blinken

ComboFix uninstalled as requested and the password suggestion is a good one too. Thanks a lot for the assistance.

the laptop seems better, haven't seen websites asking for credit card verification last 2 days. Combofix log below. thanks. ComboFix 12-07-02.01 - TBC MB 02 04/07/2012 10:31:35.1.2 - x86 Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1822 [GMT 9.5:30] Running from: c:\users\TBC MB 02\Desktop\ComboFix.exe AV: McAfee® Total Protection™ Service *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee® Security-as-a-Service *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee® Total Protection™ Service *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\windows c:\programdata\windows\msxx.dat c:\programdata\Windows\vvve.dat c:\users\TBC MB 02\AppData\Local\assembly\tmp c:\users\TBC MB 02\AppData\Roaming\.# c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@1692770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@16927A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@1322770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@13227A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@372770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@3727A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@1592770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@15927A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@232770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@2327A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@1622770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@16227A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@1752770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@17527A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@1732770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@17327A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F2770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F27A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@1802770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@18027A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C2770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C27A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@1542770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@15427A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F2770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F27A0.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D2770.### c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D27A0.### c:\users\TBC MB 02\g2mdlhlpx.exe . . ((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 ))))))))))))))))))))))))))))))) . . 2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Ctx_StreamingSvc\AppData\Local\temp 2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\McAfeeMVSUser\AppData\Local\temp 2012-07-04 00:03 . 2012-07-04 00:03 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\HPAppData 2012-07-02 02:36 . 2012-07-02 02:36 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-07-02 02:36 . 2012-07-02 02:36 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-07-02 00:59 . 2012-04-04 06:26 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-07-02 00:58 . 2012-07-02 00:58 -------- d-----w- c:\program files\iPod 2012-07-02 00:58 . 2012-07-02 01:01 -------- d-----w- c:\program files\iTunes 2012-07-02 00:39 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-07-02 00:39 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-07-02 00:39 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-07-02 00:39 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-07-02 00:38 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll 2012-07-02 00:38 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-07-02 00:38 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-07-02 00:38 . 2012-06-02 05:49 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-07-02 00:38 . 2012-06-02 05:42 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-06-30 06:03 . 2012-06-30 06:03 -------- d-----w- c:\program files\Trend Micro 2012-06-29 05:41 . 2012-06-29 05:41 -------- d-----w- c:\program files\NoVirusThanks 2012-06-29 00:54 . 2012-06-29 00:54 -------- d-----w- c:\users\TBC MB 02\AppData\Local\Macromedia 2012-06-29 00:40 . 2012-06-29 00:40 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Malwarebytes 2012-06-29 00:39 . 2012-06-29 00:39 -------- d-----w- c:\programdata\Malwarebytes 2012-06-29 00:39 . 2012-07-02 00:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-06-26 00:57 . 2012-06-26 02:34 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Foxit Software 2012-06-26 00:53 . 2012-06-26 00:53 -------- d-----w- c:\program files\Foxit Software 2012-06-22 07:25 . 2012-07-02 00:32 -------- d-----w- c:\program files\MediaInfo 2012-06-13 23:43 . 2012-05-15 01:12 2342400 ----a-w- c:\windows\system32\win32k.sys 2012-06-13 23:43 . 2012-04-28 03:19 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-13 23:43 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\system32\msi.dll 2012-06-13 23:43 . 2012-04-26 04:48 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-13 23:43 . 2012-04-26 04:48 57856 ----a-w- c:\windows\system32\rdpwsx.dll 2012-06-13 23:42 . 2012-04-26 04:43 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-13 23:42 . 2012-05-02 04:52 163328 ----a-w- c:\windows\system32\profsvc.dll 2012-06-13 23:41 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll 2012-06-13 23:41 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-13 23:41 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-13 02:04 . 