Hi,

I have followed your instructions and below are the 5 logs in the following order

Malwarebytes (MBAM)
GMER
MBRCheck
DDS(2 logs)

For ease I have separated each log with
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

Thanks so much for the help, i'll await your reply





Malware

Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: 6705

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

04/07/2011 04:00:50
mbam-log-2011-07-04 (04-00-50).txt

Scan type: Quick scan
Objects scanned: 156572
Time elapsed: 14 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.FakeVLC) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Value: {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Value: {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E879057FB3765C5033A192 (Malware.Trace) -> Value: SRS_IT_E879057FB3765C5033A192 -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(defa ult) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\mary cunningham\my documents\downloads\setup (1).exe (Trojan.FakeVLC) -> Quarantined and deleted successfully.
c:\documents and settings\mary cunningham\my documents\downloads\setup.exe (Trojan.FakeVLC) -> Quarantined and deleted successfully.
c:\documents and settings\mary cunningham\my documents\downloads\VLCSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.


GMER

GMER 1.0.15.15640 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-04 06:01:10
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600BEVT-22ZCT0 rev.11.01A11
Running: me55vc81.exe; Driver: C:\DOCUME~1\MARYCU~1\LOCALS~1\Temp\awdiypow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF79CC738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF79CC7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF79CC878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF79CC914]

---- Kernel code sections - GMER 1.0.15 ----

? nlpkom.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)


++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++


GMER

GMER 1.0.15.15640 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-04 06:01:10
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600BEVT-22ZCT0 rev.11.01A11
Running: me55vc81.exe; Driver: C:\DOCUME~1\MARYCU~1\LOCALS~1\Temp\awdiypow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF79CC738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF79CC7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF79CC878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF79CC914]

---- Kernel code sections - GMER 1.0.15 ----

? nlpkom.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[140] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2728] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtClose 7C90CFEE 5 Bytes JMP 1005A2A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 10059F70 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtFlushBuffersFile 7C90D32E 5 Bytes JMP 1005A0A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtLockFile 7C90D49E 5 Bytes JMP 1005A190 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes JMP 10059EF0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtQueryInformationFile 7C90D7CE 5 Bytes JMP 1003A7A0 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 1003A610 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtSetInformationFile 7C90DC5E 5 Bytes JMP 1005A110 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtUnlockFile 7C90DEEE 5 Bytes JMP 1005A220 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)
.text C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3776] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1005A010 c:\progra~1\window~4\datamngr\datamngr.dll (Data Manager/Bandoo Media, inc)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1220] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010
IAT C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002C0010

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----


++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

aswMBR


aswMBR version 0.9.7.675 Copyright(c) 2011 AVAST Software
Run date: 2011-07-04 06:10:53
-----------------------------
06:10:53.078 OS Version: Windows 5.1.2600 Service Pack 3
06:10:53.078 Number of processors: 2 586 0x1C02
06:10:53.078 ComputerName: MAD-MAGIC UserName:
06:10:54.265 Initialize success
06:14:18.578 AVAST engine defs: 11070301
06:15:06.625 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
06:15:06.625 Disk 0 Vendor: WDC_WD1600BEVT-22ZCT0 11.01A11 Size: 152627MB BusType: 3
06:15:08.703 Disk 0 MBR read successfully
06:15:08.718 Disk 0 MBR scan
06:15:08.718 Disk 0 Windows XP default MBR code
06:15:10.718 Disk 0 scanning sectors +312560640
06:15:10.875 Disk 0 scanning C:\WINDOWS\system32\drivers
06:15:46.500 Service scanning
06:15:48.062 Disk 0 trace - called modules:
06:15:48.187 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
06:15:48.187 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x863d4ab8]
06:15:48.187 3 CLASSPNP.SYS[f765bfd7] -> nt!IofCallDriver -> \Device\00000069[0x863123b8]
06:15:48.187 5 ACPI.sys[f75c2620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86379940]
06:15:49.218 AVAST engine scan C:\
07:53:24.937 Scan finished successfully
07:54:45.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\mary cunningham\My Documents\Dim\MBR.dat"
07:54:46.171 The log file has been saved successfully to "C:\Documents and Settings\mary cunningham\My Documents\Dim\aswMBR.txt"


