdisWan (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/10 20:14:30.0330 3600 NDProxy (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/03/10 20:14:30.0392 3600 NetBIOS (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/10 20:14:30.0424 3600 netbt (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/10 20:14:30.0595 3600 NETw3v32 (a15f219208843a5a210c8cb391384453) C:\Windows\system32\DRIVERS\NETw3v32.sys
2011/03/10 20:14:30.0860 3600 NETw4v32 (1d73499a6664b4da05d750ff83fdb274) C:\Windows\system32\DRIVERS\NETw4v32.sys
2011/03/10 20:14:31.0032 3600 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/10 20:14:31.0157 3600 Npfs (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/03/10 20:14:31.0204 3600 nsiproxy (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/10 20:14:31.0313 3600 Ntfs (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys
2011/03/10 20:14:31.0375 3600 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/10 20:14:31.0422 3600 Null (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/03/10 20:14:31.0469 3600 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/03/10 20:14:31.0531 3600 nvrd32 (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/03/10 20:14:31.0578 3600 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/03/10 20:14:31.0609 3600 nvstor32 (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/03/10 20:14:31.0656 3600 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/03/10 20:14:31.0765 3600 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/03/10 20:14:31.0812 3600 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/03/10 20:14:31.0874 3600 partmgr (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/03/10 20:14:31.0921 3600 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/03/10 20:14:31.0968 3600 pci (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys
2011/03/10 20:14:32.0015 3600 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/03/10 20:14:32.0062 3600 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/03/10 20:14:32.0140 3600 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/10 20:14:32.0327 3600 PptpMiniport (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/10 20:14:32.0374 3600 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/03/10 20:14:32.0467 3600 PSched (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/10 20:14:32.0545 3600 pxkbf (0c738845c7c12c45f05b127edff2cc87) C:\Windows\system32\drivers\pxkbf.sys
2011/03/10 20:14:32.0576 3600 pxrts (04d1c97a0818f9378eeaa793a09f8202) C:\Windows\system32\drivers\pxrts.sys
2011/03/10 20:14:32.0654 3600 pxscan (e6e1f9f717feab3e16c3b160b17e6855) C:\Windows\system32\drivers\pxscan.sys
2011/03/10 20:14:32.0732 3600 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/03/10 20:14:32.0826 3600 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/10 20:14:32.0873 3600 QWAVEdrv (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/10 20:14:32.0920 3600 RasAcd (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/10 20:14:32.0966 3600 Rasl2tp (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/10 20:14:33.0029 3600 RasPppoe (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/10 20:14:33.0076 3600 rdbss (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/10 20:14:33.0107 3600 RDPCDD (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/10 20:14:33.0169 3600 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/03/10 20:14:33.0200 3600 RDPENCDD (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/10 20:14:33.0263 3600 RDPWD (e2afac98fc6ca2ad2d09f2de1bc71ad9) C:\Windows\system32\drivers\RDPWD.sys
2011/03/10 20:14:33.0341 3600 rspndr (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/10 20:14:33.0403 3600 RTL8169 (904fd29ec1ff2709099ae2cd1c09a913) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/10 20:14:33.0450 3600 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/10 20:14:33.0544 3600 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/10 20:14:33.0590 3600 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/03/10 20:14:33.0637 3600 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/03/10 20:14:33.0700 3600 sermouse (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys
2011/03/10 20:14:33.0762 3600 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/03/10 20:14:33.0793 3600 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/10 20:14:33.0840 3600 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/10 20:14:33.0871 3600 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/03/10 20:14:33.0949 3600 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/03/10 20:14:33.0996 3600 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/03/10 20:14:34.0058 3600 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/03/10 20:14:34.0121 3600 Smb (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys
2011/03/10 20:14:34.0214 3600 smserial (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\Windows\system32\DRIVERS\smserial.sys
2011/03/10 20:14:34.0292 3600 spldr (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/03/10 20:14:34.0370 3600 srv (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys
2011/03/10 20:14:34.0464 3600 srv2 (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/10 20:14:34.0526 3600 srvnet (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/10 20:14:34.0573 3600 swenum (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/10 20:14:34.0636 3600 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/10 20:14:34.0651 3600 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/10 20:14:34.0698 3600 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/10 20:14:34.0807 3600 Tcpip (2c1f7005aa3b62721bfdb307bd5f5010) C:\Windows\system32\drivers\tcpip.sys
2011/03/10 20:14:34.0885 3600 Tcpip6 (2c1f7005aa3b62721bfdb307bd5f5010) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/10 20:14:34.0932 3600 tcpipreg (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/10 20:14:34.0979 3600 TDPIPE (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/03/10 20:14:35.0026 3600 TDTCP (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/03/10 20:14:35.0088 3600 tdx (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/10 20:14:35.0150 3600 TermDD (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/10 20:14:35.0260 3600 tssecsrv (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/10 20:14:35.0369 3600 tunmp (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/10 20:14:35.0400 3600 tunnel (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/10 20:14:35.0447 3600 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/03/10 20:14:35.0509 3600 udfs (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/10 20:14:35.0587 3600 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/10 20:14:35.0634 3600 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/03/10 20:14:35.0681 3600 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/10 20:14:35.0712 3600 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/10 20:14:35.0774 3600 umbus (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/10 20:14:35.0868 3600 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\Windows\system32\Drivers\usbaapl.sys
2011/03/10 20:14:35.0930 3600 usbccgp (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/10 20:14:35.0977 3600 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/10 20:14:36.0055 3600 usbehci (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/10 20:14:36.0102 3600 usbhub (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/10 20:14:36.0164 3600 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/03/10 20:14:36.0227 3600 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/10 20:14:36.0305 3600 usbscan (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/10 20:14:36.0398 3600 USBSTOR (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/10 20:14:36.0445 3600 usbuhci (7747b902f6b7d0096f9c2bf55d3247f1) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/10 20:14:36.0508 3600 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/10 20:14:36.0539 3600 VgaSave (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/03/10 20:14:36.0586 3600 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/03/10 20:14:36.0632 3600 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/03/10 20:14:36.0664 3600 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/03/10 20:14:36.0710 3600 viamraid (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/03/10 20:14:36.0773 3600 volmgr (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys
2011/03/10 20:14:36.0820 3600 volmgrx (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/03/10 20:14:36.0913 3600 volsnap (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys
2011/03/10 20:14:36.0960 3600 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/03/10 20:14:37.0054 3600 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/10 20:14:37.0100 3600 Wanarp (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/10 20:14:37.0147 3600 Wanarpv6 (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/10 20:14:37.0194 3600 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/03/10 20:14:37.0272 3600 Wdf01000 (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/10 20:14:37.0428 3600 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/03/10 20:14:37.0537 3600 WpdUsb (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/10 20:14:37.0584 3600 ws2ifsl (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/10 20:14:37.0646 3600 WUDFRd (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/10 20:14:37.0724 3600 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/03/10 20:14:37.0740 3600 ================================================================================
2011/03/10 20:14:37.0740 3600 Scan finished
2011/03/10 20:14:37.0740 3600 ================================================================================
2011/03/10 20:14:37.0756 4372 Detected object count: 1
2011/03/10 21:05:12.0073 4372 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/03/10 21:05:12.0073 4372 \HardDisk0 - ok
2011/03/10 21:05:12.0120 4372 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure 
2011/03/10 21:05:20.0793 3728 Deinitialize success


----------



## dvk01 (Dec 14, 2002)

That fixed a TDSS rootkit, that often downloads & installs loads of other crap, most of which is not all won't show in a HJT log

Download to Desktop: DDS by sUBs from one of these locations:

http://download.bleepingcomputer.com/sUBs/dds.com
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

double click DDS.scr to run

When complete, DDS.txt will open.

