google and other links redirected

**Rainification** · 21-05-2011

Hello, here my problem
sometimes when i click on google links, or other links, it will redirect me to a random ad or website, even as I was trying to press the submit button I got redirected..... any help would be appreciated, here are the logs that you've requested:

Malware
-----------------------------------------------

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: 6630

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

5/21/2011 1:59:13 AM
mbam-log-2011-05-21 (01-59-13).txt

Scan type: Quick scan
Objects scanned: 172174
Time elapsed: 2 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components (PUP.PlaySushi) -> Quarantined and deleted successfully.

Files Infected:
c:\Users\Rain\2gweorjqjutp92vjy9gake (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome.manif est (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\install.rdf (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\chrome\pstex tlinks.jar (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\p laysushiff.dll (PUP.PlaySushi) -> Quarantined and deleted successfully.
c:\Users\Rain\AppData\Roaming\Mozilla\extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\p laysushiff.xpt (PUP.PlaySushi) -> Quarantined and deleted successfully.

---------------------------------------------------------------------------

GMER log:

GMER 1.0.15.15627 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-05-21 02:15:26
Windows 6.1.7600
Running: r1y520st.exe

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}@hapflgjhenklcpba 0x69 0x61 0x67 0x6C ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}@iafmjidmbgkfnmgkjg 0x69 0x61 0x67 0x6C ...

---- EOF - GMER 1.0.15 ----

--------------------------------------------------------------------------------------
MBRcheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: ASUSTeK Computer INC.
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: System manufacturer
System Product Name: System Product Name
Logical Drives Mask: 0x0000000d

Kernel Drivers (total 197):
0x02C06000 \SystemRoot\system32\ntoskrnl.exe
0x031E2000 \SystemRoot\system32\hal.dll
0x00BC7000 \SystemRoot\system32\kdcom.dll
0x00CB0000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00CBD000 \SystemRoot\system32\PSHED.dll
0x00CD1000 \SystemRoot\system32\CLFS.SYS
0x00D2F000 \SystemRoot\system32\CI.dll
0x00C00000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00DEF000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00EFA000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00F51000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00F5A000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00F64000 \SystemRoot\system32\DRIVERS\pci.sys
0x00F97000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00FA4000 \SystemRoot\System32\drivers\partmgr.sys
0x00FB9000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00E00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E5C000 \SystemRoot\system32\DRIVERS\pciide.sys
0x00E63000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00E73000 \SystemRoot\System32\drivers\mountmgr.sys
0x00E8D000 \SystemRoot\system32\DRIVERS\atapi.sys
0x00E96000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x00EC0000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x01038000 \SystemRoot\system32\drivers\fltmgr.sys
0x01084000 \SystemRoot\system32\drivers\fileinfo.sys
0x0122F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01098000 \SystemRoot\System32\Drivers\msrpc.sys
0x013D2000 \SystemRoot\System32\Drivers\ksecdd.sys
0x010F6000 \SystemRoot\System32\Drivers\cng.sys
0x013EC000 \SystemRoot\System32\drivers\pcw.sys
0x01200000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0143B000 \SystemRoot\system32\drivers\ndis.sys
0x0152D000 \SystemRoot\system32\drivers\NETIO.SYS
0x0158D000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01603000 \SystemRoot\System32\drivers\tcpip.sys
0x01169000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x015B8000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x011B3000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x015C8000 \SystemRoot\System32\Drivers\spldr.sys
0x01400000 \SystemRoot\System32\drivers\rdyboost.sys
0x015D0000 \SystemRoot\System32\Drivers\mup.sys
0x015E2000 \SystemRoot\System32\drivers\hwpolicy.sys
0x018D4000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0190E000 \SystemRoot\system32\DRIVERS\disk.sys
0x01924000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x0198A000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x019B4000 \SystemRoot\System32\Drivers\Null.SYS
0x019BD000 \SystemRoot\System32\Drivers\Beep.SYS
0x019C4000 \SystemRoot\System32\drivers\vga.sys
0x019D2000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x01800000 \SystemRoot\System32\drivers\watchdog.sys
0x01810000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x01819000 \SystemRoot\system32\drivers\rdpencdd.sys
0x01822000 \SystemRoot\system32\drivers\rdprefmp.sys
0x0182B000 \SystemRoot\System32\Drivers\Msfs.SYS
0x01836000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01847000 \SystemRoot\system32\DRIVERS\tdx.sys
0x01865000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x01872000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02C72000 \SystemRoot\system32\drivers\afd.sys
0x02CFC000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x02D07000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02D10000 \SystemRoot\system32\DRIVERS\pacer.sys
0x02D36000 \SystemRoot\system32\DRIVERS\netbios.sys
0x02D45000 \SystemRoot\system32\DRIVERS\serial.sys
0x02D62000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x02D7D000 \SystemRoot\system32\DRIVERS\termdd.sys
0x02D91000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0x02DAB000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02C00000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02C0C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x02C17000 \SystemRoot\System32\drivers\discache.sys
0x03EC8000 \SystemRoot\system32\drivers\csc.sys
0x03F4B000 \SystemRoot\System32\Drivers\dfsc.sys
0x03F69000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x03F7A000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x03FA0000 \SystemRoot\system32\DRIVERS\amdppm.sys
0x13EB1000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x14BD8000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x0406C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04160000 \SystemRoot\System32\drivers\dxgmms1.sys
0x041A6000 \SystemRoot\system32\DRIVERS\L1E62x64.sys
0x041B8000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x04000000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x0400B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x14BDA000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x14BEB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x13E00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04061000 \SystemRoot\system32\DRIVERS\ASACPI.sys
0x13E24000 \SystemRoot\system32\DRIVERS\serenum.sys
0x13E30000 \SystemRoot\system32\DRIVERS\fdc.sys
0x041F6000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x13E3D000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x13E4D000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x13E63000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x13E87000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x03FB5000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x13E93000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x03E00000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x03E21000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x03E3B000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x03E46000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x03E55000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04069000 \SystemRoot\system32\DRIVERS\swenum.sys
0x03E64000 \SystemRoot\system32\DRIVERS\ks.sys
0x03EA7000 \SystemRoot\system32\DRIVERS\umbus.sys
0x14BF8000 \SystemRoot\system32\DRIVERS\vmnetadapter.sys
0x03EB9000 \SystemRoot\system32\DRIVERS\VMNET.SYS
0x04C9C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04CF6000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x04D01000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04D16000 \SystemRoot\system32\drivers\HdAudio.sys
0x04D72000 \SystemRoot\system32\drivers\portcls.sys
0x04DAF000 \SystemRoot\system32\drivers\drmk.sys
0x04DD1000 \SystemRoot\system32\drivers\ksthunk.sys
0x04DD7000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04DE5000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x04DF1000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x04C00000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x04C13000 \SystemRoot\System32\drivers\Dxapi.sys
0x04C1F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x04C3C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04C3E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x04C4C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x04C65000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x04C6E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x04C7B000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x04C89000 \??\C:\Windows\system32\drivers\VMkbd.sys
0x03FE4000 \SystemRoot\system32\DRIVERS\monitor.sys
0x004F0000 \SystemRoot\System32\TSDDD.dll
0x00760000 \SystemRoot\System32\cdd.dll
0x00910000 \SystemRoot\System32\ATMFD.DLL
0x02C26000 \SystemRoot\system32\drivers\luafv.sys
0x02C49000 \SystemRoot\system32\drivers\WudfPf.sys
0x018B7000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
0x01954000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x01969000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x056D4000 \SystemRoot\system32\drivers\HTTP.sys
0x0579C000 \SystemRoot\system32\DRIVERS\bowser.sys
0x057BA000 \SystemRoot\System32\drivers\mpsdrv.sys
0x057D2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x05600000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0564E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x05671000 \??\C:\Windows\system32\drivers\hcmon.sys
0x0567D000 \??\C:\Windows\system32\drivers\vmci.sys
0x05A5F000 \??\C:\Windows\system32\drivers\vmx86.sys
0x05B35000 \SystemRoot\System32\Drivers\adfs.SYS
0x05B4D000 \SystemRoot\system32\drivers\peauth.sys
0x05BF3000 \SystemRoot\System32\Drivers\secdrv.SYS
0x05A00000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x05A2D000 \SystemRoot\System32\drivers\tcpipreg.sys
0x05A3F000 \??\C:\Windows\system32\drivers\vmnetuserif.sys
0x05A49000 \??\C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys
0x0608A000 \SystemRoot\System32\DRIVERS\srv2.sys
0x060F2000 \SystemRoot\System32\DRIVERS\srv.sys
0x06188000 \??\C:\Windows\system32\drivers\mbam.sys
0x06192000 \SystemRoot\system32\DRIVERS\DKRtWrt.sys
0x77990000 \Windows\System32\ntdll.dll
0x47E90000 \Windows\System32\smss.exe
0xFFCB0000 \Windows\System32\apisetschema.dll
0xFF850000 \Windows\System32\autochk.exe
0xFFBC0000 \Windows\System32\oleaut32.dll
0xFFAE0000 \Windows\System32\advapi32.dll
0x77890000 \Windows\System32\user32.dll
0xFFAC0000 \Windows\System32\imagehlp.dll
0xFF8B0000 \Windows\System32\ole32.dll
0xFF830000 \Windows\System32\difxapi.dll
0x77B60000 \Windows\System32\normaliz.dll
0xFF820000 \Windows\System32\lpk.dll
0xFF6F0000 \Windows\System32\rpcrt4.dll
0xFF6D0000 \Windows\System32\sechost.dll
0xFF4F0000 \Windows\System32\setupapi.dll
0x77730000 \Windows\System32\wininet.dll
0x77520000 \Windows\System32\iertutil.dll
0xFF4E0000 \Windows\System32\nsi.dll
0xFE750000 \Windows\System32\shell32.dll
0xFE640000 \Windows\System32\msctf.dll
0xFE610000 \Windows\System32\imm32.dll
0xFE570000 \Windows\System32\msvcrt.dll
0xFE4A0000 \Windows\System32\usp10.dll
0x773D0000 \Windows\System32\urlmon.dll
0xFE430000 \Windows\System32\gdi32.dll
0x772B0000 \Windows\System32\kernel32.dll
0xFE3B0000 \Windows\System32\shlwapi.dll
0x77B50000 \Windows\System32\psapi.dll
0xFE360000 \Windows\System32\Wldap32.dll
0xFE310000 \Windows\System32\ws2_32.dll
0xFE270000 \Windows\System32\comdlg32.dll
0xFE1D0000 \Windows\System32\clbcatq.dll
0xFE190000 \Windows\System32\cfgmgr32.dll
0xFE120000 \Windows\System32\KernelBase.dll
0xFE100000 \Windows\System32\devobj.dll
0xFDF90000 \Windows\System32\crypt32.dll
0xFDEF0000 \Windows\System32\comctl32.dll
0xFDEB0000 \Windows\System32\wintrust.dll
0xFDEA0000 \Windows\System32\msasn1.dll

