Gblock1

November 16, 2012

ran the batch file... all working ok. I did read the rest of your post and will delete any other programs that your team had me install that should be uninstalled. I thank you very much for walking me through this over the past few days. I appreciate it very much! Thanks again for all of your help!!!

November 16, 2012

_{Ran Hijack and did as you advised... Ran Eset and one threat found:}

_{C:\Documents and Settings\GBLOCK\My Documents\Downloads\WinZip165Multi-language.exe a variant of Win32/OpenInstall application}

November 15, 2012

Log of Mbam. and Hijack this......computer seems to be working fine now. No more google redirects and google is funcitioning properly

Log of Mbam

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.11.15.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

GBLOCK :: GLENNEEEPC [administrator]

11/15/2012 12:14:25 AM

mbam-log-2012-11-15 (00-14-25).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 201936

Time elapsed: 3 minute(s), 37 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Log of Hijack this

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 6:00:06 PM, on 11/15/2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\agent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe

C:\Program Files\EeePC\ACPI\AsEPCMon.exe

C:\Program Files\EeePC\ACPI\AsTray.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\AsScrPro.exe

C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe

C:\WINDOWS\system32\igfxext.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\ASUS\Eee Docking\Eee Docking.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe

C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\WinZip\WZQKPICK32.EXE

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\GBLOCK\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe

O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe

O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\AsScrPro.exe

O4 - HKLM\..\Run: [LiveUpdate] C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [synAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe

O4 - HKLM\..\Run: [intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup

O4 - HKLM\..\Run: [VMonitorVMUVC] "C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe" VMUVC

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [ASUSWebStorage] C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S

O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: SuperHybridEngine.lnk = ?

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O4 - Global Startup: VPN Client.lnk = ?

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK32.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll

O18 - Protocol: intu-help-qb3 - {C5E479EA-0A65-4B05-8C6C-2FC8CC682EB4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll

O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Agent - Unknown owner - C:\WINDOWS\agent.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: vToolbarUpdater13.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe

--

End of file - 12443 bytes

November 15, 2012

Google is working fine now without redirecting. Here is log that you requested.

========== OTL ==========

HKU\S-1-5-21-2514897835-882076413-806336791-1005\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKEY_USERS\S-1-5-21-2514897835-882076413-806336791-1005\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-2514897835-882076413-806336791-1005\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.

Registry key HKEY_USERS\S-1-5-21-2514897835-882076413-806336791-1005\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename

Prefs.js: "Ask.com" removed from browser.search.order.1

Prefs.js: true removed from browser.search.useDBForOrder

Prefs.js: avg@toolbar:13.2.0.5 removed from extensions.enabledItems

Prefs.js: "*.local" removed from network.proxy.no_proxies_on

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\GBLOCK\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\GBLOCK\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Default User

User: GBLOCK

User: LocalService

User: NetworkService

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default User

User: GBLOCK

->Flash cache emptied: 148486 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 11142012_230352

November 15, 2012

Copy of OTL.txt log

OTL logfile created on: 11/14/2012 10:35:58 PM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\GBLOCK\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.34 Gb Available Physical Memory | 67.28% Memory free

3.33 Gb Paging File | 2.86 Gb Available in Paging File | 85.79% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 72.06 Gb Total Space | 16.05 Gb Free Space | 22.27% Space Free | Partition Type: NTFS

Drive D: | 72.05 Gb Total Space | 71.98 Gb Free Space | 99.90% Space Free | Partition Type: NTFS

Computer Name: GLENNEEEPC | User Name: GBLOCK | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\GBLOCK\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)

PRC - C:\Program Files\WinZip\WZQKPICK32.EXE (WinZip Computing, S.L.)

PRC - C:\WINDOWS\agent.exe ()

PRC - C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe ()

PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)

PRC - C:\WINDOWS\AsScrPro.exe (ASUS)

PRC - C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

PRC - C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

PRC - C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)

PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\31b7eef43a23e7c6e93594be583f3d08\System.ServiceProcess.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\90ad0c96693527ae685ff40019bb33b0\System.ni.dll ()

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll ()

MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()

MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

MOD - C:\WINDOWS\system32\sdtnpm.dll ()

MOD - C:\WINDOWS\agent.exe ()

MOD - C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt.dll ()

MOD - C:\Program Files\ASUS\LiveUpdate\Enumeration.dll ()

MOD - C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe ()

MOD - C:\Program Files\ASUS\LiveUpdate\ClientSocket.dll ()

MOD - C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Program Files\ASUS\LiveUpdate\Parser.dll ()

MOD - C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

MOD - C:\WINDOWS\system32\btwicons.dll ()

MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()

MOD - C:\WINDOWS\system32\vpnapi.dll ()

MOD - C:\WINDOWS\system32\devenum.dll ()

MOD - C:\WINDOWS\system32\msdmo.dll ()

========== Services (SafeList) ==========

SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found

SRV - (vToolbarUpdater13.2.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()

SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)

SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE (Microsoft Corporation.)

