Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Help - infected with Trojan Horse Downloader.Zlob.BAKH
-
02-08-2011 3:19pm#1
Comments
-
-
-
-
-
Thanks - logs from DDS:
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 04/11/2010 19:45:50
System Uptime: 02/08/2011 14:29:26 (3 hours ago)
.
Motherboard: TOSHIBA | | Portable PC
Processor: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz | rPGA988A Socket | 2393/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 298 GiB total, 275.288 GiB free.
is CDROM ()
E: is CDROM (CDFS)
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) 82577LC Gigabit Network Connection
Device ID: PCI\VEN_8086&DEV_10EB&SUBSYS_00011179&REV_06\3&11583659&0&C8
Manufacturer: Intel
Name: Intel(R) 82577LC Gigabit Network Connection
PNP Device ID: PCI\VEN_8086&DEV_10EB&SUBSYS_00011179&REV_06\3&11583659&0&C8
Service: e1kexpress
.
Class GUID: {36FC9E60-C465-11CF-8056-444553540000}
Description:
Device ID: ROOT\USB\0000
Manufacturer:
Name:
PNP Device ID: ROOT\USB\0000
Service:
.
==== System Restore Points ===================
.
RP153: 04/05/2011 18:17:34 - System Checkpoint
RP154: 05/05/2011 02:45:10 - Removed HiJackThis
RP155: 05/05/2011 02:46:27 - Removed Skype Toolbars
RP156: 06/05/2011 15:26:47 - System Checkpoint
RP157: 09/05/2011 03:48:50 - System Checkpoint
RP158: 10/05/2011 14:14:06 - System Checkpoint
RP159: 11/05/2011 14:24:09 - System Checkpoint
RP160: 12/05/2011 03:37:10 - Software Distribution Service 3.0
RP161: 14/05/2011 19:11:27 - System Checkpoint
RP162: 16/05/2011 12:27:39 - System Checkpoint
RP163: 19/05/2011 23:31:41 - System Checkpoint
RP164: 21/05/2011 21:32:47 - System Checkpoint
RP165: 24/05/2011 13:42:45 - System Checkpoint
RP166: 27/05/2011 12:38:16 - System Checkpoint
RP167: 30/05/2011 13:38:29 - System Checkpoint
RP168: 31/05/2011 13:53:43 - System Checkpoint
RP169: 02/06/2011 15:05:11 - System Checkpoint
RP170: 04/06/2011 00:35:03 - System Checkpoint
RP171: 06/06/2011 15:00:01 - System Checkpoint
RP172: 08/06/2011 13:26:13 - System Checkpoint
RP173: 09/06/2011 15:13:47 - System Checkpoint
RP174: 13/06/2011 16:23:11 - System Checkpoint
RP175: 14/06/2011 18:17:20 - System Checkpoint
RP176: 16/06/2011 02:35:36 - Software Distribution Service 3.0
RP177: 17/06/2011 15:03:19 - System Checkpoint
RP178: 18/06/2011 23:43:22 - System Checkpoint
RP179: 20/06/2011 11:13:36 - System Checkpoint
RP180: 21/06/2011 14:51:32 - System Checkpoint
RP181: 22/06/2011 17:15:27 - System Checkpoint
RP182: 27/06/2011 15:09:45 - System Checkpoint
RP183: 28/06/2011 15:24:23 - System Checkpoint
RP184: 29/06/2011 14:55:54 - Software Distribution Service 3.0
RP185: 30/06/2011 20:02:43 - System Checkpoint
RP186: 01/07/2011 20:32:25 - System Checkpoint
RP187: 04/07/2011 01:50:05 - System Checkpoint
RP188: 06/07/2011 01:21:03 - System Checkpoint
RP189: 07/07/2011 14:07:25 - System Checkpoint
RP190: 08/07/2011 15:22:10 - System Checkpoint
RP191: 11/07/2011 13:48:03 - System Checkpoint
RP192: 12/07/2011 14:03:14 - System Checkpoint
RP193: 14/07/2011 04:06:20 - Software Distribution Service 3.0
RP194: 15/07/2011 19:46:49 - System Checkpoint
RP195: 18/07/2011 15:33:11 - System Checkpoint
RP196: 19/07/2011 20:01:00 - System Checkpoint
RP197: 21/07/2011 14:58:18 - System Checkpoint
RP198: 25/07/2011 14:01:12 - System Checkpoint
RP199: 27/07/2011 15:12:14 - System Checkpoint
RP200: 29/07/2011 16:04:31 - System Checkpoint
RP201: 31/07/2011 02:56:39 - System Checkpoint
RP202: 01/08/2011 06:10:01 - System Checkpoint
RP203: 02/08/2011 16:09:27 - System Checkpoint
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.1.0)
Agfa ScanWise 1.60
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AuthenTec TrueSuite
AVG 2011
AVG PC Tuneup 2011
Bluetooth Stack for Windows by Toshiba
Bonjour
Compatibility Pack for the 2007 Office system
GOM Player
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Intel(R) Graphics Media Accelerator Driver
Intel(R) Management Engine Components
Intel(R) Network Connections Drivers
Intel(R) Rapid Storage Technology
iTunes
Java(TM) 6 Update 14
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Office Word Viewer 2003
Microsoft Office XP Standard
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MSVC80_x86
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nokia Connectivity Cable Driver
Nokia PC Internet Access
Nokia PC Suite
O2 Broadband
OGA Notifier 2.0.0048.0
PC Connectivity Solution
Picasa 3
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