Processes (total 116):
0 System Idle Process
4 System
364 C:\Windows\System32\smss.exe
444 csrss.exe
504 C:\Windows\System32\wininit.exe
524 csrss.exe
572 C:\Windows\System32\services.exe
600 C:\Windows\System32\lsass.exe
608 C:\Windows\System32\lsm.exe
732 C:\Windows\System32\winlogon.exe
744 C:\Windows\System32\svchost.exe
844 C:\Windows\System32\nvvsvc.exe
896 C:\Windows\System32\svchost.exe
984 C:\Windows\System32\svchost.exe
116 C:\Windows\System32\svchost.exe
428 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\svchost.exe
1120 C:\Windows\System32\nvvsvc.exe
1240 C:\Windows\System32\svchost.exe
1436 C:\Windows\System32\spoolsv.exe
1472 C:\Windows\System32\svchost.exe
1536 C:\Windows\System32\taskhost.exe
1668 C:\Windows\SysWOW64\svchost.exe
1752 C:\Windows\System32\dwm.exe
1760 C:\Windows\explorer.exe
1876 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1904 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1952 C:\Windows\System32\svchost.exe
2032 C:\Windows\System32\svchost.exe
1676 C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
1048 C:\Windows\SysWOW64\vmnat.exe
1396 C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
1900 C:\Windows\SysWOW64\vmnetdhcp.exe
2508 C:\Windows\System32\svchost.exe
2600 C:\Program Files\Windows Sidebar\sidebar.exe
2660 C:\PPStream\PPSAP.exe
2696 C:\Program Files (x86)\HDD Health\hddhealth.exe
2948 C:\Users\Rain\AppData\Local\Google\Update\1.3.21.5 3\GoogleCrashHandler.exe
2424 C:\Windows\System32\SearchIndexer.exe
456 C:\Program Files\Windows Media Player\wmpnetwk.exe
3304 C:\Windows\System32\svchost.exe
3516 WmiPrvSE.exe
3684 C:\Program Files (x86)\iTunes\iTunesHelper.exe
3692 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
3700 C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
3708 C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
3760 C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
3768 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
4080 C:\Program Files\iPod\bin\iPodService.exe
2452 C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
3736 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
856 C:\Windows\System32\wuauclt.exe
540 C:\Windows\System32\audiodg.exe
644 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
1484 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
396 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
2756 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
3756 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
3832 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
3432 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
1164 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
3888 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
4256 C:\Windows\SysWOW64\rundll32.exe
4268 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
3424 C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
2212 C:\Windows\System32\SearchProtocolHost.exe
4276 C:\Windows\System32\SearchFilterHost.exe
1824 C:\Users\Rain\Desktop\MBRCheck.exe
2296 C:\Windows\System32\conhost.exe
888 C:\Windows\System32\dllhost.exe
4484 <unknown>
4100 <unknown>
2492 <unknown>
4688 <unknown>
5024 <unknown>
4800 <unknown>
4964 <unknown>
3036 <unknown>
4928 <unknown>
3928 <unknown>
4940 <unknown>
5008 <unknown>
1340 <unknown>
4912 <unknown>
1364 <unknown>
4536 <unknown>
4752 <unknown>
2596 <unknown>
4284 <unknown>
380 <unknown>
4376 <unknown>
2888 <unknown>
1524 <unknown>
4460 <unknown>
3220 <unknown>
2740 <unknown>
5048 <unknown>
4720 <unknown>
3508 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
1028 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4944 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
2536 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4700 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
2376 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4196 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4580 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4104 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4228 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4892 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4952 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4432 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4512 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4960 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4868 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4304 C:\Program Files (x86)\Real\RealPlayer\realplay.exe
4412 C:\Program Files (x86)\Real\RealPlayer\realplay.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD7501AALS-00J7B0, Rev: 05.00K05

Size Device Name MBR Status
--------------------------------------------
698 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: 43D883454798828D348BD54C7A5CBDE0A9733364

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
-----------------------------------------------------------------------------------

DDS log:

attach.txt:

DDS (Ver_11-05-19.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 3/3/2010 12:05:55 AM
System Uptime: 5/21/2011 2:01:33 AM (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4A78T-E
Processor: AMD Phenom(tm) II X4 965 Processor | AM3 | 3411/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 699 GiB total, 98.629 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP144: 5/18/2011 8:19:54 PM - Scheduled Checkpoint
RP145: 5/20/2011 9:31:20 PM - Installed HiJackThis
.
==== Installed Programs ======================
.
??? ?? ????
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Akamai NetSession Interface
AoA Audio Extractor
Apple Application Support
Apple Software Update
ARAX Disk Doctor Data Recovery
Bandisoft MPEG-1 Decoder
Conduit Engine
DarthMod: Shogun II (v2.05)
DarthMod: Shogun II (v2.05) Compatibility Patch
DivX Setup
DNA
FlashGet 3.3
Fraps (remove only)
Google Chrome
Google Talk Plugin
GPL MPEG-1/2 DirectShow Decoder Filter
HDD Health v3.3 Beta
HiJackThis
Java Auto Updater
Java(TM) 6 Update 24
League of Legends
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Morphyre
Mozilla Firefox (3.6.3)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NEC DISPLAY SOLUTIONS: Monitor Installer
NVIDIA PhysX
Pandora
PowerISO
PPSó??· V1.0.1.270
PPStream V2.7.0.1210 Final
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
SolveigMM AVI Trimmer
Tencent QQ
tools-freebsd
tools-linux
tools-netware
tools-solaris
tools-windows
tools-winPre2k
Uninstall Sayvoice Text to Speech 4.0
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb2279264)
Usmleworld QBank
uTorrentBar Toolbar
VC80CRTRedist - 8.0.50727.4053
Visual C++ 8.0 Runtime Setup Package (x64)
VLC media player 1.0.5
VMware Workstation
Xiph.Org Open Codecs 0.84.17315
Xvid 1.2.1 final uninstall
μTorrent
迅雷看看播放器
.
==== Event Viewer Messages From Past Week ========
.
5/20/2011 9:35:54 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\Drivers\Normandy.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
5/20/2011 8

57 PM, Error: Application Popup [1060] - \??\C:\Windows\SysWow64\Drivers\mchInjDrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
5/17/2011 12:37:09 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
5/17/2011 12:17:13 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Windows (KB2506014).
5/16/2011 11:34:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
5/16/2011 11:33:30 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
5/16/2011 11:31:32 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
5/16/2011 11:31:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
5/16/2011 11:31:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/16/2011 11:31:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/16/2011 11:31:24 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
5/16/2011 11:31:21 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx64 AvgMfx64 discache SCDEmu spldr Wanarpv6
5/16/2011 11:31:15 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002a5f7e7, 0x0000000000000000, 0x000000007ef90000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051611-33696-01.
5/16/2011 11:18:29 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002a6e330, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051611-20077-01.
5/16/2011 11:16:06 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000076fd6, 0x0000000000000002, 0x0000000000000001, 0xfffff80002a99055). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051611-24351-01.
.
==== End Of File ===========================