Save both reports to your desktop.
DDS.txt
Attach.txt

post the contents of both logs back here.


----------



## SalopHatter (Mar 9, 2011)

.
DDS (Ver_11-03-05.01) - NTFSx86 
Run by Kev at 19:24:05.54 on 11/03/2011
Internet Explorer: 8.0.6001.18904
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2038.855 [GMT 0:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Prevx\prevx.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Kev\Desktop\dds.com
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.co.uk/ig?hl=en&source=iglk
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SafeOnline BHO: {69d72956-317c-44bd-b369-8e44d4ef9801} - c:\windows\system32\PxSecure.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search

helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft

shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [recinfo256] c:\recinfo\RecInfo.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\users\kev\appdata\roaming\micros~1\windows\startm~1\programs\startup\bbcipl~1.lnk - c:\program files\bbc iplayer

desktop\BBC iPlayer Desktop.exe
StartupFolder: c:\users\kev\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk -

c:\users\kev\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common

files\adobe\calibration\Adobe Gamma Loader.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11

\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search &

destroy\SDHelper.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\kev\appdata\roaming\mozilla\firefox\profiles\5l15wpon.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ig?hl=en
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\users\kev\appdata\roaming\mozilla\firefox\profiles\5l15wpon.default\extensions\{3112ca9c-de6d-4884-a869-

9855de68056c}\components\frozen.dll
FF - component: c:\users\kev\appdata\roaming\mozilla\firefox\profiles\5l15wpon.default\extensions\{3112ca9c-de6d-4884-a869-

9855de68056c}\components\googletoolbar-ff3.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-

3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-

9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-

46ed-80e3-08825760534b}
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg8\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5

\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2010-8-25 32008]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-25 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-25 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-25 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-25 297752]
R2 CSIScanner;CSIScanner;c:\program files\prevx\prevx.exe [2010-8-25 6416120]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2010-8-25 76696]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2010-8-25 26096]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664]
.
=============== Created Last 30 ================
.
2011-03-11 00:47:09 5943120 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{0c2dcce4-468a-49ff-b66c

-8c06f52e1825}\mpengine.dll
2011-03-05 19:10:18 -------- d-----w- c:\program files\BBC iPlayer Desktop(9)
2011-02-27 21:42:21 -------- d-----w- c:\program files\iPod(155)
2011-02-27 21:42:10 -------- d-----w- c:\program files\iTunes(156)
2011-02-27 21:37:55 -------- d-----w- c:\program files\Bonjour(9)
2011-02-27 21:26:18 -------- d-----w- c:\program files\QuickTime(165)
2011-02-27 08:19:56 -------- d-----w- c:\progra~2\pEjDmIh06300
2011-02-13 11:08:46 -------- d-----w- c:\progra~2\MFAData
.
==================== Find3M ====================
.
2011-02-13 09:51:55 71880 ----a-w- c:\windows\system32\PxSecure.dll
2011-02-02 17:11:20 222080 ------w- c:\windows\system32\MpSigStub.exe
.
============= FINISH: 19:25:18.72 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft® Windows Vista™ Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 16/03/2008 00:39:12
System Uptime: 11/03/2011 07:03:08 (12 hours ago)
.
Motherboard: FUJITSU SIEMENS | | F43 
Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1333/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 91 GiB total, 20.981 GiB free.
D: is FIXED (NTFS) - 46 GiB total, 45.539 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP677: 01/02/2011 15:43:25 - Windows Update
RP678: 04/02/2011 21:00:51 - Windows Update
RP679: 09/02/2011 00:19:25 - Windows Update
RP680: 11/02/2011 09:30:08 - Windows Update
RP681: 12/02/2011 14:18:03 - Windows Update
RP682: 15/02/2011 22:54:21 - Windows Update
RP683: 20/02/2011 01:07:45 - Windows Update
RP684: 22/02/2011 10:10:37 - Windows Update
RP685: 24/02/2011 19:09:14 - Windows Update
RP686: 25/02/2011 18:45:51 - Windows Update
RP690: 10/03/2011 21:43:32 - Scheduled Checkpoint
RP691: 11/03/2011 00:46:32 - Windows Update
RP692: 11/03/2011 03:00:13 - Windows Update
.
==== Installed Programs ======================
.
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Audition 1.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0.1
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Ahead NeroVision Express
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.2.6
AVG 8.5
Avi2Dvd 0.5
AviSynth 2.5
BBC iPlayer Desktop
Bonjour
Cakewalk Professional 7.0
Combined Community Codec Pack 2007-07-22
Comic Life
Compatibility Pack for the 2007 Office system
Dropbox
DVD Shrink 3.2
ffdshow [rev 2844] [2009-03-30]
FirstSteps Diagnostics
GearDrvs
Golden Records Vinyl to CD Converter
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
iTunes
Junk Mail filter update
LAME v3.98.2 for Audacity
Malwarebytes' Anti-Malware
MediaCoder 0.7.1.4475
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Live Add-in 1.5
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Motorola SM56 Data Fax Modem
Mozilla Firefox (3.6.13)
MSVCRT
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NUMBERSHARK 3
OGA Notifier 2.0.0048.0
Prevx
Prism Video Converter
QuickTime
Realtek High Definition Audio Driver
Sonic Foundry SoundForge v4.5
Spotify
Spybot - Search & Destroy
Switch Sound File Converter
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Movie Maker 2.6
Xvid 1.2.1 final uninstall
Yahoo! Toolbar
Zoom ADSL Modem
.
==== Event Viewer Messages From Past Week ========
.
10/03/2011 19:21:31, Error: EventLog [6008] - The previous system shutdown at 19:19:39 on

10/03/2011 was unexpected.
10/03/2011 10:02:14, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "230"

attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-

4291-83B6-3328366B9097}
10/03/2011 09:42:04, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has

encountered an error trying to load signatures and will attempt reverting back to a known-good set of

signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error

description: The program can't find definition files that help detect unwanted software. Check for

updates to the definition files, and then try again. For information on installing updates, see Help and

Support. Signatures loading: Backup Loading signature version: 1.97.2292.0

Loading engine version: 1.1.6502.0
10/03/2011 09:35:15, Error: EventLog [6008] - The previous system shutdown at 09:33:54 on

10/03/2011 was unexpected.
10/03/2011 09:28:16, Error: EventLog [6008] - The previous system shutdown at 09:26:37 on