2012-06-13 02:04 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Canon 2012-06-13 00:35 . 2012-06-13 00:35 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information 2012-06-13 00:35 . 2012-06-13 02:04 -------- d-----w- c:\program files\Canon 2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL 2012-06-13 00:35 . 2010-07-20 23:49 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL 2012-06-13 00:35 . 2010-07-20 23:49 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL 2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL 2012-06-13 00:35 . 2010-07-20 23:49 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL 2012-06-13 00:35 . 2010-07-20 23:49 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll 2012-06-13 00:35 . 2010-07-20 23:48 86016 ----a-w- c:\windows\system32\CNCI4400.DLL 2012-06-13 00:35 . 2010-07-20 23:47 122880 ----a-w- c:\windows\system32\CNCL4400.DLL 2012-06-13 00:34 . 2010-07-20 23:49 143360 ----a-w- c:\windows\system32\CNCE4400.DLL 2012-06-13 00:34 . 2010-07-20 23:48 303104 ----a-w- c:\windows\system32\CNCC4400.DLL 2012-06-13 00:34 . 2010-07-08 23:08 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL 2012-06-13 00:34 . 2009-06-18 09:43 204800 ----a-w- c:\windows\system32\CNCENPR.dll 2012-06-13 00:34 . 2009-06-18 09:43 110592 ----a-w- c:\windows\system32\CNCENPU.dll 2012-06-13 00:34 . 2010-07-07 05:06 139264 ----a-w- c:\windows\system32\CNCENPM.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-30 12:26 . 2012-05-30 12:26 476960 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-05-30 12:26 . 2010-05-24 03:55 472864 ----a-w- c:\windows\system32\deployJava1.dll 2012-07-02 02:36 . 2011-05-30 04:12 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "TrustedNet Connect 2.x"="c:\program files\TrustedNet Connect 2.1\TNCTray.exe" [2003-07-29 86936] "Telstra Connection Manager"="c:\program files\NetComm\Connection Manager\ConnectionManager.exe" [2010-01-29 145408] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-12-21 1483264] "MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LManager"="c:\program files\Launch Manager\LManager.exe" [2009-08-27 1191432] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-18 1537320] "ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-09-04 186912] "Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-19 487424] "BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-09-04 261888] "NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648] "BigPond News Ticker"="c:\program files\BigPond News Ticker\BigPond__News_Ticker.exe" [2009-02-10 759728] "PLD_FrameworkRun"="c:\windows\System32\oem\RunCMD.exe" [2009-08-11 229376] "VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-08-05 3567616] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672] "PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-30 200704] "SignIn"="c:\program files\Microsoft Online Services\Sign In\SignIn.exe" [2010-03-09 1734512] "MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-05 59240] "gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 135168] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 167424] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 144384] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-09 49208] "NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2011-12-13 190768] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "BigPondWirelessBroadbandCM"="c:\program files\Telstra\Mobile Broadband Manager\TelstraUCM.exe" [2011-08-11 6198168] "HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-01 634880] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "MFNetworkScanUtility"="c:\program files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE" [2009-12-15 484760] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-9-16 708608] Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-18 795936] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] My Place.lnk - c:\program files\Next G Connection Manager\Telstra\welcome_best.exe [2010-1-13 4594096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Citrix\system32\mfaphook.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ c:\program files\Acer Bio Protection\PwdFilter Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 . R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.exe [x] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x] R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x] R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x] R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x] R3 IERA;IERA;c:\program files\Sierra Wireless Inc\IERA\IERA.exe [x] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [x] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x] R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x] R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x] R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x] R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x] R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x] R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x] R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x] R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x] R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x] R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x] R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [x] R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [x] R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [x] R3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\swg3kser00.sys [x] R3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\DRIVERS\swiwdmbus.sys [x] R3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\DRIVERS\swiwdmbx.sys [x] R3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\DRIVERS\swnc8ua3.sys [x] R3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\DRIVERS\swumxa3.