DDS.txt

DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
Run by Rain at 2:20:06 on 2011-05-21
Microsoft Windows 7 Ultimate 6.1.7600.0.936.86.1033.18.4094.2499 [GMT -4:00]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\Windows\SysWOW64\vmnat.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PPStream\PPSAP.exe
C:\Program Files (x86)\HDD Health\hddhealth.exe
C:\Users\Rain\AppData\Local\Google\Update\1.3.21.5 3\GoogleCrashHandler.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Users\Rain\AppData\Local\Google\Chrome\Applicat ion\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Rain\Desktop\dds.scr
C:\Windows\SysWOW64\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page =
uStart Page = about:blank
uSearch Bar =
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \IE\rpbrowserrecordplugin.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: FlashGetBHO: {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Rain\AppData\Roaming\FlashGetBHO\FlashGet BHO3.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Google Update] "C:\Users\Rain\AppData\Local\Google\Update\GoogleU pdate.exe" /c
uRun: [PPS Accelerator] C:\PPStream\ppsap.exe
uRun: [HDDHealth] C:\Program Files (x86)\HDD Health\HDDHealth.exe -wl
uRun: [Vidalia] "C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAFYARgBSAEUARQAtAFYATgBKADMAMgAtAEcAMw BMAEEAQQAtAEEANAA4ADkAUgAtADkAVQBKAEsARgAtAEUASwBL ADMAWAA"&"inst=NwA3AC0AMgAxADIAOQA2ADgANAAwADcALQB CADIALQBTAFQAMQArADIALQBUAEIAOQArADIALQBGAEwAKwA5A C0AWABPADMANgArADEALQBGADkATQA3AEMAKwA1AC0ARgA5AE0 AMQAwAEIAKwAyAC0AWABPADkAKwAxAC0ARgA5AE0AMgArADEA" &"prod=90"&"ver=9.0.894
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: UseDefaultTile = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: HideFastUserSwitching = 0 (0x0)
IE: Download All By FlashGet3 - C:\Users\Rain\AppData\Roaming\FlashGetBHO\GetAllUr l.htm
IE: Download By FlashGet3 - C:\Users\Rain\AppData\Roaming\FlashGetBHO\GetUrl.h tm
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll
Trusted Zone: kuaiche.com\software
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {B9DD5FFF-776D-4E53-93D3-A4463E63AD86} - hxxp://cdn.hangame.com/hangame/messenger/hani/webmsg/HanWebMsg.cab
DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} - hxxp://pubid.hangame.com/common/HanSetup1040.cab
DPF: {C052A649-6FEA-4AF3-81E4-DE31A8AD46B5} - hxxp://xmp.down.sandai.net/kankan/xoli.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB-X64: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
mRun-x64: [Shadow Defender Daemon] "C:\Program Files\Shadow Defender\DefenderDaemon.exe" /Auto
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\
FF - prefs.js: browser.search.selectedEngine - Dogpile Search!
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 1
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext\components\nprpffbrowserrecordlegacye xt.dll
FF - component: C:\Users\Rain\AppData\Roaming\Mozilla\Extensions\{ ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\P laySushiFF.dll
FF - component: C:\Users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
FF - component: C:\Users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\extensions\engine@conduit.co m\components\RadioWMPCoreGecko19.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Users\Rain\AppData\Local\Google\Update\1.3.21.5 3\npGoogleUpdate3.dll
FF - plugin: C:\Users\Rain\AppData\Roaming\Mozilla\plugins\npgo ogletalk.dll
FF - plugin: C:\Users\Rain\AppData\Roaming\Mozilla\plugins\npgt po3dautoplugin.dll
FF - plugin: C:\Windows\system32\npOGPPlugin.dll
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: fireform: fireform@mozilla.org - %profile%\extensions\fireform@mozilla.org
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext
.
============= SERVICES / DRIVERS ===============
.
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-5-17 363344]
R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2011-3-25 539248]
R3 DKRtWrt;DKRtWrt;C:\Windows\system32\DRIVERS\DKRtWr t.sys --> C:\Windows\system32\DRIVERS\DKRtWrt.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system3 2\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== File Associations ===============
.
txtfile=C:\Windows\notepad.exe %1
.
=============== Created Last 30 ================
.
2011-05-21 01:35:43 34560 ----a-w- C:\Windows\SysWow64\drivers\Normandy.sys
2011-05-21 01:31:57 388096 ----a-r- C:\Users\Rain\AppData\Roaming\Microsoft\Installer\ {45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-21 01:31:56 -------- d-----w- C:\Program Files (x86)\hijack
2011-05-21 00

53 -------- d-----w- C:\Program Files (x86)\ProxyFirewall
2011-05-20 03:12:27 -------- d-sh--w- C:\Diskeeper
2011-05-17 16:59:05 -------- d-----w- C:\Program Files (x86)\ARAX Disk Doctor Data Recovery
2011-05-17 16:13:40 44624 ----a-w- C:\Windows\System32\drivers\DKRtWrt.sys
2011-05-17 16:13:37 -------- d-----w- C:\ProgramData\Diskeeper Corporation
2011-05-17 16:13:37 -------- d-----w- C:\Program Files\Diskeeper Corporation
2011-05-17 16:13:37 -------- d-----w- C:\Program Files\Common Files\Diskeeper Corporation
2011-05-17 12:32:12 -------- d-----w- C:\Users\Rain\AppData\Roaming\Malwarebytes
2011-05-17 12:32:05 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-17 12:32:05 -------- d-----w- C:\ProgramData\Malwarebytes
2011-05-17 12:32:02 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-05-17 12:32:02 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-05-17 12:19:30 -------- d-----w- C:\Users\Rain\AppData\Roaming\BitDefender
2011-05-17 12:19:01 -------- d-----w- C:\Program Files\BitDefender
2011-05-17 12:00:34 -------- d-----w- C:\Users\Rain\AppData\Roaming\QuickScan
2011-05-17 12:00:11 -------- d-----w- C:\Program Files\Common Files\BitDefender
2011-05-17 11:59:43 792339 ----a-w- C:\ProgramData\bdinstall.bin
2011-05-17 05:33:09 -------- d-----w- C:\Program Files (x86)\HDD Health
2011-05-17 04:16:29 -------- d-----w- C:\Program Files (x86)\Western Digital Corporation
2011-05-14 05:33:41 -------- d-----w- C:\Windows\048298C9A4D3490B9FF9AB023A9238F3.TMP
2011-05-08 16:15:13 -------- d--h--w- C:\Users\Rain\AppData\Local\Chromium
2011-05-08 16:05:50 -------- d--h--w- C:\Users\Rain\AppData\Roaming\The Creative Assembly
2011-05-04 21:38:07 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2011-05-03 00:17:44 -------- d--h--w- C:\Users\Rain\AppData\Local\VMware
2011-05-03 00:04:38 81008 ----a-w- C:\Windows\System32\drivers\vmci.sys
2011-05-03 00:04:34 68720 ----a-w- C:\Windows\System32\drivers\vmx86.sys
2011-05-03 00:04:09 334448 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe
2011-05-03 00:04:05 404080 ----a-w- C:\Windows\SysWow64\vmnat.exe
2011-05-03 00:04:05 30320 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys
2011-05-03 00:04:01 968816 ----a-w- C:\Windows\System32\vnetlib64.dll
2011-05-03 00:03:21 31856 ----a-w- C:\Windows\System32\drivers\VMkbd.sys
2011-05-03 00:03:18 38512 ----a-w- C:\Windows\System32\drivers\hcmon.sys
2011-05-03 00:02:29 -------- d-----w- C:\Program Files (x86)\Common Files\VMware
2011-05-03 00:01:42 -------- d-----w- C:\Program Files (x86)\VMware
2011-05-02 23:57:56 106496 ----a-r- C:\Users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B 7DCEC95892A.exe
2011-05-02 23:57:56 106496 ----a-r- C:\Users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955 273A708467.exe
2011-05-02 23:57:56 106496 ----a-r- C:\Users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33F BFB5D3639.exe
2011-05-02 23:57:55 -------- d-----w- C:\Program Files (x86)\Common Files\Tencent
2011-05-02 23:57:49 -------- d-----w- C:\Program Files (x86)\Tencent
2011-05-02 23:57:36 18760 ----a-w- C:\Windows\SysWow64\QQVistaHelper.dll
2011-05-02 23:57:36 -------- d-----w- C:\Users\Rain\AppData\Roaming\Tencent
.
==================== Find3M ====================
.
2011-05-04 21:38:07 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2011-04-16 16:51:16 27536 ----a-w- C:\Windows\System32\xfcodec64.dll
2011-03-26 02:00:54 252528 ----a-w- C:\Windows\SysWow64\vmnc.dll
2011-03-26 00:04:58 56880 ----a-w- C:\Windows\System32\vmnetbridge.dll
2011-03-26 00:04:58 55344 ----a-w- C:\Windows\System32\vnetinst.dll
2011-03-26 00:04:58 45104 ----a-w- C:\Windows\System32\drivers\vmnetbridge.sys
2011-03-26 00:04:58 24112 ----a-w- C:\Windows\System32\drivers\vmnet.sys
2011-03-26 00:04:58 20016 ----a-w- C:\Windows\System32\drivers\vmnetadapter.sys
2010-07-08 14:37:14 101544 ----a-w- C:\Program Files\Common Files\LinkInstaller.exe
.
============= FINISH: 2:20:39.60 ===============

**broni** · 21-05-2011

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

================================================== ===============

I don't see any AV program running.

Please, install one of these:
- Avast! free antivirus: avast! Free Antivirus - Download Software for Virus Protection
- Avira free antivirus: Avira AntiVir Personal - Free Antivirus
Update, run full scan, report on any findings.

When done....

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
Click the "Scan" button to start scan:

On completion of the scan click "Save log", save it to your desktop and post in your next reply:

================================================== ====

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: Uninstall & Remove McAfee, Symantec, Norton, AVG, Avast & More Antivirus and Security Applications and Programs
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

**Rainification** · 22-05-2011

here the result from avast, couldn't save a text version so i've posted a screen shot, hope that's ok
Untitled.jpg picture by rainification - Photobucket

----------------------------------------------------------------------------------------------------------------------------------------
aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-21 22:39:54
-----------------------------
22:39:54.221 OS Version: Windows x64 6.1.7600
22:39:54.221 Number of processors: 4 586 0x402
22:39:54.222 ComputerName: RAINITIS UserName: Rain
22:39:56.094 Initialize success
22:40:03.914 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
22:40:03.916 Disk 0 Vendor: Size: 0MB BusType: 0
22:40:03.917 Device \Driver\atapi -> MajorFunction fffffa8004a306c0
22:40:05.919 Disk 0 MBR read successfully
22:40:05.920 Disk 0 MBR scan
22:40:05.922 Disk 0 TDL4@MBR code has been found
22:40:05.924 Disk 0 MBR hidden
22:40:05.926 Disk 0 MBR [TDL4] **ROOTKIT**
22:40:05.928 Service scanning
22:40:06.826 Disk 0 trace - called modules:
22:40:06.828 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8004a306c0]<<
22:40:06.831 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a23060]
22:40:06.834 3 CLASSPNP.SYS[fffff8800192543f] -> nt!IofCallDriver -> [0xfffffa8004406520]
22:40:06.836 5 ACPI.sys[fffff88000f05781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800440a060]
22:40:06.839 \Driver\atapi[0xfffffa80048b5a10] -> IRP_MJ_CREATE -> 0xfffffa8004a306c0
22:40:06.844 Scan finished successfully
22:40:31.285 Disk 0 MBR has been saved successfully to "C:\Users\Rain\Desktop\MBR.dat"
22:40:31.289 The log file has been saved successfully to "C:\Users\Rain\Desktop\aswMBR.txt"

-----------------------------------------------------------------------------------------------------------------------------------

**broni** · 22-05-2011

If you didn't start Combofix yet, don't run it for now...

Download TDSSKiller and save it to your desktop.