RICOH R5U230 Media Driver ver.2.08.03.03
Security Task Manager 1.8c
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Skype™ 5.3
Sophos Anti-Rootkit 1.5.4
Temp File Cleaner
TOSHIBA 180 Degrees Rotation Utility
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Controls
TOSHIBA Direct Disc Writer
TOSHIBA Disc Creator
TOSHIBA Display Devices Change Utility
TOSHIBA DVD PLAYER
TOSHIBA HDD Protection
TOSHIBA HDD/SSD Alert
TOSHIBA Hotkey Utility for Display Devices
TOSHIBA Manuals
TOSHIBA Mobile Extension3
Toshiba Online Product Information
TOSHIBA Password Utility
TOSHIBA PC Diagnostic Tool
TOSHIBA PC Health Monitor
TOSHIBA Power Saver
TOSHIBA Security Assist
TOSHIBA TouchPad On/Off Utility V2.5.1.0
TOSHIBA USB Sleep and Charge Utility
TOSHIBA Utilities
TOSHIBA Web Camera Application
TOSHIBA Zooming Utility
Uninstall for TOSHIBA Mobile Extension3
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Windows Internet Explorer 8 (KB2362765)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB971029)
Update for Windows XP (KB973687)
Vuze
WebFldrs XP
Windows Driver Package - Nokia Modem (03/05/2008 3.7)
Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Internet Explorer 8
Windows Media Format Runtime
Windows Media Player 10
WinRAR archiver
WinZip 15.0
Wireless Hotkey
.
==== Event Viewer Messages From Past Week ========
.
31/07/2011 19:48:07, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
30/07/2011 22:53:31, error: Dhcp [1002] - The IP address lease 89.204.176.147 for the Network Card with network address 001E101F0812 has been denied by the DHCP server 89.204.195.93 (The DHCP Server sent a DHCPNACK message).
30/07/2011 22:05:46, error: Dhcp [1002] - The IP address lease 95.83.202.37 for the Network Card with network address 001E101F051B has been denied by the DHCP server 89.204.176.145 (The DHCP Server sent a DHCPNACK message).
30/07/2011 21:17:16, error: Dhcp [1002] - The IP address lease 62.40.48.52 for the Network Card with network address 001E101F051B has been denied by the DHCP server 95.83.202.38 (The DHCP Server sent a DHCPNACK message).
30/07/2011 19:28:31, error: Dhcp [1002] - The IP address lease 89.204.204.255 for the Network Card with network address 001E101FE948 has been denied by the DHCP server 62.40.48.49 (The DHCP Server sent a DHCPNACK message).
30/07/2011 03:24:04, error: Service Control Manager [7031] - The Expat Shield Service service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
30/07/2011 03:23:50, error: Service Control Manager [7031] - The Expat Shield Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
30/07/2011 03:23:26, error: Service Control Manager [7031] - The Expat Shield Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
30/07/2011 03:23:19, error: Service Control Manager [7031] - The Expat Shield Routing Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
30/07/2011 03:23:12, error: Service Control Manager [7031] - The Expat Shield Routing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
30/07/2011 03:23:09, error: Service Control Manager [7034] - The Expat Shield Monitoring Service service terminated unexpectedly. It has done this 1 time(s).
29/07/2011 16:32:34, error: Dhcp [1002] - The IP address lease 62.40.53.72 for the Network Card with network address 001E101F5224 has been denied by the DHCP server 62.40.51.209 (The DHCP Server sent a DHCPNACK message).
29/07/2011 01:41:48, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: atapi PCIIde
28/07/2011 17:24:59, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
28/07/2011 13:51:24, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
28/07/2011 02:24:12, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.DebugCRT. Reference error message: The referenced assembly is not installed on your system. .
28/07/2011 02:24:12, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll. Reference error message: The operation completed successfully. .
28/07/2011 02:24:12, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.DebugCRT could not be found and Last Error was The referenced assembly is not installed on your system.
27/07/2011 20:32:12, error: Dhcp [1002] - The IP address lease 89.204.183.112 for the Network Card with network address 001E101FCAB6 has been denied by the DHCP server 89.204.203.218 (The DHCP Server sent a DHCPNACK message).
27/07/2011 16:05:27, error: Service Control Manager [7034] - The TrueSuiteService service terminated unexpectedly. It has done this 1 time(s).