10/03/2011 was unexpected.
09/03/2011 23:24:54, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered}

Registry hive (file): '\??\C:\Users\Kev\AppData\Local\Microsoft\Windows\UsrClass.dat' was

corrupted and it has been recovered. Some data might have been lost.
09/03/2011 23:24:39, Error: EventLog [6008] - The previous system shutdown at 23:23:24 on

09/03/2011 was unexpected.
09/03/2011 11:09:05, Error: Service Control Manager [7031] - The CSIScanner service terminated

unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000

milliseconds: Restart the service.
07/03/2011 21:40:02, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered

on the interface with IP address 10.0.0.8. The computer with the IP address 10.0.0.5 did not allow the

name to be claimed by this computer.
07/03/2011 19:44:30, Error: bowser [8003] - The master browser has received a server

announcement from the computer MOORE-PC that believes that it is the master browser for the domain

on transport NetBT_Tcpip_{D039210B-81E5-4AE2-96D0-2AB20E55C. The master browser is stopping

or an election is being forced.
07/03/2011 19:34:25, Error: bowser [8003] - The master browser has received a server

announcement from the computer IMAC that believes that it is the master browser for the domain on

transport NetBT_Tcpip_{D039210B-81E5-4AE2-96D0-2AB20E55C59A}. The master browser is

stopping or an election is being forced.
06/03/2011 17:29:08, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease

192.168.0.7 for the Network Card with network address 001CBF55D4BE has been denied by the DHCP

server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
06/03/2011 17:28:33, Error: ACPI [13] - : The embedded controller (EC) did not respond within the

specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that

the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an

upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
05/03/2011 19:19:02, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "230"

attempting to start the service wercplsupport with arguments "" in order to run the server: {0E9A7BB5

-F699-4D66-8A47-B919F5B6A1DB}
05/03/2011 19:06:49, Error: Service Control Manager [7022] - The Server service hung on starting.
05/03/2011 19:06:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was

reached while waiting for a transaction response from the Winmgmt service.
05/03/2011 19:06:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was

reached while waiting for a transaction response from the seclogon service.
05/03/2011 19:06:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was

reached while waiting for a transaction response from the IKEEXT service.
05/03/2011 19:06:49, Error: Service Control Manager [7001] - The Security Center service depends

on the Windows Management Instrumentation service which failed to start because of the following

error: The service did not respond to the start or control request in a timely fashion.
05/03/2011 19:06:49, Error: Service Control Manager [7001] - The SBSD Security Center Service

service depends on the Security Center service which failed to start because of the following error: The

dependency service or group failed to start.
05/03/2011 19:06:49, Error: Service Control Manager [7001] - The IP Helper service depends on the

Windows Management Instrumentation service which failed to start because of the following error: The

service did not respond to the start or control request in a timely fashion.
05/03/2011 19:06:49, Error: Service Control Manager [7001] - The Computer Browser service

depends on the Server service which failed to start because of the following error: After starting, the

service hung in a start-pending state.
05/03/2011 19:06:49, Error: Service Control Manager [7000] - The Secondary Logon service failed to

start due to the following error: The service did not respond to the start or control request in a timely

fashion.
05/03/2011 19:06:49, Error: Service Control Manager [7000] - The IKE and AuthIP IPsec Keying

Modules service failed to start due to the following error: The service did not respond to the start or

control request in a timely fashion.
05/03/2011 18:49:29, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has

encountered an error trying to load signatures and will attempt reverting back to a known-good set of

signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error

description: The program can't find definition files that help detect unwanted software. Check for

updates to the definition files, and then try again. For information on installing updates, see Help and

Support. Signatures loading: Backup Loading signature version: 1.97.2292.0

Loading engine version: 1.1.6502.0
05/03/2011 18:38:17, Error: EventLog [6008] - The previous system shutdown at 18:37:05 on

05/03/2011 was unexpected.
05/03/2011 18:33:15, Error: EventLog [6008] - The previous system shutdown at 18:31:14 on

05/03/2011 was unexpected.
05/03/2011 18:25:52, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has

encountered an error trying to load signatures and will attempt reverting back to a known-good set of

signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error

description: The program can't find definition files that help detect unwanted software. Check for

updates to the definition files, and then try again. For information on installing updates, see Help and

Support. Signatures loading: Backup Loading signature version: 1.97.2292.0

Loading engine version: 1.1.6502.0
05/03/2011 18:25:50, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease

192.168.2.8 for the Network Card with network address 001CBF55D4BE has been denied by the DHCP

server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
05/03/2011 18:13:44, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.8

for the Network Card with network address 001CBF55D4BE has been denied by the DHCP server

192.168.0.1 (The DHCP Server sent a DHCPNACK message).
05/03/2011 11:22:07, Error: EventLog [6008] - The previous system shutdown at 11:20:04 on

05/03/2011 was unexpected.
05/03/2011 11:08:24, Error: EventLog [6008] - The previous system shutdown at 11:06:40 on

05/03/2011 was unexpected.
05/03/2011 11:04:02, Error: EventLog [6008] - The previous system shutdown at 11:01:21 on

05/03/2011 was unexpected.
05/03/2011 10:31:54, Error: EventLog [6008] - The previous system shutdown at 10:29:59 on

05/03/2011 was unexpected.
05/03/2011 10:13:20, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has

encountered an error trying to load signatures and will attempt reverting back to a known-good set of

signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error

description: The program can't find definition files that help detect unwanted software. Check for

updates to the definition files, and then try again. For information on installing updates, see Help and

Support. Signatures loading: Backup Loading signature version: 1.97.2292.0

Loading engine version: 1.1.6502.0
05/03/2011 10:13:20, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease

192.168.2.8 for the Network Card with network address 001CBF55D4BE has been denied by the DHCP

server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
05/03/2011 10:13:19, Error: Print [19] - The print spooler failed to share printer Epson Stylus CX6400

(M) with shared resource name Epson Stylus CX6400 (M). Error 2114. The printer cannot be used by

others on the network.
05/03/2011 10:13:19, Error: Print [19] - The print spooler failed to share printer \\Imac\EPSON

Stylus CX6400 with shared resource name EPSON Stylus CX6400. Error 2114. The printer cannot be

used by others on the network.
05/03/2011 10:06:46, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084"

attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-

01A1-40AA-86AC-DB1CBF673334}
05/03/2011 10:06:00, Error: Service Control Manager [7026] - The following boot-start or system-

start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX DfsC NetBIOS netbt nsiproxy PSched

RasAcd rdbss Smb spldr Tcpip tdx Wanarpv6
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Workstation service depends on

the Network Store Interface Service service which failed to start because of the following error: The

dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver

service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the

following error: A device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The WebClient service depends on the

WebDav Client Redirector Driver service which failed to start because of the following error: The

dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility

service depends on the TCP/IP Protocol Driver service which failed to start because of the following

error: A device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service

depends on the Ancilliary Function Driver for Winsock service which failed to start because of the

following error: A device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and

Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because

of the following error: A device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service

depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the

following error: The dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service

depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the

following error: The dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Network Store Interface Service

service depends on the NSI proxy service service which failed to start because of the following error: A

device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Network Location Awareness

service depends on the TCP/IP Protocol Driver service which failed to start because of the following

error: A device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Network List Service service

depends on the Network Location Awareness service which failed to start because of the following

error: The dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The IP Helper service depends on the

Network Store Interface Service service which failed to start because of the following error: The

dependency service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The DNS Client service depends on the

NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device

attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The DHCP Client service depends on

the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A

device attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Computer Browser service

depends on the Server service which failed to start because of the following error: The dependency

service or group failed to start.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Bonjour Service service depends

on the TCP/IP Protocol Driver service which failed to start because of the following error: A device

attached to the system is not functioning.
05/03/2011 10:06:00, Error: Service Control Manager [7001] - The Apple Mobile Device service

depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A

device attached to the system is not functioning.
05/03/2011 10:05:45, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084"

attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-

F52A-11D8-B9A5-505054503030}
05/03/2011 10:05:11, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068"

attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-

C419-11D9-A5B4-001185AD2B89}
05/03/2011 10:05:11, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068"

attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166

-11D1-B1D0-00805FC1270E}
05/03/2011 10:05:11, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068"

attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A

-4927-A040-7C35AD3180EF}
05/03/2011 10:05:09, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084"

attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-

5536-11D1-B726-00C04FB926AF}
05/03/2011 10:05:01, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084"

attempting to start the service ShellHWDetection with arguments "" in order to run the server:

{DD522ACC-F821-461A-A407-50B198B896DC}
05/03/2011 10:04:37, Error: EventLog [6008] - The previous system shutdown at 10:02:37 on

05/03/2011 was unexpected.
.
==== End Of File ===========================


----------



## dvk01 (Dec 14, 2002)

uninstall AVG
reboot 
Delete any existing version of ComboFix you have sitting on your desktop
*Please read and follow all these instructions very carefully*​* Do not edit or remove any information or user names etc, otherwise we cannot fix the problem. If you insist on editing out anything then I will close the topic & refuse to offer any help.  *

Download ComboFix from *Here* or * Here*to your Desktop.
*As you download it rename it to username123.exe*

***Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer***
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


*Very Important!* *Temporarily disable* your *anti-virus* and *anti-malware* real-time protection and any *script blocking components of them or your firewall*_* before* _performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results" or stop combofix running at all_
Click on *THIS LINK * to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re enable the protection again after combofix has finished*
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running 
Double click on *combofix.exe* & follow the prompts.​If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. 
Please post the *"C:\ComboFix.txt" * for further review

*****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze *****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read  HERE  why we disable autoruns

*Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version. *

Please tell us if it has cured the problems or if there are any outstanding issues


----------



## SalopHatter (Mar 9, 2011)

Derek, sorry but struggling to disable both MBAM and SBS&D. Also - do I need to exit both Windows Defender and turn the Windows firewall off..??


----------



## dvk01 (Dec 14, 2002)

no need for MBAM or SAS or Windows defender or firewall to be disabled


----------



## SalopHatter (Mar 9, 2011)

ComboFix 11-03-10.04 - Kev 11/03/2011 20:36:22.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2038.1209 [GMT 0:00]
Running from: c:\users\Kev\Desktop\username123.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\firststeps\FirstSteps.exe
c:\users\Kev\AppData\Roaming\Microsoft\AdjMmsVista.dll
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Anna and the evil hedgehog by Lx.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\I coudn't fit the name in x.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Kung-Fu Nell.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Lucy.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Magical Romance by A x.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Oak Romances 2 by A x.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\Oak Romances.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\The Adventures Of Nell 2 by Anna x.pif
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Recent\The Adventures Of Nell! By Anna x.pif
.
.
((((((((((((((((((((((((( Files Created from 2011-02-11 to 2011-03-11 )))))))))))))))))))))))))))))))
.
.
2011-03-11 20:41 . 2011-03-11 20:41 -------- d-----w- c:\users\Kev\AppData\Local\temp
2011-03-11 00:47 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0C2DCCE4-468A-49FF-B66C-8C06F52E1825}\mpengine.dll
2011-03-05 19:10 . 2011-03-05 19:10 -------- d-----w- c:\program files\BBC iPlayer Desktop(9)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iPod(155)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iTunes(156)
2011-02-27 21:37 . 2011-02-27 21:37 -------- d-----w- c:\program files\Bonjour(9)
2011-02-27 21:26 . 2011-02-27 21:26 -------- d-----w- c:\program files\QuickTime(165)
2011-02-27 08:19 . 2011-02-27 08:19 -------- d-----w- c:\programdata\pEjDmIh06300
2011-02-13 11:08 . 2011-03-10 09:40 -------- d-----w- c:\programdata\MFAData
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-13 09:51 . 2010-08-25 21:16 71880 ----a-w- c:\windows\system32\PxSecure.dll
2011-02-13 09:51 . 2010-08-25 21:16 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-02-13 09:51 . 2010-08-25 21:16 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-02-13 09:51 . 2010-08-25 21:16 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-02-02 17:11 . 2009-10-02 16:38 222080 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-17 1232896]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-04 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-13 4399104]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"recinfo256"="c:\recinfo\RecInfo.exe" [2007-10-23 2764800]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
.
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-6-13 142336]
Dropbox.lnk - c:\users\Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-4-15 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=vpnt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2011-02-13 32008]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2010-11-28 6416120]
S2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-02-13 76696]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-02-13 26096]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-11 c:\windows\Tasks\User_Feed_Synchronization-{AB8ACD97-3DEA-4E96-9E0D-ABB6D5036EF2}.job
- c:\windows\system32\msfeedssync.exe [2010-04-10 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Kev\AppData\Roaming\Mozilla\Firefox\Profiles\5l15wpon.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ig?hl=en
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-11 20:41
Windows 6.0.6000 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-03-11 20:43:47
ComboFix-quarantined-files.txt 2011-03-11 20:43
.
Pre-Run: 22,593,601,536 bytes free
Post-Run: 22,625,746,944 bytes free
.
- - End Of File - - 070957133601C042F103E7966A125F18


----------



## dvk01 (Dec 14, 2002)

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)

*Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished *

Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply .

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *

once that has been done
we need to examine some of the files that combofix has deleted so please do this

can you please go to C:\qoobox & right click the quarantine folder, select send to compressed(zip) folders 
that will make a zipped copy of the quarantine folder
then 
please upload that to http://www.thespykiller.co.uk/index.php?board=1.0 so we can examine the files

Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, When the file is listed in the windows press send to upload the file


----------



## SalopHatter (Mar 9, 2011)

Next combofix report as requested.