Extract (unzip) its contents to your desktop.
Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

**Rainification** · 22-05-2011

i actually did run combofix :P

ComboFix 11-05-21.03 - Rain 1/2011 Sat 22:46:46.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.936.86.1033.18.4094.1726 [GMT -4:00]
执行位置: c:\users\Rain\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Naver
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\01d00098f732f640c6a5c8d431515b46.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\049497fd8947e722ae04b02eab871c18.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\067a9fd1541da872bb757c3da6a33d92.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0783fa07a21528ab730a1df23334399c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0999dc9d92e75202025b885f39592438.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0ba4ed06c78b5997716890d067fe2f51.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0bb985ae9fc3a38262b3fd4c5cb03a3e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0ccc70e9bd23465e9e97d9445314fa13.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\0d5b5b246d05342352b6c776e1cf5212.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\11e75649feaf8ef009c4ed99aafe8310.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\1ba01a94a454af76ad1d723478b7127d.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\1ec397e7e85d3c521dc4c849c4e3ea0f.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\1f840d5d0d14655c624d157818b7003d.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\24c8b24d8a5c9889dac59d968fa1b8d8.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\251f27bb0e06e757f562bc1dc84a615f.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\25e9c02c9d769d249732f66e042c290e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\28358b19588cf08bbb5de8b51850fe3a.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\288a0b7430370eb282f72b7e015c3c9a.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\28e51fb50e37beadbd134e4ae50e8f63.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2a066ba87c16f28ec9819e3285252403.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2c5a2cabd3b78548df720c3ee90efb41.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2c86ccbe1c6e19b40bb8de244b0ba1e7.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2d0afc3654f0a438f23598fb84be758c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2dfb42d5ca2c7ccc627743d095dfbac9.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\2eacacaddf4a71fe74de2b3f14074ac6.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\354c633ff9bf6fb3ecfad0ad65113c47.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\366a8f1bc352313a1074df76fdbce056.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\393e4d90773d8bbc9b905d903b618bdf.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\397bc65516fb1e815aa106a3d14d5305.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\3c1498e5ef362e757dc43d17482960f3.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\3ca41046bcb79924498d631f343d4371.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\461b3a8e7cfacb0c812e36aed9447c6d.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\46ceb001bfdc384ffe00657d8c567973.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\46eb2cd25804a00a1f22c69c4020c7e5.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\47d1dba34092ceb5412ac6f70c51e606.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\485d27cb769c9983f17e3d9eb5d03c5c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\4b377d6eea3966e34c9a3ac2c647e5e5.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\4e216d83dc7da9779966ea4d31e236dd.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\4e6865e0bf7cf90244ce414917cc6556.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\51303604fcc7ede3ff317e6daac0c19a.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\52b483be9d71439ea530fb17638e5382.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\56613b7bd5cb1c3e01ecaa7a811022a9.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\59a83ef1238e50bddcc7caeb618d1824.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\59d3e0ea0c210c7674fea90f5382090c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\5af1fa38e21413b7b2f5c6371f706543.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\5c5edcfe25ff895bc5c6a8d734710c5c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\5f45a68915125fa8ad11a60ebffe29ee.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\6166b09fdf1ac1eaa1ae57a6eb20c03b.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\63eb5d17d60101356a7bbfdaae9afa57.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\654f8818ae39026c29f34808452fb02f.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\69482b1568b01b43c70d0ace76055f7e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\6ab204a5ef9f916fe93d527a421ffdda.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\741983fb8768fa4d118c8ca59f82bb83.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\7cef98e862160d452cf773da8f4e2064.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\7f1d8b588793a67a9e8271b309c497c8.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\82724e37ddf746e5c798c9541a83d990.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\877d5ef68d1b6d7922fd09e955289803.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\8abcdf24b4bfa351f3b767c4232c6d02.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\91a1315c3d05215b1504e5899d32b936.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\9a40bf533c72981026081869543bbde2.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\9a846edeab464b62f0f2a74c54059f0b.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\9c5178781b9775c8036205fa67727330.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\9f9c2aa3ed1b1b0f922524c5a5260d1c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\a26ba057241a8c2ae219a8db7335f51c.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\a67e0c2d6a842bf89983192c7e42d7c7.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\a9583053db1a9b326763e99e2321c517.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\ad63fa05a8e976a9e0939831eb5ba308.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\b2c8a6ebad81932fcbe8461599d71865.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\b527594c48bbaad67924ced89a416e20.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\b86745632d1223fab788478c41828d9a.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\b88e5980318f9688b4348228079f4f04.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\c25b7660062dfaf312f7142d2126cf2e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\c2a9bad2a6f3c5b8aba800c2646abbf0.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\c36f2f770b74dd9e49947e924f85eeea.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\c636b5bf68f8ea6811c91dd569143b63.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\c73959eceda75ddf82609033ed2756e9.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\ccbebc209ee7342ed2a62b6d6e996645.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\d0d1583aaf54f587014b422167bddd89.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\d41d8cd98f00b204e9800998ecf8427e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\d7c0d1ef6446382c3f7bb71308ba122f.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\d8c72d47eaed4bf47aa5d4f291a7c350.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\d909bf9e40d3de9bfa779059a90ff834.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\dc973701a6a9f218f60e389f479684db.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\dcc3ea4461b925db5858951892b5fa12.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\df0ea822d926c8fa5e9401e70f2cea67.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\e09d50f5972f50e03ca6be41cf66e0b5.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\e261f32b2da3462f5a3f10d0e3cb11c7.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\e52ee3c662672a47bf85d717ebb4ae8e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\e5c061252396f14b1dca59f288bf9c20.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\ebc4635e6aeb6c62f3801a378bdfaa4d.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\ecb246b7273dc7466b406d7b8b10c09e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\f63720489499e58792f33295e3dfbf29.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\f9531b586c797615c6b11c5d9e8b7302.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\fd44d831ab115f692f560f8ea07c9868.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\fe5046d3ac6595d8f385d8a45126456e.bmp
c:\users\Rain\AppData\Local\Microsoft\Windows\Temp orary Internet Files\fe6d388665fbc8cdfabaa8dc587839f7.bmp
c:\users\Rain\AppData\Roaming\Adobe\plugs
c:\users\Rain\AppData\Roaming\Adobe\shed
c:\users\Rain\AppData\Roaming\Adobe\shed\thr1.chm
c:\users\Rain\AppData\Roaming\explorer
c:\users\Rain\AppData\Roaming\SQLite3.dll
c:\windows\SysWow64\Explorer
.
.
((((((((((((((((((((((((( 2011-04-22 至 2011-05-22 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-05-22 02:52 . 2011-05-22 02:52 -------- d-----w- c:\users\Rain01\AppData\Local\temp
2011-05-22 01:04 . 2011-05-10 12:04 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-22 01:04 . 2011-05-10 11:59 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-22 01:04 . 2011-05-10 12:02 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-22 01:04 . 2011-05-10 11:59 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-22 01:04 . 2011-05-10 12:04 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-22 01:04 . 2011-05-10 12:10 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-22 01:04 . 2011-05-10 11:59 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-22 01:03 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
2011-05-22 01:03 . 2011-05-10 12:10 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-22 01:03 . 2011-05-22 01:03 -------- d-----w- c:\programdata\AVAST Software
2011-05-22 01:03 . 2011-05-22 01:03 -------- d-----w- c:\program files\AVAST Software