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\DRIVERS\zghsdiag.sys [x] R3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\DRIVERS\zghsmdm.sys [x] R3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\DRIVERS\zghsnmea.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 cdfdrv;cdfdrv;c:\windows\system32\DRIVERS\cdfdrv.sys [x] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x] S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [x] S2 ctxpidmn;ctxpidmn;c:\windows\system32\DRIVERS\ctxpidmn.sys [x] S2 CtxSbx;CtxSbx;c:\windows\system32\DRIVERS\CtxSbx.sys [x] S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x] S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [x] S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [x] S2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [x] S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [x] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x] S2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [x] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x] S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [x] S2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x] S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x] S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [x] S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [x] S2 RadeSvc;Citrix Streaming Service;c:\program files\Citrix\Streaming Client\RadeSvc.exe [x] S2 regi;regi;c:\windows\system32\drivers\regi.sys [x] S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x] S2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x] S2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\Sierra Wireless Inc\Common\SwiCardDetect.exe [x] S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [x] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x] S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x] S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.exe [x] S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x] S3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x] S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] S3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\TrustedNet Connect 2.1\tncservice.exe [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . --- Other Services/Drivers In Memory --- . *Deregistered* - mfeavfk01 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28] . 2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28] . 2012-06-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003Core.job - c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27] . 2012-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003UA.job - c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27] . . ------- Supplementary Scan ------- . uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956 uInternet Settings,ProxyOverride = 192.168.*.*;*.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 Trusted Zone: localhost Trusted Zone: telstra.com Trusted Zone: telstra.com\prm Trusted Zone: telstra.com.au Trusted Zone: tlsmb.com.au\mail Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //FWEvent.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www TCP: DhcpNameServer = 10.0.0.138 TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0}: NameServer = 10.4.81.103 10.4.182.20 DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab FF - ProfilePath - . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(784) c:\program files\Citrix\system32\CtxSbxHook.DLL . - - - - - - - > 'lsass.exe'(620) c:\program files\Citrix\system32\CtxSbxHook.DLL c:\program files\Acer Bio Protection\PwdFilter.DLL . Completion time: 2012-07-04 10:49:26 ComboFix-quarantined-files.txt 2012-07-04 01:19 . Pre-Run: 385,954,033,664 bytes free Post-Run: 388,331,110,400 bytes free . - - End Of File - - D84609834EB4CF95582933CF364FAE40

Thanks for the asistance Laptop is still behaving a bit sluggish, Ie seems to crash unexpectedly, MBAM scan results below. Malwarebytes Anti-Malware (Trial) 1.61.0.1400 www.malwarebytes.org Database version: v2012.07.02.06 Windows 7 x86 NTFS Internet Explorer 9.0.8112.16421 TBC MB 02 :: TBCMB02-PC [administrator] Protection: Enabled 3/07/2012 9:15:12 AM mbam-log-2012-07-03 (09-15-12).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 423662 Time elapsed: 5 hour(s), 14 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