SRV - (Agent) -- C:\WINDOWS\agent.exe ()

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (rpcapd) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)

SRV - (QBCFMonitorService) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)

SRV - (QBFCService) -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)

SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found

DRV - (PDRFRAME) -- File not found

DRV - (PDRELI) -- File not found

DRV - (PDFRAME) -- File not found

DRV - (PDCOMP) -- File not found

DRV - (PCIDump) -- File not found

DRV - (lbrtfdc) -- File not found

DRV - (i2omgmt) -- File not found

DRV - (Changer) -- File not found

DRV - (catchme) -- C:\DOCUME~1\GBLOCK\LOCALS~1\Temp\catchme.sys File not found

DRV - (avgtp) -- C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)

DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)

DRV - (Netaapl) -- C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.)

DRV - (AsUpIO) -- C:\WINDOWS\system32\drivers\AsUpIO.sys ()

DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)

DRV - (VMUVC) -- C:\WINDOWS\system32\drivers\VMUVC.sys (Vimicro Corporation)

DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)

DRV - (FTDIBUS) -- C:\WINDOWS\system32\drivers\ftdibus.sys (FTDI Ltd.)

DRV - (FTSER2K) -- C:\WINDOWS\system32\drivers\ftser2k.sys (FTDI Ltd.)

DRV - (fssfltr) -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)

DRV - (uvclf) -- C:\WINDOWS\system32\drivers\uvclf.sys (GenesysLogic Technologies, Inc.)

DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)

DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)

DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)

DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)

DRV - (vvftUVC) -- C:\WINDOWS\system32\drivers\vvftUVC.sys (Vimicro Corporation)

DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)

DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)

DRV - (AsusACPI) -- C:\WINDOWS\system32\drivers\ASUSACPI.SYS (ASUSTeK Computer Inc.)

DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)

DRV - (btwhid) -- C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)

DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)

DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)

DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)

DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs LLC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={A52AF0D5-672F-4D00-969B-B636178B590D}&mid=0ecffd51abd64f1bb9b4546f4fb78a47-4d2e5c41e3d76b204bb6bca41bc2a2f08b6b494a〈=en&ds=hk011&pr=sa&d=2012-09-18 18:23:32&v=12.2.5.34&sap=hp

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://tbsearch.ask.com/redirect?client=ie&tb=BT3&o=14987&src=crm&q={searchTerms}&locale=en_US

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={A52AF0D5-672F-4D00-969B-B636178B590D}&mid=0ecffd51abd64f1bb9b4546f4fb78a47-4d2e5c41e3d76b204bb6bca41bc2a2f08b6b494a〈=en&ds=hk011&pr=sa&d=2012-09-18 18:23:32&v=12.2.5.34&sap=dsp&q={searchTerms}

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2514897835-882076413-806336791-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.ebay.com"

FF - prefs.js..extensions.enabledItems: avg@toolbar:13.2.0.5

FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll ()

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\GBLOCK\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)

FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\GBLOCK\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\GBLOCK\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\GBLOCK\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\FireFoxExt\13.2.0.5 [2012/11/08 20:47:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/11/11 21:47:07 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/11/11 21:47:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/08/28 19:09:24 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/10/31 15:35:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\GBLOCK\Application Data\Mozilla\Extensions

[2012/11/11 21:47:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\GBLOCK\Application Data\Mozilla\Firefox\Profiles\ie191ljh.default\extensions

[2012/11/11 21:47:29 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\GBLOCK\Application Data\Mozilla\Firefox\Profiles\ie191ljh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

[2012/11/11 21:47:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012/10/24 12:50:58 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012/11/08 20:47:28 | 000,003,574 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml

[2012/10/24 12:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/10/24 12:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/11/14 18:18:34 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKU\S-1-5-21-2514897835-882076413-806336791-1005\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)

O4 - HKLM..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)

O4 - HKLM..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)

O4 - HKLM..\Run: [iMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [LiveUpdate] C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe ()

O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()

O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [synAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)

O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation)

O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()

O4 - HKU\S-1-5-21-2514897835-882076413-806336791-1005..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

O4 - HKU\S-1-5-21-2514897835-882076413-806336791-1005..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ SuperHybridEngine.lnk = C:\Program Files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe (ASUSTeK Computer Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK32.EXE (WinZip Computing, S.L.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2514897835-882076413-806336791-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2514897835-882076413-806336791-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-2514897835-882076413-806336791-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-2514897835-882076413-806336791-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 107.17.124.1 64.134.255.2 64.134.255.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{65197B67-2E55-4FB1-BC95-8142C72E5B4D}: DhcpNameServer = 107.17.124.1 64.134.255.2 64.134.255.10