2011-05-21 16:26 . 2011-05-21 16:38 -------- d-----w- c:\program files (x86)\JDownloader
2011-05-21 01:35 . 2011-05-21 01:35 34560 ----a-w- c:\windows\SysWow64\drivers\Normandy.sys
2011-05-21 01:31 . 2011-05-21 01:31 388096 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-21 01:31 . 2011-05-21 01:31 -------- d-----w- c:\program files (x86)\hijack
2011-05-21 00:56 . 2011-05-21 01:21 -------- d-----w- c:\program files (x86)\ProxyFirewall
2011-05-20 03:12 . 2011-05-21 06:04 -------- d-----w- C:\Diskeeper
2011-05-17 16:59 . 2011-05-17 17:00 -------- d-----w- c:\program files (x86)\ARAX Disk Doctor Data Recovery
2011-05-17 16:13 . 2011-02-14 06:04 44624 ----a-w- c:\windows\system32\drivers\DKRtWrt.sys
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\programdata\Diskeeper Corporation
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\program files\Diskeeper Corporation
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\program files\Common Files\Diskeeper Corporation
2011-05-17 12:32 . 2011-05-17 12:32 -------- d-----w- c:\users\Rain\AppData\Roaming\Malwarebytes
2011-05-17 12:32 . 2011-05-17 12:32 -------- d-----w- c:\programdata\Malwarebytes
2011-05-17 12:32 . 2010-12-20 22:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-17 12:32 . 2011-05-17 14:11 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-17 12:32 . 2010-12-20 22:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-17 12:19 . 2011-05-17 12:19 -------- d-----w- c:\users\Rain\AppData\Roaming\BitDefender
2011-05-17 12:19 . 2011-05-17 12:19 -------- d-----w- c:\program files\BitDefender
2011-05-17 12:00 . 2011-05-17 12:00 -------- d-----w- c:\users\Rain\AppData\Roaming\QuickScan
2011-05-17 12:00 . 2011-05-17 12:19 -------- d-----w- c:\program files\Common Files\BitDefender
2011-05-17 11:59 . 2011-05-17 14:14 792339 ----a-w- c:\programdata\bdinstall.bin
2011-05-17 05:33 . 2011-05-17 14:11 -------- d-----w- c:\program files (x86)\HDD Health
2011-05-17 04:16 . 2011-05-17 04:16 -------- d-----w- c:\program files (x86)\Western Digital Corporation
2011-05-14 05:33 . 2011-05-17 07:54 -------- d-----w- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP
2011-05-08 16:15 . 2011-05-08 16:15 -------- d--h--w- c:\users\Rain\AppData\Local\Chromium
2011-05-08 16:05 . 2011-05-08 16:05 -------- d--h--w- c:\users\Rain\AppData\Roaming\The Creative Assembly
2011-05-04 21:38 . 2011-05-04 21:38 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-05-03 00:17 . 2011-05-20 03:04 -------- d--h--w- c:\users\Rain\AppData\Local\VMware
2011-05-03 00:17 . 2011-05-20 03:04 -------- d-----w- c:\users\Rain\AppData\Roaming\VMware
2011-05-03 00:04 . 2011-03-26 03:43 81008 ----a-w- c:\windows\system32\drivers\vmci.sys
2011-05-03 00:04 . 2011-03-26 03:43 68720 ----a-w- c:\windows\system32\drivers\vmx86.sys
2011-05-03 00:04 . 2011-03-26 03:42 334448 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
2011-05-03 00:04 . 2011-03-26 03:42 404080 ----a-w- c:\windows\SysWow64\vmnat.exe
2011-05-03 00:04 . 2011-03-26 03:41 30320 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
2011-05-03 00:04 . 2011-03-26 03:43 968816 ----a-w- c:\windows\system32\vnetlib64.dll
2011-05-03 00:03 . 2011-03-26 03:41 31856 ----a-w- c:\windows\system32\drivers\VMkbd.sys
2011-05-03 00:03 . 2011-03-26 02:27 38512 ----a-w- c:\windows\system32\drivers\hcmon.sys
2011-05-03 00:02 . 2011-05-03 00:02 -------- d-----w- c:\program files (x86)\Common Files\VMware
2011-05-03 00:01 . 2011-05-21 06:01 -------- d-----w- c:\programdata\VMware
2011-05-03 00:01 . 2011-05-03 00:01 -------- d-----w- c:\program files (x86)\VMware
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B 7DCEC95892A.exe
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955 273A708467.exe
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33F BFB5D3639.exe
2011-05-02 23:57 . 2011-05-02 23:57 -------- d-----w- c:\program files (x86)\Common Files\Tencent
2011-05-02 23:57 . 2011-05-02 23:57 -------- d-----w- c:\program files (x86)\Tencent
2011-05-02 23:57 . 2011-05-17 07:52 -------- d-----w- c:\users\Rain\AppData\Roaming\Tencent
2011-05-02 23:57 . 2011-05-02 23:57 18760 ----a-w- c:\windows\SysWow64\QQVistaHelper.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2011-04-16 16:51 . 2011-04-16 16:51 27536 ----a-w- c:\windows\system32\xfcodec64.dll
2011-03-26 02:00 . 2011-03-26 02:00 252528 ----a-w- c:\windows\SysWow64\vmnc.dll
2011-03-26 00:04 . 2011-03-26 00:04 56880 ----a-w- c:\windows\system32\vmnetbridge.dll
2011-03-26 00:04 . 2011-03-26 00:04 55344 ----a-w- c:\windows\system32\vnetinst.dll
2011-03-26 00:04 . 2011-03-26 00:04 45104 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
2011-03-26 00:04 . 2011-03-26 00:04 24112 ----a-w- c:\windows\system32\drivers\vmnet.sys
2011-03-26 00:04 . 2011-03-26 00:04 20016 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
2010-07-08 14:37 . 2010-07-08 14:37 101544 ----a-w- c:\program files\Common Files\LinkInstaller.exe
.
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"PPS Accelerator"="c:\ppstream\ppsap.exe" [2010-02-24 214408]
"HDDHealth"="c:\program files (x86)\HDD Health\HDDHealth.exe" [2008-06-15 1692672]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2010-11-18 274608]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
"vmware-tray"="c:\program files (x86)\VMware\VMware Workstation\vmware-tray.exe" [2011-03-26 129648]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer]
"UseDefaultTile"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 aswSnx;aswSnx; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dump_wmimmc;dump_wmimmc;c:\games\C9\GameGuard\dump _wmimmc.sys [x]
R3 Normandy;Normandy SR2; [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va003;X6va003;c:\users\Rain\AppData\Local\Temp\0 03F512.tmp [x]
S1 aswSP;aswSP; [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\as wMonFlt.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-20 363344]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2011-03-26 539248]
S3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWr t.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\dr ivers\mbam.sys [x]
S3 X6va001;X6va001;c:\users\Rain\AppData\Local\Temp\0 01558F.tmp [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWFSBLK
*NewlyCreated* - ASWMBR
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWTDI
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
‘计划任务’ 文件夹里的内容
.
2011-05-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-480970768-2986676160-1293654911-1001Core.job
- c:\users\Rain\AppData\Local\Google\Update\GoogleUp date.exe [2010-03-03 05:16]
.
2011-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-480970768-2986676160-1293654911-1001UA.job
- c:\users\Rain\AppData\Local\Google\Update\GoogleUp date.exe [2010-03-03 05:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\00 avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- 而外的扫描 -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download All By FlashGet3 - c:\users\Rain\AppData\Roaming\FlashGetBHO\GetAllUr l.htm
IE: Download By FlashGet3 - c:\users\Rain\AppData\Roaming\FlashGetBHO\GetUrl.h tm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\VMware\VMware Workstation\vsocklib.dll
Trusted Zone: kuaiche.com\software
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
DPF: {B9DD5FFF-776D-4E53-93D3-A4463E63AD86} - hxxp://cdn.hangame.com/hangame/messenger/hani/webmsg/HanWebMsg.cab
DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} - hxxp://pubid.hangame.com/common/HanSetup1040.cab
DPF: {C052A649-6FEA-4AF3-81E4-DE31A8AD46B5} - hxxp://xmp.down.sandai.net/kankan/xoli.cab
FF - ProfilePath - c:\users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\
FF - prefs.js: browser.search.selectedEngine - Dogpile Search!
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 1
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: fireform: fireform@mozilla.org - %profile%\extensions\fireform@mozilla.org
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext
.
.
------- 文件类型 -------
.
txtfile=c:\windows\notepad.exe %1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
Wow6432Node-HKCU-Run-Vidalia - c:\program files (x86)\Vidalia Bundle\Vidalia\vidalia.exe
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
HKLM-Run-Shadow Defender Daemon - c:\program files\Shadow Defender\DefenderDaemon.exe
AddRemove-PPSGame - e:\pps.tv\PPSGame\unppsgame.exe
AddRemove-Usmleworld QBank - c:\windows\system32\javaws.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\n pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X 6va001]
"ImagePath"="\??\c:\users\Rain\AppData\Local\Temp\ 001558F.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X 6va003]
"ImagePath"="\??\c:\users\Rain\AppData\Local\Temp\ 003F512.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\SetID\Internal]
@Denied: (A 2) (LocalSystem)
"DATA"="<settings expireTime=\"0\" productStatus=\"1\" obSize=\"0\" InstallTS=\"2145870353\" isSubsc=\"0\" version=\"12.0.1\" timeDiff=\"1\" oldDevice=\"\" authStatus_ts=\"0\" />"
"Device"="yM29zbvPzMnLvrm+x8fPzce+zro="
"DEVICE2"="ycnIysbNvrnOzsjLu769zcq8ucs="
"DATA2"="<settings accountStatus=\"4\" oldDevice=\"\" timeDiff=\"6903\" expireTime=\"1321419524\" productStatus=\"1\" obSize=\"0\" InstallSTD=\"1305634674\" isSubsc=\"0\" authStat_av=\"0\" version=\"14.1\" keyType=\"194\" prodId=\"3\" moduleId1=\"9\" moduleId2=\"0\" relType=\"0\" />\0a"
.
[HKEY_USERS\S-1-5-21-480970768-2986676160-1293654911-1001\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}*]
"hapflgjhenklcpba"=hex:69,61,67,6c,62,69,68,6a,69, 67,69,68,6f,68,6b,65,68,67,
00,02
"iafmjidmbgkfnmgkjg"=hex:69,61,67,6c,62,69,68,6a,6 9,67,69,68,6f,68,6b,65,68,67,
00,65
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macrome d\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUt il10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PC W\Security]
@Denied: (Full) (Everyone)
.
完成时间: 2011-05-21 22:55:07
ComboFix-quarantined-files.txt 2011-05-22 02:55
.
Pre-Run: 103,391,956,992 bytes free
Post-Run: 104,490,737,664 bytes free
.
- - End Of File - - 856A2087142CD60C49B596B6223A581C