ComboFix 11-03-11.02 - Kev 12/03/2011 14:03:11.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2038.1124 [GMT 0:00]
Running from: c:\users\Kev\Desktop\username123.exe
Command switches used :: c:\users\Kev\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\pEjDmIh06300
c:\programdata\pEjDmIh06300\pEjDmIh06300
.
.
((((((((((((((((((((((((( Files Created from 2011-02-12 to 2011-03-12 )))))))))))))))))))))))))))))))
.
.
2011-03-12 14:07 . 2011-03-12 14:07 -------- d-----w- c:\users\Kev\AppData\Local\temp
2011-03-12 14:07 . 2011-03-12 14:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-12 13:22 . 2008-01-02 16:33 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-03-11 22:18 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C910B47D-0D9F-49D5-AC28-5002FF624E17}\mpengine.dll
2011-03-05 19:10 . 2011-03-05 19:10 -------- d-----w- c:\program files\BBC iPlayer Desktop(9)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iPod(155)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iTunes(156)
2011-02-27 21:37 . 2011-02-27 21:37 -------- d-----w- c:\program files\Bonjour(9)
2011-02-27 21:26 . 2011-02-27 21:26 -------- d-----w- c:\program files\QuickTime(165)
2011-02-13 11:08 . 2011-03-10 09:40 -------- d-----w- c:\programdata\MFAData
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-13 09:51 . 2010-08-25 21:16 71880 ----a-w- c:\windows\system32\PxSecure.dll
2011-02-13 09:51 . 2010-08-25 21:16 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-02-13 09:51 . 2010-08-25 21:16 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-02-13 09:51 . 2010-08-25 21:16 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-02-02 17:11 . 2009-10-02 16:38 222080 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-17 1232896]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-04 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-13 4399104]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"recinfo256"="c:\recinfo\RecInfo.exe" [2007-10-23 2764800]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
.
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-6-13 142336]
Dropbox.lnk - c:\users\Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-4-15 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=vpnt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2011-02-13 32008]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2010-11-28 6416120]
S2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-02-13 76696]
S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-02-13 26096]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-11 c:\windows\Tasks\User_Feed_Synchronization-{AB8ACD97-3DEA-4E96-9E0D-ABB6D5036EF2}.job
- c:\windows\system32\msfeedssync.exe [2010-04-10 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Kev\AppData\Roaming\Mozilla\Firefox\Profiles\5l15wpon.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ig?hl=en
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-12 14:07
Windows 6.0.6000 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-03-12 14:10:07
ComboFix-quarantined-files.txt 2011-03-12 14:09
ComboFix2.txt 2011-03-11 20:43
.
Pre-Run: 21,630,468,096 bytes free
Post-Run: 21,605,990,400 bytes free
.
- - End Of File - - 9C87297A05CA8A9FD9D441E003EC6B30


----------



## SalopHatter (Mar 9, 2011)

Also sent quarantine file (zipped) to the spykiller, as requested. 

Really appreciate your help with this - will happily donate to the Hedgehog Rescue Centre (had a really nice walk in Epping Forest only last weekend when staying with friends in Chingford). 

Wil sort out a donation tomorrow.

Kev


----------



## dvk01 (Dec 14, 2002)

I am double checking a couple of the files which might have been removed by mistake, if they are OK we can soon restore them from CF quarantine

but some of the files show traces to other possible malware so

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)

*Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished *

Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply .

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *


----------



## SalopHatter (Mar 9, 2011)

Got the latest CF log but unable to launch either IE or Frirefox - message says "illegal operation attempted on a registry key that has been marked for deletion".