++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

DDS

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 6.0.2900.5512
Run by mary cunningham at 730 on 2011-07-04
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.169 [GMT 1:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k yksvcs
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\WINDOW~4\Datamngr\DATAMN~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\igfxext.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\PROGRA~1\samsung\SAMSUN~3\SUPNOT~1.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\mary cunningham\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchqu.com/406
uSearch Bar = hxxp://dts.search-results.com/sidebar.html?src=ssb&appid=119&systemid=406
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=119&systemid=406&q={searchTerms}
mSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=119&systemid=406&q={searchTerms}
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\window~4\datamngr\toolbar\searchqudtx. dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: UrlHelper Class: {a40dc6c5-79d0-4ca8-a185-8ff989af1115} - c:\progra~1\window~4\datamngr\IEBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: BandooIEPlugin Class: {eb5cee80-030a-4ed8-8e20-454e9c68380f} - c:\program files\bandoo\plugins\ie\ieplugin.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\window~4\datamngr\toolbar\searchqudtx. dll
uRun: [Google Update] "c:\documents and settings\mary cunningham\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [<NO NAME>]
mRun: [EDS] c:\program files\samsung\samsung eds\EDSAgent.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [DMHotKey] c:\program files\samsung\easy display manager\DMLoader.exe
mRun: [SUPBackground] c:\program files\samsung\samsung update plus\SUPBackground.exe
mRun: [BatteryManager] c:\program files\samsung\samsung battery manager\BatteryManager.exe
mRun: [MagicKeyboard] c:\program files\samsung\magickbd\PreMKBD.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DATAMNGR] c:\progra~1\window~4\datamngr\DATAMN~1.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ado beg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blu eto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{956E56DE-372E-4444-AD7B-406C28AD7B75} : DhcpNameServer = 192.168.1.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\window~4\datamngr\datamngr.dll c:\progra~1\window~4\datamngr\iebho.dll c:\progra~1\bandoo\bndhook.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGI DSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 297168]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2010-2-22 4300]
R2 yksvc;Marvell Yukon Service;c:\windows\system32\svchost.exe -k yksvcs [2008-4-14 14336]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\driv ers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\driv ers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\ AVGIDSShim.sys [2010-8-19 27216]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\ SamsungEDS.SYS [2008-1-15 30208]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [2010-2-22 238464]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-21 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-19 1025352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-21 136176]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\dr ivers\mbamswissarmy.sys [2011-7-4 39984]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [2011-5-7 197504]
S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [2011-5-7 148992]
S4 Mssdincrcm;Mssdincrcm; [x]
.
=============== Created Last 30 ================
.
2011-07-04 00:11:04 -------- d-----w- c:\documents and settings\mary cunningham\application data\Malwarebytes
2011-07-04 00:10:48 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-04 00:10:46 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-07-04 00:10:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-04 00:10:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-03 14:46:34 -------- d-----w- C:\fixwareout
2011-07-03 14:29:53 -------- d-----w- c:\program files\Trend Micro
2011-07-02 00:36:30 -------- d-----w- c:\documents and settings\all users\application data\boost_interprocess
2011-07-01 17:16:36 -------- d-----w- c:\documents and settings\all users\application data\Bandoo
2011-07-01 17:16:23 -------- d-----w- c:\program files\Bandoo
2011-07-01 17:16:21 1524112 ----a-w- c:\windows\system32\bandoolmx.dll
2011-07-01 17:16:16 -------- d-----w- c:\documents and settings\mary cunningham\local settings\application data\Ilivid Player
2011-07-01 17:15:46 -------- dc-h--w- c:\documents and settings\all users\application data\{C1D18E30-468F-478F-8837-B6CBA25F6547}
2011-07-01 17:15:22 -------- d-----w- c:\program files\iLivid
2011-07-01 17:14:40 -------- d-----w- c:\documents and settings\mary cunningham\application data\searchqutoolbar
2011-07-01 17:14:25 -------- d-----w- c:\program files\Windows iLivid Toolbar
2011-07-01 17:13:57 -------- d-----w- c:\documents and settings\mary cunningham\local settings\application data\PackageAware
2011-06-18 15:51:48 -------- d-----w- c:\windows\SxsCaPendDel
.
==================== Find3M ====================
.
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 14:47:19 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 14:47:19 667136 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 14:47:19 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-04-25 1244 369664 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-04-14 20:28:42 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
.
============= FINISH: 7:57:55.40 ===============