**broni** · 22-05-2011

That's fine.
We'll get back to it in a moment.
For now, run TDSSKiller.

**Rainification** · 22-05-2011

2011/05/21 22:58:45.0552 4280 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29
2011/05/21 22:58:45.0822 4280 ================================================== ==============================
2011/05/21 22:58:45.0822 4280 SystemInfo:
2011/05/21 22:58:45.0822 4280
2011/05/21 22:58:45.0822 4280 OS Version: 6.1.7600 ServicePack: 0.0
2011/05/21 22:58:45.0822 4280 Product type: Workstation
2011/05/21 22:58:45.0823 4280 ComputerName: RAINITIS
2011/05/21 22:58:45.0823 4280 UserName: Rain
2011/05/21 22:58:45.0823 4280 Windows directory: C:\Windows
2011/05/21 22:58:45.0823 4280 System windows directory: C:\Windows
2011/05/21 22:58:45.0823 4280 Running under WOW64
2011/05/21 22:58:45.0823 4280 Processor architecture: Intel x64
2011/05/21 22:58:45.0823 4280 Number of processors: 4
2011/05/21 22:58:45.0823 4280 Page size: 0x1000
2011/05/21 22:58:45.0823 4280 Boot type: Normal boot
2011/05/21 22:58:45.0823 4280 ================================================== ==============================
2011/05/21 22:58:46.0028 4280 Initialize success
2011/05/21 22:59:00.0274 8788 ================================================== ==============================
2011/05/21 22:59:00.0274 8788 Scan started
2011/05/21 22:59:00.0274 8788 Mode: Manual;
2011/05/21 22:59:00.0274 8788 ================================================== ==============================
2011/05/21 22:59:01.0373 8788 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/05/21 22:59:01.0400 8788 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2011/05/21 22:59:01.0421 8788 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/05/21 22:59:01.0456 8788 adfs (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys
2011/05/21 22:59:01.0487 8788 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/05/21 22:59:01.0511 8788 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/05/21 22:59:01.0535 8788 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/05/21 22:59:01.0583 8788 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2011/05/21 22:59:01.0608 8788 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2011/05/21 22:59:01.0656 8788 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2011/05/21 22:59:01.0671 8788 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2011/05/21 22:59:01.0690 8788 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/05/21 22:59:01.0705 8788 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/05/21 22:59:01.0728 8788 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
2011/05/21 22:59:01.0746 8788 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/05/21 22:59:01.0763 8788 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
2011/05/21 22:59:01.0793 8788 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2011/05/21 22:59:01.0844 8788 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/05/21 22:59:01.0864 8788 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/05/21 22:59:01.0907 8788 aswFsBlk (f1dbe3d02ffcdee5246f29b0ecebe6e0) C:\Windows\system32\drivers\aswFsBlk.sys
2011/05/21 22:59:01.0998 8788 aswMonFlt (f3e75dd1bcc358fb4629357ad09e7c84) C:\Windows\system32\drivers\aswMonFlt.sys
2011/05/21 22:59:02.0021 8788 aswRdr (fccbdc045dc12afd1508205117e7ed11) C:\Windows\system32\drivers\aswRdr.sys
2011/05/21 22:59:02.0111 8788 aswSnx (5824dca602a0a30e866bc2ac98c6d970) C:\Windows\system32\drivers\aswSnx.sys
2011/05/21 22:59:02.0141 8788 aswSP (af07b4bef920f90205148f3a05e2974c) C:\Windows\system32\drivers\aswSP.sys
2011/05/21 22:59:02.0211 8788 aswTdi (a3eca5af3b4823a523c285a8df0f9e4f) C:\Windows\system32\drivers\aswTdi.sys
2011/05/21 22:59:02.0249 8788 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/21 22:59:02.0259 8788 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2011/05/21 22:59:02.0317 8788 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/05/21 22:59:02.0342 8788 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/05/21 22:59:02.0382 8788 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/05/21 22:59:02.0424 8788 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/05/21 22:59:02.0461 8788 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/21 22:59:02.0484 8788 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/05/21 22:59:02.0502 8788 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/05/21 22:59:02.0524 8788 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/05/21 22:59:02.0547 8788 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/05/21 22:59:02.0564 8788 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/05/21 22:59:02.0580 8788 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/05/21 22:59:02.0597 8788 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/05/21 22:59:02.0636 8788 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/21 22:59:02.0658 8788 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/21 22:59:02.0683 8788 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/05/21 22:59:02.0713 8788 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/05/21 22:59:02.0749 8788 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/05/21 22:59:02.0767 8788 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2011/05/21 22:59:02.0796 8788 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2011/05/21 22:59:02.0814 8788 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/05/21 22:59:02.0830 8788 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/05/21 22:59:02.0858 8788 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/05/21 22:59:02.0900 8788 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys
2011/05/21 22:59:02.0937 8788 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2011/05/21 22:59:02.0953 8788 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/05/21 22:59:02.0982 8788 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/05/21 22:59:03.0026 8788 DKRtWrt (20c394c80113d77406df8f1adc720b01) C:\Windows\system32\DRIVERS\DKRtWrt.sys
2011/05/21 22:59:03.0082 8788 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/05/21 22:59:03.0141 8788 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/21 22:59:03.0214 8788 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/05/21 22:59:03.0291 8788 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/05/21 22:59:03.0318 8788 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2011/05/21 22:59:03.0344 8788 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/05/21 22:59:03.0369 8788 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/05/21 22:59:03.0399 8788 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/21 22:59:03.0418 8788 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/05/21 22:59:03.0436 8788 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/05/21 22:59:03.0449 8788 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/21 22:59:03.0470 8788 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2011/05/21 22:59:03.0495 8788 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/05/21 22:59:03.0525 8788 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/21 22:59:03.0555 8788 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/05/21 22:59:03.0576 8788 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/05/21 22:59:03.0610 8788 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/05/21 22:59:03.0660 8788 hcmon (d5fa01185a7d5a65724fd87b34e53f5b) C:\Windows\system32\drivers\hcmon.sys
2011/05/21 22:59:03.0676 8788 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/05/21 22:59:03.0712 8788 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2011/05/21 22:59:03.0743 8788 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/21 22:59:03.0760 8788 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/05/21 22:59:03.0779 8788 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/05/21 22:59:03.0795 8788 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/05/21 22:59:03.0847 8788 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/21 22:59:03.0885 8788 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/05/21 22:59:03.0913 8788 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2011/05/21 22:59:03.0935 8788 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2011/05/21 22:59:03.0960 8788 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/21 22:59:03.0986 8788 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/05/21 22:59:04.0010 8788 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/05/21 22:59:04.0034 8788 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2011/05/21 22:59:04.0064 8788 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/21 22:59:04.0093 8788 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/21 22:59:04.0117 8788 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/05/21 22:59:04.0148 8788 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/05/21 22:59:04.0181 8788 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/05/21 22:59:04.0191 8788 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2011/05/21 22:59:04.0216 8788 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/21 22:59:04.0243 8788 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/21 22:59:04.0266 8788 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/21 22:59:04.0288 8788 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/21 22:59:04.0465 8788 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2011/05/21 22:59:04.0609 8788 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/05/21 22:59:04.0801 8788 L1E (2ac603c3188c704cfce353659aa7ad71) C:\Windows\system32\DRIVERS\L1E62x64.sys
2011/05/21 22:59:04.0926 8788 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/21 22:59:05.0063 8788 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/05/21 22:59:05.0129 8788 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/05/21 22:59:05.0190 8788 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/05/21 22:59:05.0233 8788 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/05/21 22:59:05.0250 8788 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/05/21 22:59:05.0280 8788 MBAMProtector (3d3c4b63f11f63f50253e734f0ace9f2) C:\Windows\system32\drivers\mbam.sys
2011/05/21 22:59:05.0302 8788 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/05/21 22:59:05.0320 8788 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/05/21 22:59:05.0352 8788 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/05/21 22:59:05.0390 8788 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/21 22:59:05.0428 8788 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/21 22:59:05.0454 8788 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/21 22:59:05.0472 8788 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2011/05/21 22:59:05.0494 8788 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2011/05/21 22:59:05.0517 8788 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/21 22:59:05.0539 8788 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2011/05/21 22:59:05.0573 8788 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/21 22:59:05.0592 8788 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/21 22:59:05.0618 8788 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/21 22:59:05.0641 8788 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2011/05/21 22:59:05.0663 8788 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2011/05/21 22:59:05.0694 8788 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/05/21 22:59:05.0720 8788 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/05/21 22:59:05.0738 8788 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/05/21 22:59:05.0769 8788 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/21 22:59:05.0786 8788 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/21 22:59:05.0803 8788 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/05/21 22:59:05.0829 8788 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2011/05/21 22:59:05.0849 8788 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/21 22:59:05.0869 8788 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/05/21 22:59:05.0887 8788 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/05/21 22:59:05.0923 8788 MTsensor (03b7145c889603537e9ffeabb1ad1089) C:\Windows\system32\DRIVERS\ASACPI.sys