One of my staff came to me saying his laptop was asking for credit card details from websites that dont usually require verification and that Internet explorer and frefox were both unresponsive in general. DDS logs attached. please help . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32 Run by TBC MB 02 at 16:12:27 on 2012-06-30 Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1811 [GMT 9.5:30] . AV: McAfee® Total Protection™ Service *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee® Total Protection™ Service *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee® Security-as-a-Service *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Acer Bio Protection\CompPtcVUI.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Program Files\Common Files\Citrix\System32\CdfSvc.exe C:\Program Files\Launch Manager\dsiwmis.exe C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe C:\Program Files\Acer\Registration\GregHSRW.exe C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Program Files\Acer Bio Protection\BASVC.exe C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Windows\system32\mfevtps.exe C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\Citrix\Streaming Client\RadeSvc.exe C:\Program Files\Acer\Acer VCM\RS_Service.exe C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe C:\Program Files\Acer\Acer Updater\UpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Common Files\McAfee\SystemCore\mfeann.exe C:\Windows\system32\conhost.exe C:\Windows\system32\PrintIsolationHost.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe C:\Program Files\BigPond News Ticker\BigPond__News_Ticker.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\System32\OEM\RunCmd.exe C:\Program Files\Acer Bio Protection\PdtWzd.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Windows\PLFSetI.exe C:\Program Files\Microsoft Online Services\Sign In\SignIn.exe C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\system32\conhost.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\System32\igfxpers.exe c:\windows\system32\oem\setEvent.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\Telstra\Mobile Broadband Manager\TelstraUCM.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Program Files\TrustedNet Connect 2.1\TNCTray.exe C:\Program Files\NetComm\Connection Manager\ConnectionManager.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Common Files\Apple\Internet Services\ubd.exe C:\Program Files\TrustedNet Connect 2.1\tncservice.exe C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe C:\Windows\system32\conhost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Acer\Acer VCM\AcerVCM.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe C:\Windows\system32\igfxext.exe C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe C:\Windows\system32\DllHost.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exe C:\Windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&m=aspire_4810t&r=27360909b006l03e8zq05t47l1s14p mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956 mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956 uInternet Settings,ProxyOverride = 192.168.*.*;*.local BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110926074541.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll" EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [Google Update] "c:\users\tbc mb 02\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [TrustedNet Connect 2.x] "c:\program files\trustednet connect 2.1\TNCTray.exe" uRun: [Telstra Connection Manager] c:\program files\netcomm\connection manager\ConnectionManager.exe uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe mRun: [LManager] c:\program files\launch manager\LManager.exe mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [ODDPwr] "c:\program files\acer\optical drive power management\ODDPwr.exe" mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe mRun: [backupManagerTray] "c:\program files\newtech infosystems\acer backup manager\BackupManagerTray.exe" -h -k mRun: [NortonOnlineBackupReminder] "c:\program files\symantec\norton online backup\activation\NobuActivation.exe" UNATTENDED mRun: [bigPond News Ticker] "c:\program files\bigpond news ticker\BigPond__News_Ticker.exe" mRun: [PLD_FrameworkRun] c:\windows\system32\oem\runcmd.exe c:\windows\system32\oem\OKTOLaunch_PLD_Framework.cmd mRun: [VitaKeyPdtWzd] "c:\program files\acer bio protection\PdtWzd.exe" mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe mRun: [PLFSetI] c:\windows\PLFSetI.exe mRun: [signIn] "c:\program files\microsoft online services\sign in\SignIn.exe" /autorun mRun: [MVS Splash] "c:\program files\mcafee\managed virusscan\desktopui\XTray.exe" mRun: [XeroxRegistation] "c:\users\tbcmb0~1\appdata\local\temp\xerox\ereg\EReg.exe" /Startup mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [<NO NAME>] mRun: [NSU_agent] "c:\program files\nokia\nokia software updater\nsu3ui_agent.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [bigPondWirelessBroadbandCM] "c:\program files\telstra\mobile broadband manager\TelstraUCM.exe" -tsr mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [MFNetworkScanUtility] c:\program files\canon\canon mf network scan utility\CNMFSUT.EXE mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\myplac~1.lnk - c:\program files\next g connection manager\telstra\welcome_best.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer bio protection\PwdBank.exe IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll Trusted Zone: localhost Trusted Zone: telstra.com Trusted Zone: telstra.com\prm Trusted Zone: telstra.com.au Trusted Zone: tlsmb.com.au\mail Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //FWEvent.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://teamtelstra.webex.com/client/T27L10NSP21EP3/webex/ieatgpc1.