O18 - Protocol\Handler\intu-help-qb1 {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll (TODO: <Company name>)

O18 - Protocol\Handler\intu-help-qb3 {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll ()

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Eee PC Seashell_1.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Eee PC Seashell_1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/05/20 14:19:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/14 22:34:59 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\GBLOCK\Desktop\OTL.exe

[2012/11/14 21:18:53 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine

[2012/11/14 21:15:42 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2012/11/14 18:38:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012/11/14 18:21:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2012/11/14 18:09:30 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2012/11/14 00:00:56 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2012/11/14 00:00:56 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2012/11/14 00:00:56 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2012/11/14 00:00:56 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2012/11/13 23:51:35 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/11/13 23:51:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt

[2012/11/12 17:16:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\GBLOCK\Desktop\Nacva 2011 RFP_files

[2012/11/12 14:32:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\GBLOCK\Desktop\how_to_find_hidden_assets_files

[2012/11/11 21:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service

[2012/11/11 21:47:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Mozilla

[2012/11/11 11:28:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/11/11 11:28:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2012/11/11 11:28:53 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012/11/11 11:28:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012/11/09 23:22:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\GBLOCK\Desktop\Bench Media Video

[2012/11/08 20:48:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\GBLOCK\Desktop\AICPA 2012 BV Conf Orlando

[2012/10/28 00:07:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\GBLOCK\Desktop\Accounting Today Presentation 10-30-12

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/11/14 22:41:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012/11/14 22:34:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\GBLOCK\Desktop\OTL.exe

[2012/11/14 22:01:47 | 000,436,626 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012/11/14 22:01:47 | 000,069,372 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012/11/14 21:57:54 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/11/14 21:57:45 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk

[2012/11/14 21:57:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/11/14 21:50:40 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Desktop\MBR.dat

[2012/11/14 21:49:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2514897835-882076413-806336791-1005UA.job

[2012/11/14 19:00:13 | 001,664,624 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/11/14 18:49:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2514897835-882076413-806336791-1005Core.job

[2012/11/14 18:42:22 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012/11/14 18:18:34 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2012/11/14 18:09:35 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2012/11/14 07:48:23 | 000,000,432 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Application Data\wklnhst.dat

[2012/11/14 00:02:09 | 000,000,281 | ---- | M] () -- C:\Boot.bak

[2012/11/12 17:21:53 | 000,376,290 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Desktop\NACVA CAll For Presenters.pdf

[2012/11/12 17:16:55 | 000,164,268 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Desktop\Nacva 2011 RFP.htm

[2012/11/12 14:32:17 | 000,076,187 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Desktop\how_to_find_hidden_assets.html

[2012/11/11 21:47:09 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\GBLOCK\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2012/11/11 21:47:09 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2012/11/11 11:28:56 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/11/10 22:03:41 | 000,000,020 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT

[2012/11/08 20:47:25 | 000,026,984 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys

[2012/10/22 03:37:31 | 001,866,368 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\win32k.sys

[2012/10/22 03:37:31 | 001,866,368 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/14 21:50:40 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Desktop\MBR.dat

[2012/11/14 00:02:09 | 000,000,281 | ---- | C] () -- C:\Boot.bak

[2012/11/14 00:02:04 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2012/11/14 00:00:56 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2012/11/14 00:00:56 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2012/11/14 00:00:56 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2012/11/14 00:00:56 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2012/11/14 00:00:56 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2012/11/12 17:16:54 | 000,164,268 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Desktop\Nacva 2011 RFP.htm

[2012/11/12 16:24:00 | 000,376,290 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Desktop\NACVA CAll For Presenters.pdf

[2012/11/12 14:32:15 | 000,076,187 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Desktop\how_to_find_hidden_assets.html

[2012/11/11 21:47:09 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk

[2012/11/11 11:28:56 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/10/04 21:48:50 | 000,000,616 | ---- | C] () -- C:\WINDOWS\obd.ini

[2012/09/18 21:06:53 | 000,000,060 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Application Data\default.pls

[2012/09/18 18:02:30 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\GBLOCK\.rnd

[2012/02/28 22:34:42 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012/02/11 17:10:05 | 000,155,648 | ---- | C] () -- C:\WINDOWS\agent.exe

[2012/02/11 17:10:00 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\sdtnpm.dll

[2011/12/02 00:26:06 | 000,000,116 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc

[2010/04/03 21:34:16 | 000,167,949 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Application Data\mv.db

[2010/04/03 21:34:16 | 000,000,058 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Application Data\settings.ini

[2009/12/12 20:06:27 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/11/14 10:13:10 | 000,000,432 | ---- | C] () -- C:\Documents and Settings\GBLOCK\Application Data\wklnhst.dat