----------



## dvk01 (Dec 14, 2002)

you must reboot and it will all be OK


----------



## SalopHatter (Mar 9, 2011)

ComboFix 11-03-12.01 - Kev 13/03/2011 12:00:00.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2038.989 [GMT 0:00]
Running from: c:\users\Kev\Desktop\username123.exe
Command switches used :: c:\users\Kev\Desktop\CFScript.txt
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-02-13 to 2011-03-13 )))))))))))))))))))))))))))))))
.
.
2011-03-13 12:05 . 2011-03-13 12:05 -------- d-----w- c:\users\Kev\AppData\Local\temp
2011-03-13 12:05 . 2011-03-13 12:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-12 13:22 . 2008-01-02 16:33 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-03-11 22:18 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C910B47D-0D9F-49D5-AC28-5002FF624E17}\mpengine.dll
2011-03-05 19:10 . 2011-03-05 19:10 -------- d-----w- c:\program files\BBC iPlayer Desktop(9)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iPod(155)
2011-02-27 21:42 . 2011-02-27 21:42 -------- d-----w- c:\program files\iTunes(156)
2011-02-27 21:37 . 2011-02-27 21:37 -------- d-----w- c:\program files\Bonjour(9)
2011-02-27 21:26 . 2011-02-27 21:26 -------- d-----w- c:\program files\QuickTime(165)
2011-02-13 11:08 . 2011-03-10 09:40 -------- d-----w- c:\programdata\MFAData
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-13 09:51 . 2010-08-25 21:16 71880 ----a-w- c:\windows\system32\PxSecure.dll
2011-02-13 09:51 . 2010-08-25 21:16 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-02-13 09:51 . 2010-08-25 21:16 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-02-13 09:51 . 2010-08-25 21:16 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-02-02 17:11 . 2009-10-02 16:38 222080 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\Kev\DOCUME~1\ANNA&L~1 ----
.
2011-01-02 22:56 . 2011-01-02 22:56 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\annafb.doc
2010-11-13 21:56 . 2010-11-13 21:56 20992 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Band.doc
2010-11-03 21:35 . 2010-11-03 21:35 200192 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Form-Nice, Not Nice or Weird - Lucy Style!.ppt
2010-10-29 16:24 . 2010-10-29 16:24 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna's attempt at a LR GeeNic story xxxx.doc
2010-10-28 20:05 . 2010-10-29 16:26 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\On The Sea.doc
2010-04-11 15:59 . 2010-04-11 15:59 757760 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\To Lucy your favourite things....ppt
2010-04-08 17:59 . 2010-04-14 08:40 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\I Met Mabel.doc
2010-04-08 17:18 . 2010-04-08 18:01 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Sugar.doc
2010-04-06 19:23 . 2010-04-06 19:23 28160 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Lucy's Party Playlist.doc
2010-04-06 18:20 . 2010-05-12 18:10 43008 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Archie.doc
2010-04-06 18:05 . 2010-04-07 12:07 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Mabel.doc
2010-04-05 19:43 . 2010-04-05 19:43 26112 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Archi could be a best-seller.doc
2010-04-05 18:43 . 2010-04-05 19:42 26112 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\1Archi could be a best-seller.doc
2010-02-13 19:59 . 2010-02-13 19:59 27648 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Z nothin important.doc
2009-12-21 20:12 . 2009-12-21 20:12 1575936 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Alvin and the Chipmunks 2 cast.ppt
2009-12-11 22:19 . 2009-12-11 22:19 122880 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Emotions.ppt
2009-12-11 19:39 . 2009-12-11 19:39 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Opinion, The Bermuda Triangle.doc
2009-12-11 19:30 . 2009-12-11 19:30 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Theories, Bermuda Triangle.doc
2009-12-06 18:20 . 2009-12-06 18:20 116736 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Chore list.ppt
2009-12-04 20:14 . 2009-12-04 20:19 38400 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Happiness.pub
2009-12-03 22:00 . 2009-12-03 22:00 96768 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\LOVE!.ppt
2009-11-30 18:23 . 2009-11-30 19:42 45012992 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Photos.ppt
2009-11-28 16:49 . 2009-11-28 16:49 102400 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Aaron Johnson.ppt
2009-11-26 20:04 . 2009-11-26 20:04 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Tales of the Unexplained.doc
2009-11-25 21:10 . 2009-11-25 21:10 515584 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Creepy.ppt
2009-11-25 19:05 . 2009-11-25 19:31 339456 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Christmas Party Invite!.ppt
2009-11-25 16:30 . 2009-11-25 16:30 1701376 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Look at them now!.ppt
2009-11-24 15:42 . 2009-11-24 15:42 20480 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Mesmerised.doc
2009-11-24 14:16 . 2009-11-24 14:16 20992 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Shining Review.doc
2009-11-23 15:47 . 2009-11-23 19:06 31744 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Nice and Clean.doc
2009-11-23 13:35 . 2009-11-23 13:35 26624 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Serendipity.doc
2009-11-23 12:06 . 2009-11-23 12:06 10157568 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\To Nanny and Grampy.ppt
2009-11-22 18:51 . 2009-11-22 18:51 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Brain teasers.doc
2009-11-22 17:10 . 2009-11-22 17:10 154624 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\To Mummy, Daddy and Lucy.ppt
2009-11-22 16:10 . 2009-11-22 16:10 231424 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Bermuda Triangle, English HW Project x.doc
2009-11-21 18:15 . 2009-11-21 18:15 123392 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Individual A and L Quiz Team Names.ppt
2009-11-21 17:59 . 2009-11-21 20:54 327680 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna and Lucy Quiz.ppt
2009-11-16 21:18 . 2009-12-15 21:25 28672 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\1 my great story, carry on with it lulu!.doc
2009-11-16 14:51 . 2009-11-16 14:51 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\1 my november tory, carry on with it lulu!.doc
2009-11-07 18:18 . 2009-11-07 18:18 3187200 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Style Do's and Don'ts!.ppt
2009-11-02 22:02 . 2009-11-04 21:35 765952 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Celebrities Looking Different!.ppt
2009-10-20 18:07 . 2009-10-21 21:25 626688 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Art, Lions Peace Poster design images.ppt
2009-10-20 17:35 . 2009-10-20 17:35 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Piracy Independent Study.doc
2009-10-20 17:27 . 2009-10-20 17:27 44544 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\picture to continue soon.ppt
2009-10-19 18:25 . 2009-10-19 18:25 1114112 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Friends.ppt
2009-10-11 12:23 . 2010-10-29 16:32 233984 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\111 my class!!!! Nice or not lucy style!!!.ppt
2009-10-09 17:19 . 2009-10-09 17:19 1172992 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Don't They Look Grown Up!.ppt
2009-09-14 22:20 . 2009-09-14 22:20 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Megan.doc
2009-09-01 19:43 . 2009-09-03 19:47 4606976 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Sunshine Smiles.ppt
2009-09-01 11:53 . 2009-09-01 11:53 142336 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Film Slideshow.ppt
2009-08-29 12:46 . 2009-09-16 16:12 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\1 Sadie.doc
2009-08-29 12:14 . 2009-08-29 12:14 51180040 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Lucy.comicdoc
2009-08-29 11:31 . 2009-08-29 11:32 51999240 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Kung-Fu Nell.comicdoc
2009-08-29 11:01 . 2009-08-29 11:01 7092232 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna and the evil hedgehog by Lx.comicdoc
2009-08-26 16:18 . 2009-08-26 16:18 10256392 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Oak Romances 2 by A x.comicdoc
2009-08-26 15:56 . 2009-08-26 15:56 10906120 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Oak Romances.comicdoc
2009-08-26 15:36 . 2009-08-26 15:36 31931400 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Magical Romance by A x.comicdoc
2009-08-26 13:52 . 2009-08-26 13:52 10110984 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\I coudn't fit the name in x.comicdoc
2009-08-26 13:08 . 2009-08-26 13:08 55526408 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Adventures Of Nell 2 by Anna x.comicdoc
2009-08-24 13:08 . 2009-08-24 13:08 2778632 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The bird of San Fran x.comicdoc
2009-08-24 12:56 . 2009-08-24 12:56 52297736 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Adventures Of Nell! By Anna x.comicdoc
2009-08-24 12:28 . 2009-08-24 12:28 9868808 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Hetty.comicdoc
2009-08-23 20:10 . 2009-08-23 20:10 14848 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna's Presentation.ppt
2009-08-22 23:24 . 2009-08-22 23:24 906240 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Love Music Hate Racsism.ppt
2009-08-18 18:16 . 2009-08-18 18:16 361472 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Films 2.ppt
2009-08-03 15:23 . 2009-08-03 15:23 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Friend Butterfly.doc
2009-07-21 22:57 . 2009-07-21 22:57 20992 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Review of Torn Pages.doc
2009-07-19 16:59 . 2009-07-19 16:59 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Block Busta.doc
2009-07-17 17:27 . 2009-07-17 17:27 2545664 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Feel Good Slideshow.ppt
2009-07-17 17:27 . 2009-07-17 17:27 80896 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Japenese Cherry Tree.ppt
2009-07-16 10:28 . 2009-11-24 16:23 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Book and Film Reviews.doc
2009-06-15 19:33 . 2009-06-18 17:41 103936 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Little Bots Lyrics.ppt
2009-06-14 08:56 . 2009-06-14 08:56 224256 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The shining.ppt
2009-06-11 19:57 . 2009-06-11 19:57 588800 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Celebs by A.ppt
2009-06-10 19:30 . 2009-06-10 19:30 26112 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Arthog Check List.ppt
2009-06-09 20:00 . 2009-06-09 20:00 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Wild Child Phrase.doc
2009-06-09 19:43 . 2009-06-09 20:05 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Julie-O, Mark Summer.doc
2009-06-07 18:01 . 2009-06-09 18:19 2274304 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Feel-Good Slideshow.ppt
2009-05-30 21:59 . 2009-05-30 21:59 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Hi.doc
2009-05-30 12:25 . 2009-05-30 12:25 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Anna that turned pink.doc
2009-05-26 22:14 . 2009-06-10 19:12 119808 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Shake it.ppt
2009-04-23 20:51 . 2009-04-23 20:51 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Helen Moore's Appointment.doc
2009-04-21 19:42 . 2009-04-21 19:42 1092096 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Disaster and Epic Movie.ppt
2009-04-08 16:48 . 2009-04-08 16:48 149504 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Celebrities.ppt
2009-03-26 19:07 . 2009-03-26 19:07 236544 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Guess.ppt
2009-03-25 20:04 . 2009-03-25 20:04 113664 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\History HW.ppt
2009-03-25 20:03 . 2009-03-25 20:03 262656 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Oh My God.ppt
2009-03-25 19:33 . 2009-03-25 19:33 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\L2L Homework.doc
2009-03-08 17:06 . 2009-03-08 17:06 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna's 12th birthday invitation.doc