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E} : DhcpNameServer = 192.168.1.254 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603432303 : DhcpNameServer = 10.0.0.138 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603934303 : DhcpNameServer = 10.0.0.138 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\36C61627B602E6564777F627B6 : DhcpNameServer = 192.168.20.1 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\452434 : DhcpNameServer = 192.168.5.254 TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\8445340205F627471626C6560284F6473707F647 : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0} : NameServer = 10.4.81.103 10.4.182.20 TCP: Interfaces\{56F3F92A-E39A-409D-BAB7-7D2DF4926FDE} : DhcpNameServer = 10.4.85.135 10.4.176.231 TCP: Interfaces\{A076241E-F287-4440-A75C-6FF8FC204DF6} : DhcpNameServer = 192.168.1.254 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - c:\program files\mcafee\managed virusscan\agent\MyRmProt5.0.0.811.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll AppInit_DLLs: c:\progra~1\citrix\system32\mfaphook.dll LSA: Notification Packages = c:\program files\acer bio protection\PwdFilter . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-16 461864] R1 cdfdrv;cdfdrv;c:\windows\system32\drivers\cdfdrv.sys [2008-7-27 27672] R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-8-12 64712] R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-8-12 164776] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928] R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-9-3 20328] R2 ctxpidmn;ctxpidmn;c:\windows\system32\drivers\ctxpidmn.sys [2008-8-16 22808] R2 CtxSbx;CtxSbx;c:\windows\system32\drivers\CtxSbx.sys [2008-8-16 185880] R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2009-9-16 107016] R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2009-9-16 688128] R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2010-1-13 22528] R2 Greg_Service;GRegService;c:\program files\acer\registration\GregHSRW.exe [2009-8-28 1150496] R2 IGBASVC;EgisTec Service;c:\program files\acer bio protection\BASVC.exe [2009-8-5 3450368] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-29 654408] R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\mcafee\siteadvisor enterprise\McSACore.exe [2011-5-12 324928] R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-1-7 166024] R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2011-1-12 160344] R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-1-7 148520] R2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-12-7 214896] R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064] R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-9-4 62720] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2009-6-18 144640] R2 ODDPwrSvc;Acer ODD Power Service;c:\program files\acer\optical drive power management\ODDPWRSvc.exe [2009-9-16 125472] R2 PassThru Service;Internet Pass-Through Service;c:\program files\htc\internet pass-through\PassThruSvr.exe [2011-9-15 88576] R2 RadeSvc;Citrix Streaming Service;c:\program files\citrix\streaming client\RadeSvc.exe [2008-8-16 398656] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032] R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-9-16 253952] R2 RumorServer;McAfee Peer Distribution Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064] R2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\sierra wireless inc\common\SwiCardDetect.exe [2011-6-24 238960] R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer\version5\TeamViewer_Service.exe [2010-6-28 173352] R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-1 2337144] R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-1-19 3027840] R2 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2009-9-16 240160] R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.361.0\SeaPort.EXE [2012-2-10 240408] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2009-9-16 180736] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-29 22344] R3 MfeAVFK;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-4-16 180008] R3 MfeBOPK;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-4-16 59288] R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-8-12 338040] R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048] R3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\trustednet connect 2.1\TNCService.exe [2010-7-22 320408] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.361.0\BBSvc.EXE [2012-2-10 193816] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176] S2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-9-16 359952] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-6-28 250056] S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-9-16 43944] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-1-13 29472] S3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [2009-8-10 89600] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176] S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408] S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [2010-6-23 23040] S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2009-9-16 101248] S3 IERA;IERA;c:\program files\sierra wireless inc\iera\IERA.exe [2010-8-11 152432] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-7-10 7168] S3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2011-12-16 15896] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-6-29 40776] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-12 87808] S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\windows\system32\drivers\mferkdk.sys [2010-4-16 34248] S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [2009-7-10 25856] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-4-4 