02/08/2011 17:01:39, error: Service Control Manager [7011] - Timeout (60000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service.
02/08/2011 16:32:26, error: Dhcp [1002] - The IP address lease 95.83.206.204 for the Network Card with network address 001E101F648E has been denied by the DHCP server 89.204.203.245 (The DHCP Server sent a DHCPNACK message).
02/08/2011 16:26:21, error: Dhcp [1002] - The IP address lease 89.204.180.179 for the Network Card with network address 001E101F648E has been denied by the DHCP server 95.83.206.201 (The DHCP Server sent a DHCPNACK message).
02/08/2011 15:08:31, error: Dhcp [1002] - The IP address lease 62.40.58.220 for the Network Card with network address 001E101F648E has been denied by the DHCP server 89.204.180.177 (The DHCP Server sent a DHCPNACK message).
02/08/2011 14:32:31, error: Dhcp [1002] - The IP address lease 89.204.204.250 for the Network Card with network address 001E101F648E has been denied by the DHCP server 62.40.58.217 (The DHCP Server sent a DHCPNACK message).
02/08/2011 03:18:03, error: Dhcp [1002] - The IP address lease 89.204.198.124 for the Network Card with network address 001E101F62F7 has been denied by the DHCP server 89.204.205.145 (The DHCP Server sent a DHCPNACK message).
01/08/2011 15:58:21, error: Dhcp [1002] - The IP address lease 89.204.199.246 for the Network Card with network address 001E101FEA01 has been denied by the DHCP server 89.204.179.41 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================
.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by John Reynolds at 17:00:36 on 2011-08-02
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2864.1937 [GMT 1:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: McAfee VirusScan *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *Enabled*
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\Program Files\Fingerprint Sensor\atservice.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.exe
C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
C:\Program Files\TOSHIBA\TNRotate\TNRotate.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\thpsrv.exe
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\system32\TPSODDCtl.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\O2\O2 Broadband USB Modem\O2 Broadband\O2 Broadband.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://uk.yahoo.com/
uSearch Page =
uSearch Bar =
mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{ECB77AE7-BDC8-4FF2-8228-099A0D8A1FFC}
uInternet Settings,ProxyOverride = <local>;*.local
mSearchAssistant =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: TrueSuite Website Log On: {8590886e-ec8c-43c1-a32c-e4c2b0b6395b} - c:\program files\truesuite\TrueSuite.IEBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.exe
mRun: [TMERzCtl.EXE] c:\program files\toshiba\tme3\TMERzCtl.EXE /Service
mRun: [TMESRV.EXE] c:\program files\toshiba\tme3\TMESRV31.EXE /Logon
mRun: [TNRotate] %ProgramFiles%\TOSHIBA\TNRotate\TNRotate.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
mRun: [TUSBSleepChargeSrv] %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
mRun: [DDWMon] c:\program files\toshiba\toshiba direct disc writer\\ddwmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [TFncKy] TFncKy.exe
mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
mRun: [NDSTray.exe] NDSTray.exe
mRun: [ThpSrv] c:\windows\system32\thpsrv /logon
mRun: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe
mRun: [TFNF5] TFNF5.exe
mRun: [TPSODDCtl] TPSODDCtl.exe
mRun: [TPSMain] TPSMain.exe
mRun: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
mRun: [SystemTray] c:\program files\truesuite\TrueSuite.SysTray.exe
mRun: [ClientAppLogon] c:\program files\truesuite\TrueSuite.ClientAppLogonExe.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
mRun: [TWebCamera] "c:\program files\toshiba\toshiba web camera application\TWebCamera.exe" autorun
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [TOSHIBA Online Product Information] c:\program files\toshiba\toshiba online product information\topi.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-4-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-4-13 32592]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [2009-6-29 29760]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [2009-5-11 6528]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-4-13 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-4-13 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-13 297168]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [2010-6-15 5888]
R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2010-11-4 47104]
R2 risdpcie;risdpcie;c:\windows\system32\drivers\risdpe86.sys [2010-11-4 48128]
R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixdpe86.sys [2010-11-4 38400]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [2007-3-26 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2007-2-19 134016]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2008-4-30 4992]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2010-11-4 671488]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-13 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-4-13 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-4-13 26192]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-3-6 117504]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2010-6-15 44800]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-11-4 132352]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2010-11-4 235520]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [2010-11-4 24064]
S0 vuuhla;vuuhla;c:\windows\system32\drivers\ftgnstlx.sys --> c:\windows\system32\drivers\ftgnstlx.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-11-4 1684736]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2010-6-15 160424]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-3-6 101504]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-3-6 63616]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys --> c:\windows\system32\drivers\ewusbdev.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\e.tmp --> c:\windows\system32\E.tmp [?]
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
2011-07-06 18:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 18:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 17:01:59.18 ===============0 -
Advertisement
-
-
-
-
-
-
Advertisement
-
Advertisement