2009-03-03 19:43 . 2009-03-16 19:22 80384 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Spiralling.ppt
2009-02-27 21:17 . 2009-02-27 21:17 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Review of Ways to Live Forever by Sally Nicholls.doc
2009-02-14 20:50 . 2009-02-14 20:50 68608 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Fruit!.ppt
2009-02-05 20:51 . 2009-02-05 20:51 37888 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Cupcakes!.ppt
2009-02-05 14:00 . 2009-02-05 14:00 15360 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Anna's Top Ten!.ppt
2009-02-05 12:23 . 2009-02-05 12:23 78848 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Films ?.ppt
2009-02-04 11:24 . 2009-02-04 11:24 19968 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\A.doc
2009-02-04 11:13 . 2009-02-04 11:13 24576  ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\12345 Review.doc
2009-02-03 18:42 . 2009-02-03 19:55 117760 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Weather Poems.ppt
2009-01-12 18:38 . 2009-11-19 21:55 642048 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\1.ppt
2009-01-05 14:14 . 2009-01-05 14:14 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Poems by Lucy.doc
2008-12-23 16:52 . 2009-01-12 18:38 8704 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\5 hate 34cy.ppt
2008-12-23 16:44 . 2008-12-23 16:44 42496 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Publication13.pub
2008-12-23 16:43 . 2008-12-23 16:43 41984 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Publication14.pub
2008-12-23 14:07 . 2008-12-23 14:07 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Review of Why The Whales Came by Michael Morpurgo.doc
2008-12-23 12:58 . 2008-12-23 12:58 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Review on The Boy in the Striped Pyjamas.doc
2008-12-14 18:47 . 2008-12-14 18:47 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\nativity characters.doc
2008-12-13 10:55 . 2008-12-13 10:55 46592 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Films.ppt
2008-12-07 20:43 . 2008-12-07 20:43 19968 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\I am sorry Lucy.doc
2008-11-29 17:32 . 2010-04-11 15:44 54272 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Form 2.ppt
2008-11-29 13:54 . 2008-11-29 13:54 9728 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\People in my form 2.ppt
2008-11-29 13:24 . 2008-11-29 13:24 35840 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The ice cream poem.pub
2008-11-29 11:34 . 2008-11-29 11:34 62976 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Publication3.pub
2008-11-29 11:04 . 2008-11-29 11:04 58880 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Crazy Poem by Lucy, It's really good!.pub
2008-11-29 10:54 . 2008-11-29 10:54 20480 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My favourite books and films.doc
2008-11-23 13:37 . 2009-07-16 12:58 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Camp, Anna's Story.doc
2008-11-22 17:05 . 2008-11-22 17:05 20480 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\ROOMS AVAILABLE.doc
2008-11-22 17:05 . 2008-11-22 17:05 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\B+ B.doc
2008-11-22 16:14 . 2008-11-22 16:14 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Pink Pomegranate.doc
2008-11-18 18:06 . 2008-11-19 20:35 279552 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Med homework.pub
2008-11-10 18:08 . 2008-11-10 18:08 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Design Homework.doc
2008-11-04 21:11 . 2008-11-04 21:11 43520 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Family.ppt
2008-11-04 21:07 . 2009-07-25 10:18 306176 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Cupcake the magazine for kids.ppt
2008-11-03 21:10 . 2008-11-03 21:10 386560 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Opal the magazine!.ppt
2008-11-03 20:16 . 2008-11-03 20:16 269824 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Opal.ppt
2008-11-02 16:14 . 2008-11-02 16:14 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\a review of sleepovers by jacqueline Wilson.doc
2008-10-20 18:49 . 2009-06-09 18:22 62464 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\My Form-Nice or Not!!!!!.ppt
2008-10-15 17:58 . 2008-10-15 17:58 86016 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\i'm oddddddddddddd!.pub
2008-10-09 19:14 . 2008-10-09 19:14 61952 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Internet Safety.pub
2008-08-31 14:30 . 2009-03-15 21:04 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\All about ME!!!.ppt
2008-08-21 18:54 . 2008-08-21 18:54 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Rock Collection.doc
2008-08-21 10:25 . 2008-08-21 11:23 34816 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Lyrics to Jilted John.ppt
2008-08-20 21:05 . 2008-08-20 21:05 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Lyrics to Jilted John.doc
2008-08-20 20:48 . 2008-12-23 16:18 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Broken Apple.doc
2008-08-19 20:26 . 2008-08-20 10:20 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Lyrics to black kids song called I'm not gonna teach your boyfriend how to dance.doc
2008-08-19 19:14 . 2008-08-19 19:14 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\story.doc
2008-08-19 16:46 . 2008-08-20 20:48 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Limestone Jelly.doc
2008-08-19 11:12 . 2008-08-19 11:12 28160 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Hide and seek.doc
2008-08-17 20:53 . 2008-08-17 20:53 65024 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Publication2.pub
2008-08-17 20:51 . 2008-08-17 20:51 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Red is like fire.doc
2008-08-17 18:39 . 2008-08-17 18:39 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Ghost Walk.doc
2008-08-17 10:14 . 2008-08-17 10:14 31232 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Presentation1.ppt
2008-08-08 16:47 . 2008-10-09 19:46 169472 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Families.ppt
2008-08-05 15:27 . 2008-08-05 15:27 139776 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Tringle Dingle.ppt
2008-07-28 10:15 . 2008-07-28 10:15 157184 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Unusual.ppt
2008-07-27 19:19 . 2010-11-05 22:01 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Dear Diary.doc
2008-07-25 13:32 . 2008-07-25 13:32 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\my new story.doc
2008-07-25 13:15 . 2008-07-25 13:15 57344 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Beautiful.ppt
2008-07-25 13:14 . 2008-07-25 13:14 144384 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Haiku poems.pub
2008-07-24 21:17 . 2008-07-26 21:48 44544 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Life at war.doc
2008-07-24 20:38 . 2008-10-09 19:45 26624 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Singing Swinging.doc
2008-07-23 23:37 . 2008-07-25 13:15 86016 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Twist.ppt
2008-07-20 15:06 . 2008-07-20 15:14 40448 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Publication1.pub
2008-07-17 23:38 . 2008-07-17 23:38 19968 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Attack.doc
2008-07-17 23:30 . 2008-07-17 23:31 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Treasure hunt.doc
2008-07-15 16:25 . 2008-07-23 17:29 187904 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The world at it's greatest.ppt
2008-07-13 19:46 . 2008-07-13 19:46 153088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Me me me.ppt
2008-07-12 13:08 . 2008-07-12 13:08 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\I will tell you a story.doc
2008-07-04 22:47 . 2008-07-04 22:47 51712 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Coconut Lime.pub
2008-06-29 21:22 . 2009-05-28 19:49 26624 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Get away.doc
2008-06-27 16:40 . 2008-06-27 16:40 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The moon sparkled above Alex.doc
2008-06-24 15:05 . 2008-06-24 15:05 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\cm away=.......doc
2008-06-24 15:04 . 2008-06-24 15:32 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\recorded results.doc
2008-06-21 10:44 . 2008-06-21 10:44 44544 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Patterns.ppt
2008-06-17 20:10 . 2008-06-17 20:10 19968 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\melted ice.doc
2008-05-27 17:47 . 2008-08-09 14:02 584704 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Tiger Lily.ppt
2008-05-25 11:39 . 2010-10-29 16:30 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\A story by me.doc
2008-04-09 22:21 . 2008-07-12 17:53 126464 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\The Anna Files.ppt
2008-04-09 00:10 . 2008-04-09 00:10 24576 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Indie Elephants.doc
2008-04-08 23:52 . 2008-04-08 23:52 25600 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Don't Be Silly, Luce.ppt
2008-04-08 22:12 . 2008-04-12 20:34 27136 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Dancin' + Gangin'.doc
2008-04-08 02:12 . 2009-02-04 16:00 34816 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\'Camp' A REALLY GOOD STORY SO FAR!!!!.doc
2008-04-07 18:35 . 2008-04-07 18:35 131584 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Country.ppt
2008-04-02 22:25 . 2008-06-19 20:38 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Kylie Wow.doc
2008-04-02 22:17 . 2008-04-02 22:17 25088 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Bob.doc
2008-04-02 20:56 . 2008-12-23 13:14 22528 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Email me Jola.doc
2008-03-31 06:25 . 2008-03-31 06:25 30720 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\America.ppt
2008-03-31 06:14 . 2008-03-31 06:14 24064 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Our American Holiday.doc
2008-03-26 18:48 . 2008-03-26 18:48 177152 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Saving The Planet.ppt
2008-03-23 14:18 . 2008-05-25 11:18 3165 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Story.txt
2008-03-16 17:44 . 2008-03-16 17:44 833 ----a-w- c:\users\Kev\DOCUME~1\ANNA&L~1\Poems by Lucy Moore.txt
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-17 1232896]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-04 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-13 4399104]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"recinfo256"="c:\recinfo\RecInfo.exe" [2007-10-23 2764800]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
.
c:\users\Kev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBC iPlayer Desktop.lnk - c:\program files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe [2010-6-13 142336]
Dropbox.lnk - c:\users\Kev\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-4-15 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI1"=vpnt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2011-02-13 32008]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2010-11-28 6416120]
S2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-02-13 76696]
S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-02-13 26096]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 08:09]
.
2011-03-12 c:\windows\Tasks\User_Feed_Synchronization-{AB8ACD97-3DEA-4E96-9E0D-ABB6D5036EF2}.job
- c:\windows\system32\msfeedssync.exe [2010-04-10 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/ig?hl=en&source=iglk
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Kev\AppData\Roaming\Mozilla\Firefox\Profiles\5l15wpon.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ig?hl=en
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-13 12:05
Windows 6.0.6000 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(6016)
c:\users\Kev\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
Completion time: 2011-03-13 12:07:59
ComboFix-quarantined-files.txt 2011-03-13 12:07
ComboFix2.txt 2011-03-12 14:10
ComboFix3.txt 2011-03-11 20:43
.
Pre-Run: 21,409,210,368 bytes free
Post-Run: 21,174,419,456 bytes free
.
- - End Of File - - 0109B5D03DAA2DFBA37E5631DBEB72E3