++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++

Attach

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 27/03/2010 20:17:48
System Uptime: 04/07/2011 04:03:18 (3 hours ago)
.
Motherboard: SAMSUNG ELECTRONICS CO., LTD. | | NC10
Processor: Intel(R) Atom(TM) CPU N270 @ 1.60GHz | U2E1 | 1596/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 20.594 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP102: 07/04/2011 23:59:16 - System Checkpoint
RP103: 26/04/2011 22:37:16 - Software Distribution Service 3.0
RP104: 04/05/2011 08:15:23 - Installed BigPond Wireless Broadband
RP105: 06/05/2011 02:32:06 - System Checkpoint
RP106: 08/05/2011 06:28:51 - System Checkpoint
RP107: 23/05/2011 06:04:23 - System Checkpoint
RP108: 27/05/2011 00:13:41 - Software Distribution Service 3.0
RP109: 29/05/2011 03:00:27 - Software Distribution Service 3.0
RP110: 17/06/2011 04:58:37 - Software Distribution Service 3.0
RP111: 18/06/2011 16:47:26 - Software Distribution Service 3.0
RP112: 19/06/2011 04:44:57 - Software Distribution Service 3.0
RP113: 28/06/2011 03:00:18 - Software Distribution Service 3.0
RP114: 29/06/2011 03:00:37 - Software Distribution Service 3.0
RP115: 29/06/2011 05:54:37 - Removed BigPond Wireless Broadband
RP116: 29/06/2011 06:15:37 - Software Distribution Service 3.0
RP117: 03/07/2011 15:53:46 - Removed MSXML 6.0 Parser
.
==== Installed Programs ======================
.
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop CS
Adobe Reader 9.4.5
ASIO4ALL
Atheros WLAN Client
AVG 2011
Bandoo
Collab
Easy Display Manager
Easy Network Manager
FL Studio 8
Google Chrome
Google Earth
Google Update Helper
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952117-v2)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
IL Download Manager
iLivid
imagine digital freedom - Samsung
Intel(R) Graphics Media Accelerator Driver
Java Auto Updater
Java(TM) 6 Update 24
Magic Keyboard
Malwarebytes' Anti-Malware version 1.51.0.1200
Marvell Miniport Driver
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SONY_MEDIAMGR2)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MSXML 6.0 Parser
Namuga 1.3M Webcam
Play Camera
PoiZone
Realtek High Definition Audio Driver
Samsung Battery Manager
Samsung EDS
Samsung Magic Doctor
Samsung Update Plus
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2183461)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360131)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2416400)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2482017)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2497640)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2530548)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544521)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Skype™ 5.3
Sony Media Manager 2.3
Sony Noise Reduction Plug-In 2.0h
Sony Sound Forge 9.0
Sony Vegas Pro 8.0
Synaptics Pointing Device Driver
Toxic Biohazard
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
User Guide
VLC media player 1.0.1
WebFldrs XP
WIDCOMM Bluetooth Software
Windows iLivid Toolbar
Windows Media Format 11 runtime
Windows Presentation Foundation
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
.
==== Event Viewer Messages From Past Week ========
.
29/06/2011 1553, error: Dhcp [1002] - The IP address lease 192.168.1.92 for the Network Card with network address 0026B6435B3D has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
29/06/2011 06:16:34, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
29/06/2011 0521, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
28/06/2011 20:46:50, error: Dhcp [1002] - The IP address lease 172.29.30.136 for the Network Card with network address 0026B6435B3D has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
28/06/2011 01:00:38, error: Dhcp [1002] - The IP address lease 192.168.1.103 for the Network Card with network address 0026B6435B3D has been denied by the DHCP server 192.168.5.1 (The DHCP Server sent a DHCPNACK message).
04/07/2011 07:12:52, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
01/07/2011 18:43:33, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.25 with the system having network hardware address 00:23:12:02:F6:8B. Network operations on this system may be disrupted as a result.
01/07/2011 17:05:53, error: Dhcp [1002] - The IP address lease 192.168.1.40 for the Network Card with network address 0026B6435B3D has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================



regards

DG

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

================================================== ========

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: Uninstall & Remove McAfee, Symantec, Norton, AVG, Avast & More Antivirus and Security Applications and Programs
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!