2011/05/21 22:59:05.0937 8788 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/05/21 22:59:05.0968 8788 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/21 22:59:06.0007 8788 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2011/05/21 22:59:06.0023 8788 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/05/21 22:59:06.0050 8788 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/21 22:59:06.0088 8788 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/21 22:59:06.0110 8788 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/21 22:59:06.0122 8788 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2011/05/21 22:59:06.0140 8788 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/21 22:59:06.0161 8788 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/21 22:59:06.0200 8788 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/05/21 22:59:06.0259 8788 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/05/21 22:59:06.0368 8788 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/21 22:59:06.0410 8788 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
2011/05/21 22:59:06.0430 8788 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/05/21 22:59:06.0653 8788 nvlddmkm (6f9cbe52517660b68694accee35ec4d5) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/05/21 22:59:06.0878 8788 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
2011/05/21 22:59:06.0898 8788 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
2011/05/21 22:59:06.0924 8788 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/05/21 22:59:06.0951 8788 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/21 22:59:07.0024 8788 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/05/21 22:59:07.0116 8788 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2011/05/21 22:59:07.0139 8788 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2011/05/21 22:59:07.0155 8788 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2011/05/21 22:59:07.0172 8788 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/05/21 22:59:07.0192 8788 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/05/21 22:59:07.0213 8788 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/05/21 22:59:07.0297 8788 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/21 22:59:07.0313 8788 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/05/21 22:59:07.0340 8788 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/21 22:59:07.0581 8788 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/05/21 22:59:07.0669 8788 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/05/21 22:59:07.0747 8788 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/21 22:59:07.0766 8788 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/21 22:59:07.0799 8788 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/05/21 22:59:07.0821 8788 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/21 22:59:07.0839 8788 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/21 22:59:07.0859 8788 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/21 22:59:07.0876 8788 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/21 22:59:07.0897 8788 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/05/21 22:59:07.0916 8788 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/21 22:59:07.0952 8788 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys
2011/05/21 22:59:07.0982 8788 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/21 22:59:07.0996 8788 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/05/21 22:59:08.0019 8788 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2011/05/21 22:59:08.0043 8788 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2011/05/21 22:59:08.0089 8788 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/21 22:59:08.0121 8788 s3cap (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/05/21 22:59:08.0144 8788 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/05/21 22:59:08.0191 8788 SCDEmu (46942b6980b35ffda6afa40a8328938c) C:\Windows\system32\drivers\SCDEmu.sys
2011/05/21 22:59:08.0211 8788 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2011/05/21 22:59:08.0239 8788 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/05/21 22:59:08.0284 8788 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/05/21 22:59:08.0306 8788 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/05/21 22:59:08.0325 8788 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/05/21 22:59:08.0355 8788 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/05/21 22:59:08.0370 8788 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/05/21 22:59:08.0387 8788 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/05/21 22:59:08.0407 8788 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/05/21 22:59:08.0441 8788 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/05/21 22:59:08.0460 8788 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/05/21 22:59:08.0482 8788 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/05/21 22:59:08.0511 8788 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/05/21 22:59:08.0552 8788 srv (43067a65522eaec33d31a12d6fa8e3f4) C:\Windows\system32\DRIVERS\srv.sys
2011/05/21 22:59:08.0576 8788 srv2 (03715cf9c30b563da35fc5f2b8f7b8e0) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/21 22:59:08.0595 8788 srvnet (fbd09635227a8026c0f7790f604343c6) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/21 22:59:08.0621 8788 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/05/21 22:59:08.0654 8788 storflt (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/05/21 22:59:08.0669 8788 storvsc (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\DRIVERS\storvsc.sys
2011/05/21 22:59:08.0687 8788 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/21 22:59:08.0751 8788 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2011/05/21 22:59:08.0801 8788 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/21 22:59:08.0828 8788 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/21 22:59:08.0851 8788 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/05/21 22:59:08.0868 8788 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/05/21 22:59:08.0888 8788 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/21 22:59:08.0902 8788 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/21 22:59:08.0941 8788 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/21 22:59:08.0963 8788 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/21 22:59:08.0986 8788 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/05/21 22:59:09.0009 8788 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/21 22:59:09.0050 8788 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/05/21 22:59:09.0072 8788 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/21 22:59:09.0085 8788 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/05/21 22:59:09.0120 8788 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/21 22:59:09.0152 8788 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2011/05/21 22:59:09.0171 8788 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/21 22:59:09.0194 8788 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/21 22:59:09.0217 8788 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
2011/05/21 22:59:09.0241 8788 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/05/21 22:59:09.0265 8788 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/05/21 22:59:09.0284 8788 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/05/21 22:59:09.0304 8788 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/05/21 22:59:09.0334 8788 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/21 22:59:09.0352 8788 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/05/21 22:59:09.0376 8788 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/05/21 22:59:09.0392 8788 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2011/05/21 22:59:09.0427 8788 vmbus (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\DRIVERS\vmbus.sys
2011/05/21 22:59:09.0448 8788 VMBusHID (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/05/21 22:59:09.0473 8788 vmci (312aec23a85424543af898a59209b479) C:\Windows\system32\drivers\vmci.sys
2011/05/21 22:59:09.0505 8788 vmkbd (ffc30caeeb2fc5fee8568cff74edeaed) C:\Windows\system32\drivers\VMkbd.sys
2011/05/21 22:59:09.0516 8788 VMnetAdapter (9d54f1339e78c95bf3d9939ebcb66378) C:\Windows\system32\DRIVERS\vmnetadapter.sys
2011/05/21 22:59:09.0536 8788 VMnetBridge (fb54ef3aa613d2832fd3812e7cb2fc75) C:\Windows\system32\DRIVERS\vmnetbridge.sys
2011/05/21 22:59:09.0551 8788 VMnetuserif (56d547bfc3f1619fa82ec9ef5d24e802) C:\Windows\system32\drivers\vmnetuserif.sys
2011/05/21 22:59:09.0578 8788 vmx86 (62cd5a87fde14701506d4e0dd8f13d2e) C:\Windows\system32\drivers\vmx86.sys
2011/05/21 22:59:09.0589 8788 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/05/21 22:59:09.0608 8788 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2011/05/21 22:59:09.0646 8788 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2011/05/21 22:59:09.0673 8788 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/05/21 22:59:09.0767 8788 vstor2-ws60 (e61c910e2ddf4797c1b1f9239636e894) C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys
2011/05/21 22:59:09.0781 8788 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2011/05/21 22:59:09.0811 8788 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/05/21 22:59:09.0840 8788 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/21 22:59:09.0848 8788 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/21 22:59:09.0890 8788 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/05/21 22:59:09.0920 8788 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/21 22:59:09.0961 8788 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/05/21 22:59:09.0976 8788 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/05/21 22:59:10.0022 8788 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/05/21 22:59:10.0036 8788 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/21 22:59:10.0070 8788 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/21 22:59:10.0101 8788 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2011/05/21 22:59:10.0121 8788 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/21 22:59:10.0228 8788 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/05/21 22:59:10.0231 8788 ================================================== ==============================
2011/05/21 22:59:10.0231 8788 Scan finished
2011/05/21 22:59:10.0231 8788 ================================================== ==============================
2011/05/21 22:59:10.0237 10080 Detected object count: 1
2011/05/21 22:59:20.0831 10080 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/21 22:59:20.0831 10080 \HardDisk0 - ok
2011/05/21 22:59:20.0832 10080 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/05/21 22:59:30.0990 7560 Deinitialize success