----------



## dvk01 (Dec 14, 2002)

that looks OK 

the pif files Combofix deleted had references to various file names with a .com extension & they are executable files & normally are viruses

it all looks clear so how it is from your end 

I am just waiting to hear about 2 of the files CF deleted. They look clean to me but we are getting them double checked, so as soon as I hear I will let you know. It might well be tommorow before I get a response though


----------



## SalopHatter (Mar 9, 2011)

It all seems to be ok this end. I'm hugely grateful for your help and look forward to the final all clear tomorrow. Going forward is there anything you'd recommend I should have in terms of overall security? As I said earlier I've got Spybot S&D, MBAM, Prevx and AVG free. Is this sufficient or the wrong combination? Do I need all of it or a different combination or something else all together?

Cheers, Kev


----------



## dvk01 (Dec 14, 2002)

Even though teh files deleted appear clean, they have the potential to be misused so they should stay deleted

your protection looks OK

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
* Click *START* then * RUN*
* Now type *Combofix /Uninstall * in the runbox and click *OK*. Note the *space *between the *X* and the */U*, it needs to be there.









This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here* http://www.thespykiller.co.uk/index.php?page=3 *for info on how to tighten your security settings and how to help prevent future attacks.

and scan here* http://secunia.com/software_inspector/ * for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place


----------



## SalopHatter (Mar 9, 2011)

Things still not right here I'm afraid. Did all I was asked, secunia found 2 adobe and 2 apple products needing updating which i've done. Had a slight problem with Adobe Reader so uninstalled it and rebooted - on start up I can't get past the Windows login - the screen just goes grey (only the mouse pointer showing) and no desktop. Have had to reboot in safe mode to find that security centre isn't running again and will not allow me to turn it on. Am currently doing another system restore back to yesterday evening. 

Also noticed last night that IE wouldn't load and could only be shut down from Task Manager (Firefox was ok). Also Prevx is saying it's found malware which I think is the DDS file (but I'll confirm later once restore is complete - as I type here the laptop is still 'shutting down' in the restore process - and it's been saying that for about 10 minutes now). Also - after uninstalling ComboFix and rebooting last night the file was still showing on the desktop - is that right??

So... help! Kev


----------



## dvk01 (Dec 14, 2002)

I don't think security center works in safe mode
But by the sound of this, you are going to need to restore to factory settings to guarantee a complete cure


----------



## SalopHatter (Mar 9, 2011)

Hi - I've uninstalled all Adobe Flash programmes (Air, reader etc) because I was getting an error message saying that Air was damaged. I'd like to hang on before moving to factory reset and see if this makes a difference. IE is now loading correctly and all seems quiet and working OK. I'll reinstall the adobe stuff later. Should Combofix still be showing on the desktop having uninstalled? Also would you recommend AVG free or MSE..?


----------



## dvk01 (Dec 14, 2002)

try this uninstaller for combofix

http://download.bleepingcomputer.com/sUBs/CF_UNINST.EXE

if everything else is all working then see how it goes
you did have a nasty rootkit & we can never guarantee to fix all the damage that one does

I normally recommend MSE as better than AVG


----------



## SalopHatter (Mar 9, 2011)

Sounds like a plan. Combofix uninstalled, MSE installed. One final question - should I get rid of SB S&D, MBAM and Prevx having got MSE or are they compatible?

Thanks again for all your help with this. Really appreciate it and have been over to the Hedgehog site and made a donation. Who marks the thread 'solved', you or me?!


----------



## dvk01 (Dec 14, 2002)

MBAM is fine
Prevx should be ok but might clash although they say it doesn't
I don't see the need for spybot


----------



## SalopHatter (Mar 9, 2011)

Thanks. Will mark as solved now. Cheers.


----------