20480] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-1-29 8320] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-9-16 4231680] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-5-18 137600] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-5-18 8576] S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2009-6-18 50432] S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-5-31 16472] S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-5-31 11104] S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [2009-10-5 31872] S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2010-7-1 188392] S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [2010-7-1 32872] S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992] S3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\drivers\swg3kser00.sys [2012-3-20 215552] S3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\drivers\swiwdmbus.sys [2010-6-21 78720] S3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\drivers\swiwdmbx.sys [2012-3-20 83968] S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [2012-3-20 208128] S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [2010-6-21 156544] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-6 1343400] S3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\drivers\zghsdiag.sys [2011-12-16 113688] S3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\drivers\zghsmdm.sys [2011-12-16 113688] S3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\drivers\zghsnmea.sys [2011-12-16 113688] . =============== Created Last 30 ================ . 2012-06-30 06:03:43 -------- d-----w- c:\program files\Trend Micro 2012-06-30 03:50:25 -------- d-----w- c:\program files\CCleaner 2012-06-29 05:41:11 -------- d-----w- c:\program files\NoVirusThanks 2012-06-29 00:54:22 -------- d-----w- c:\users\tbc mb 02\appdata\local\Macromedia 2012-06-29 00:40:47 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2012-06-29 00:40:47 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Malwarebytes 2012-06-29 00:39:47 -------- d-----w- c:\programdata\Malwarebytes 2012-06-29 00:39:43 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-29 00:39:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-06-27 23:30:36 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-26 00:57:32 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Foxit Software 2012-06-26 00:53:23 -------- d-----w- c:\program files\Foxit Software 2012-06-22 07:25:29 -------- d-----w- c:\program files\MediaInfo 2012-06-21 23:24:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-06-21 23:23:48 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-06-21 23:23:34 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-06-21 23:23:34 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-19 03:22:39 -------- d-----w- c:\programdata\Windows 2012-06-13 23:43:37 2342400 ----a-w- c:\windows\system32\win32k.sys 2012-06-13 23:43:13 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-13 23:43:07 2342400 ----a-w- c:\windows\system32\msi.dll 2012-06-13 23:43:03 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-13 23:43:00 57856 ----a-w- c:\windows\system32\rdpwsx.dll 2012-06-13 23:42:59 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-13 23:42:50 163328 ----a-w- c:\windows\system32\profsvc.dll 2012-06-13 23:41:29 1156608 ----a-w- c:\windows\system32\crypt32.dll 2012-06-13 23:41:27 139264 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-13 23:41:24 103936 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-13 00:35:37 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information 2012-06-13 00:35:33 -------- d-----w- c:\program files\Canon 2012-06-13 00:35:05 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL 2012-06-13 00:35:05 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL 2012-06-13 00:35:05 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL 2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL 2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL 2012-06-13 00:35:00 86016 ----a-w- c:\windows\system32\CNCI4400.DLL 2012-06-13 00:35:00 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll 2012-06-13 00:35:00 122880 ----a-w- c:\windows\system32\CNCL4400.DLL 2012-06-13 00:34:58 303104 ----a-w- c:\windows\system32\CNCC4400.DLL 2012-06-13 00:34:58 143360 ----a-w- c:\windows\system32\CNCE4400.DLL 2012-06-13 00:34:27 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL 2012-06-13 00:34:19 204800 ----a-w- c:\windows\system32\CNCENPR.dll 2012-06-13 00:34:19 110592 ----a-w- c:\windows\system32\CNCENPU.dll 2012-06-13 00:34:18 139264 ----a-w- c:\windows\system32\CNCENPM.dll . ==================== Find3M ==================== . 2012-06-28 00:19:08 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-30 12:26:10 476960 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-05-30 12:26:10 472864 ----a-w- c:\windows\system32\deployJava1.dll 2012-05-17 22:45:37 1800192 ----a-w- c:\windows\system32\jscript9.dll 2012-05-17 22:35:47 1129472 ----a-w- c:\windows\system32\wininet.dll 2012-05-17 22:35:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2012-05-17 22:29:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2012-05-17 22:24:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-04-02 04:46:44 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-02 04:46:44 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe . ============= FINISH: 16:14:08.62 =============== Attach.txt DDS.txt