**broni** · 22-05-2011

Very good

How is redirection?

Re-run Combofix and give me a fresh log.

**Rainification** · 22-05-2011

Haven't experienced any redirecting yet, but it usually is very random so I'm not 100% sure, anyway here's the new log:

ComboFix 11-05-21.03 - Rain 1/2011 Sat 23:11:24.2.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.936.86.1033.18.4094.2730 [GMT -4:00]
执行位置: c:\users\Rain\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( 2011-04-22 至 2011-05-22 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-05-22 03:15 . 2011-05-22 03:15 -------- d-----w- c:\users\rain02\AppData\Local\temp
2011-05-22 03:15 . 2011-05-22 03:15 -------- d-----w- c:\users\Rain01\AppData\Local\temp
2011-05-22 03:15 . 2011-05-22 03:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-22 01:04 . 2011-05-10 12:04 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-22 01:04 . 2011-05-10 11:59 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-22 01:04 . 2011-05-10 12:02 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-22 01:04 . 2011-05-10 11:59 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-22 01:04 . 2011-05-10 12:04 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-22 01:04 . 2011-05-10 12:10 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-22 01:04 . 2011-05-10 11:59 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-05-22 01:03 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr
2011-05-22 01:03 . 2011-05-10 12:10 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-05-22 01:03 . 2011-05-22 01:03 -------- d-----w- c:\programdata\AVAST Software
2011-05-22 01:03 . 2011-05-22 01:03 -------- d-----w- c:\program files\AVAST Software
2011-05-21 16:26 . 2011-05-21 16:38 -------- d-----w- c:\program files (x86)\JDownloader
2011-05-21 01:35 . 2011-05-21 01:35 34560 ----a-w- c:\windows\SysWow64\drivers\Normandy.sys
2011-05-21 01:31 . 2011-05-21 01:31 388096 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-21 01:31 . 2011-05-21 01:31 -------- d-----w- c:\program files (x86)\hijack
2011-05-21 00:56 . 2011-05-21 01:21 -------- d-----w- c:\program files (x86)\ProxyFirewall
2011-05-20 03:12 . 2011-05-21 06:04 -------- d-----w- C:\Diskeeper
2011-05-17 16:59 . 2011-05-17 17:00 -------- d-----w- c:\program files (x86)\ARAX Disk Doctor Data Recovery
2011-05-17 16:13 . 2011-02-14 06:04 44624 ----a-w- c:\windows\system32\drivers\DKRtWrt.sys
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\programdata\Diskeeper Corporation
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\program files\Diskeeper Corporation
2011-05-17 16:13 . 2011-05-17 16:13 -------- d-----w- c:\program files\Common Files\Diskeeper Corporation
2011-05-17 12:32 . 2011-05-17 12:32 -------- d-----w- c:\users\Rain\AppData\Roaming\Malwarebytes
2011-05-17 12:32 . 2011-05-17 12:32 -------- d-----w- c:\programdata\Malwarebytes
2011-05-17 12:32 . 2010-12-20 22:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-17 12:32 . 2011-05-17 14:11 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-17 12:32 . 2010-12-20 22:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-17 12:19 . 2011-05-17 12:19 -------- d-----w- c:\users\Rain\AppData\Roaming\BitDefender
2011-05-17 12:19 . 2011-05-17 12:19 -------- d-----w- c:\program files\BitDefender
2011-05-17 12:00 . 2011-05-17 12:00 -------- d-----w- c:\users\Rain\AppData\Roaming\QuickScan
2011-05-17 12:00 . 2011-05-17 12:19 -------- d-----w- c:\program files\Common Files\BitDefender
2011-05-17 11:59 . 2011-05-17 14:14 792339 ----a-w- c:\programdata\bdinstall.bin
2011-05-17 05:33 . 2011-05-17 14:11 -------- d-----w- c:\program files (x86)\HDD Health
2011-05-17 04:16 . 2011-05-17 04:16 -------- d-----w- c:\program files (x86)\Western Digital Corporation
2011-05-14 05:33 . 2011-05-17 07:54 -------- d-----w- c:\windows\048298C9A4D3490B9FF9AB023A9238F3.TMP
2011-05-08 16:15 . 2011-05-08 16:15 -------- d--h--w- c:\users\Rain\AppData\Local\Chromium
2011-05-08 16:05 . 2011-05-08 16:05 -------- d--h--w- c:\users\Rain\AppData\Roaming\The Creative Assembly
2011-05-04 21:38 . 2011-05-04 21:38 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-05-03 00:17 . 2011-05-20 03:04 -------- d--h--w- c:\users\Rain\AppData\Local\VMware
2011-05-03 00:17 . 2011-05-20 03:04 -------- d-----w- c:\users\Rain\AppData\Roaming\VMware
2011-05-03 00:04 . 2011-03-26 03:43 81008 ----a-w- c:\windows\system32\drivers\vmci.sys
2011-05-03 00:04 . 2011-03-26 03:43 68720 ----a-w- c:\windows\system32\drivers\vmx86.sys
2011-05-03 00:04 . 2011-03-26 03:42 334448 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
2011-05-03 00:04 . 2011-03-26 03:42 404080 ----a-w- c:\windows\SysWow64\vmnat.exe
2011-05-03 00:04 . 2011-03-26 03:41 30320 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
2011-05-03 00:04 . 2011-03-26 03:43 968816 ----a-w- c:\windows\system32\vnetlib64.dll
2011-05-03 00:03 . 2011-03-26 03:41 31856 ----a-w- c:\windows\system32\drivers\VMkbd.sys
2011-05-03 00:03 . 2011-03-26 02:27 38512 ----a-w- c:\windows\system32\drivers\hcmon.sys
2011-05-03 00:02 . 2011-05-03 00:02 -------- d-----w- c:\program files (x86)\Common Files\VMware
2011-05-03 00:01 . 2011-05-22 03:00 -------- d-----w- c:\programdata\VMware
2011-05-03 00:01 . 2011-05-03 00:01 -------- d-----w- c:\program files (x86)\VMware
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B 7DCEC95892A.exe
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955 273A708467.exe
2011-05-02 23:57 . 2011-05-02 23:57 106496 ----a-r- c:\users\Rain\AppData\Roaming\Microsoft\Installer\ {3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33F BFB5D3639.exe
2011-05-02 23:57 . 2011-05-02 23:57 -------- d-----w- c:\program files (x86)\Common Files\Tencent
2011-05-02 23:57 . 2011-05-02 23:57 -------- d-----w- c:\program files (x86)\Tencent
2011-05-02 23:57 . 2011-05-17 07:52 -------- d-----w- c:\users\Rain\AppData\Roaming\Tencent
2011-05-02 23:57 . 2011-05-02 23:57 18760 ----a-w- c:\windows\SysWow64\QQVistaHelper.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2011-04-16 16:51 . 2011-04-16 16:51 27536 ----a-w- c:\windows\system32\xfcodec64.dll
2011-03-26 02:00 . 2011-03-26 02:00 252528 ----a-w- c:\windows\SysWow64\vmnc.dll
2011-03-26 00:04 . 2011-03-26 00:04 56880 ----a-w- c:\windows\system32\vmnetbridge.dll
2011-03-26 00:04 . 2011-03-26 00:04 55344 ----a-w- c:\windows\system32\vnetinst.dll
2011-03-26 00:04 . 2011-03-26 00:04 45104 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
2011-03-26 00:04 . 2011-03-26 00:04 24112 ----a-w- c:\windows\system32\drivers\vmnet.sys
2011-03-26 00:04 . 2011-03-26 00:04 20016 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
2010-07-08 14:37 . 2010-07-08 14:37 101544 ----a-w- c:\program files\Common Files\LinkInstaller.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-22_02.53.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-05-22 01:05 16384 c:\windows\SysWOW64\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-05-22 03:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-05-22 01:05 49152 c:\windows\SysWOW64\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-05-22 03:00 49152 c:\windows\SysWOW64\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-05-22 01:05 16384 c:\windows\SysWOW64\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
+ 2009-07-14 04:54 . 2011-05-22 03:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
+ 2010-03-03 06:39 . 2011-05-22 03:02 50062 c:\windows\system32\wdi\ShutdownPerformanceDiagnos tics_SystemData.bin
+ 2009-07-14 05:10 . 2011-05-22 03:02 33010 c:\windows\system32\wdi\BootPerformanceDiagnostics _SystemData.bin
+ 2010-03-03 05:11 . 2011-05-22 03:02 13608 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-480970768-2986676160-1293654911-1001_UserData.bin
+ 2009-07-14 04:46 . 2011-05-22 03:03 71736 c:\windows\ServiceProfiles\NetworkService\AppData\ Roaming\Microsoft\SoftwareProtectionPlatform\Cache \cache.dat
+ 2011-05-22 03:00 . 2011-05-22 03:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
- 2011-05-21 06:01 . 2011-05-21 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
+ 2011-05-22 03:00 . 2011-05-22 03:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
- 2011-05-21 06:01 . 2011-05-21 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
+ 2009-07-14 05:01 . 2011-05-22 02:59 456712 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\FontCache-System.dat
- 2009-07-14 05:01 . 2011-05-21 06:01 456712 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\FontCache-System.dat
+ 2009-07-14 04:45 . 2011-05-22 03:03 3607895 c:\windows\ServiceProfiles\NetworkService\AppData\ Roaming\Microsoft\SoftwareProtectionPlatform\token s.dat
- 2009-07-14 04:45 . 2011-05-04 21:45 3607895 c:\windows\ServiceProfiles\NetworkService\AppData\ Roaming\Microsoft\SoftwareProtectionPlatform\token s.dat
+ 2010-12-01 08:29 . 2011-05-22 02:59 8652851 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\FontCache-S-1-5-21-480970768-2986676160-1293654911-1001-12288.dat
- 2009-07-14 02:34 . 2011-05-22 01:04 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2009-07-14 02:34 . 2011-05-22 03:14 10223616 c:\windows\system32\SMI\Store\Machine\schema.dat
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"PPS Accelerator"="c:\ppstream\ppsap.exe" [2010-02-24 214408]
"HDDHealth"="c:\program files (x86)\HDD Health\HDDHealth.exe" [2008-06-15 1692672]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2010-11-18 274608]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
"vmware-tray"="c:\program files (x86)\VMware\VMware Workstation\vmware-tray.exe" [2011-03-26 129648]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer]
"UseDefaultTile"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dump_wmimmc;dump_wmimmc;c:\games\C9\GameGuard\dump _wmimmc.sys [x]
R3 Normandy;Normandy SR2; [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va003;X6va003;c:\users\Rain\AppData\Local\Temp\0 03F512.tmp [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\as wMonFlt.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-20 363344]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2011-03-26 539248]
S3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWr t.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\dr ivers\mbam.sys [x]
S3 X6va001;X6va001;c:\users\Rain\AppData\Local\Temp\0 0186AC.tmp [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWSNX
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
‘计划任务’ 文件夹里的内容
.
2011-05-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-480970768-2986676160-1293654911-1001Core.job
- c:\users\Rain\AppData\Local\Google\Update\GoogleUp date.exe [2010-03-03 05:16]
.
2011-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-480970768-2986676160-1293654911-1001UA.job
- c:\users\Rain\AppData\Local\Google\Update\GoogleUp date.exe [2010-03-03 05:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\00 avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Shadow Defender Daemon"="c:\program files\Shadow Defender\DefenderDaemon.exe" [BU]
.
------- 而外的扫描 -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download All By FlashGet3 - c:\users\Rain\AppData\Roaming\FlashGetBHO\GetAllUr l.htm
IE: Download By FlashGet3 - c:\users\Rain\AppData\Roaming\FlashGetBHO\GetUrl.h tm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\VMware\VMware Workstation\vsocklib.dll
Trusted Zone: kuaiche.com\software
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
DPF: {B9DD5FFF-776D-4E53-93D3-A4463E63AD86} - hxxp://cdn.hangame.com/hangame/messenger/hani/webmsg/HanWebMsg.cab
DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} - hxxp://pubid.hangame.com/common/HanSetup1040.cab
DPF: {C052A649-6FEA-4AF3-81E4-DE31A8AD46B5} - hxxp://xmp.down.sandai.net/kankan/xoli.cab
FF - ProfilePath - c:\users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\
FF - prefs.js: browser.search.selectedEngine - Dogpile Search!
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 1
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: fireform: fireform@mozilla.org - %profile%\extensions\fireform@mozilla.org
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext
.
.
------- 文件类型 -------
.
txtfile=c:\windows\notepad.exe %1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\n pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X 6va001]
"ImagePath"="\??\c:\users\Rain\AppData\Local\Temp\ 00186AC.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X 6va003]
"ImagePath"="\??\c:\users\Rain\AppData\Local\Temp\ 003F512.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\SetID\Internal]
@Denied: (A 2) (LocalSystem)
"DATA"="<settings expireTime=\"0\" productStatus=\"1\" obSize=\"0\" InstallTS=\"2145870353\" isSubsc=\"0\" version=\"12.0.1\" timeDiff=\"1\" oldDevice=\"\" authStatus_ts=\"0\" />"
"Device"="yM29zbvPzMnLvrm+x8fPzce+zro="
"DEVICE2"="ycnIysbNvrnOzsjLu769zcq8ucs="
"DATA2"="<settings accountStatus=\"4\" oldDevice=\"\" timeDiff=\"6903\" expireTime=\"1321419524\" productStatus=\"1\" obSize=\"0\" InstallSTD=\"1305634674\" isSubsc=\"0\" authStat_av=\"0\" version=\"14.1\" keyType=\"194\" prodId=\"3\" moduleId1=\"9\" moduleId2=\"0\" relType=\"0\" />\0a"
.
[HKEY_USERS\S-1-5-21-480970768-2986676160-1293654911-1001\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}*]
"hapflgjhenklcpba"=hex:69,61,67,6c,62,69,68,6a,69, 67,69,68,6f,68,6b,65,68,67,
00,02
"iafmjidmbgkfnmgkjg"=hex:69,61,67,6c,62,69,68,6a,6 9,67,69,68,6f,68,6b,65,68,67,
00,65
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macrome d\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUt il10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10 p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PC W\Security]
@Denied: (Full) (Everyone)
.
完成时间: 2011-05-21 23:17:22
ComboFix-quarantined-files.txt 2011-05-22 03:17
ComboFix2.txt 2011-05-22 02:55
.
Pre-Run: 103,442,997,248 bytes free
Post-Run: 103,176,036,352 bytes free
.
- - End Of File - - A45C9A0E62785584C4EADF118F2149BC

**broni** · 22-05-2011

You should be OK.
A rootkit was a main culprit here.
We'll keep checking though....

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box
Click OK

Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

Firefox::
FF - ProfilePath - c:\users\Rain\AppData\Roaming\Mozilla\Firefox\Prof iles\da4dg2sx.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 1

RegNull::
[HKEY_USERS\S-1-5-21-480970768-2986676160-1293654911-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{578CB383-C1BA-09AB-C383-B662DA71340D}*]

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

google and other links redirected

google and other links redirected

Similar Threads

Google Links being redirected

Google links getting redirected!

Google Links being redirected

Google links being redirected.

Google links are being redirected