[2009/11/01 17:46:42 | 000,605,092 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3900.QLF

[2009/11/01 17:46:42 | 000,574,840 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3700.QLF

[2009/11/01 17:46:42 | 000,534,484 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3000.QLF

[2009/11/01 17:46:42 | 000,469,504 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP1632.QLF

[2009/11/01 17:46:42 | 000,321,213 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP816.QLF

[2009/11/01 17:46:42 | 000,269,684 | ---- | C] () -- C:\Documents and Settings\GBLOCK\PCD3000.EXE

[2009/11/01 17:46:42 | 000,260,439 | ---- | C] () -- C:\Documents and Settings\GBLOCK\XP600.QLF

[2009/11/01 17:46:42 | 000,211,282 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP800.QLF

[2009/11/01 17:46:42 | 000,210,160 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3900.QLD

[2009/11/01 17:46:42 | 000,209,869 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP800E.QLF

[2009/11/01 17:46:42 | 000,208,735 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3700.QLD

[2009/11/01 17:46:42 | 000,202,705 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP808.QLF

[2009/11/01 17:46:42 | 000,186,388 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP400.QLF

[2009/11/01 17:46:42 | 000,186,159 | ---- | C] () -- C:\Documents and Settings\GBLOCK\XP400.QLF

[2009/11/01 17:46:42 | 000,178,028 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP1632.QLD

[2009/11/01 17:46:42 | 000,174,585 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP816.QLD

[2009/11/01 17:46:42 | 000,141,659 | ---- | C] () -- C:\Documents and Settings\GBLOCK\PCD3000.QLF

[2009/11/01 17:46:42 | 000,007,276 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MA3000.QLD

[2009/11/01 17:46:42 | 000,002,418 | ---- | C] () -- C:\Documents and Settings\GBLOCK\XP600.QLD

[2009/11/01 17:46:42 | 000,002,402 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP800.QLD

[2009/11/01 17:46:42 | 000,002,212 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP808.QLD

[2009/11/01 17:46:42 | 000,002,195 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP800E.QLD

[2009/11/01 17:46:42 | 000,001,846 | ---- | C] () -- C:\Documents and Settings\GBLOCK\MODEM.LST

[2009/11/01 17:46:42 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\GBLOCK\XP400.QLD

[2009/11/01 17:46:42 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\GBLOCK\GP400.QLD

[2009/10/21 16:44:10 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\SystemConfiguration

[2009/10/21 16:44:10 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\GBLOCK\Application Data\Synth Leads

[2009/10/21 16:44:10 | 000,000,012 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Clips

[2009/10/21 16:40:14 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT

[2009/10/21 12:14:23 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\GBLOCK\default.pls

[2009/10/09 18:20:41 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat

========== ZeroAccess Check ==========

[2009/06/22 22:59:57 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2009/03/02 18:04:03 | 001,499,136 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 07:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

< End of report >

November 15, 2012

Copies of TDSS log and ASWMBR log.

21:20:38.0578 2544 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

21:20:39.0312 2544 ============================================================

21:20:39.0312 2544 Current date / time: 2012/11/14 21:20:39.0312

21:20:39.0312 2544 SystemInfo:

21:20:39.0312 2544

21:20:39.0312 2544 OS Version: 5.1.2600 ServicePack: 3.0

21:20:39.0312 2544 Product type: Workstation

21:20:39.0312 2544 ComputerName: GLENNEEEPC

21:20:39.0312 2544 UserName: GBLOCK

21:20:39.0312 2544 Windows directory: C:\WINDOWS

21:20:39.0312 2544 System windows directory: C:\WINDOWS

21:20:39.0312 2544 Processor architecture: Intel x86

21:20:39.0312 2544 Number of processors: 2

21:20:39.0312 2544 Page size: 0x1000

21:20:39.0312 2544 Boot type: Normal boot

21:20:39.0312 2544 ============================================================

21:20:40.0515 2544 BG loaded

21:20:41.0078 2544 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

21:20:41.0093 2544 ============================================================

21:20:41.0093 2544 \Device\Harddisk0\DR0:

21:20:41.0109 2544 MBR partitions:

21:20:41.0109 2544 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x901F5C0

21:20:41.0109 2544 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x901F5FF, BlocksNum 0x901B73E

21:20:41.0109 2544 ============================================================

21:20:41.0218 2544 C: <-> \Device\Harddisk0\DR0\Partition1

21:20:41.0375 2544 D: <-> \Device\Harddisk0\DR0\Partition2

21:20:41.0515 2544 ============================================================

21:20:41.0515 2544 Initialize success

21:20:41.0515 2544 ============================================================

21:21:57.0234 2464 Deinitialize success

Run date: 2012-11-14 21:26:53

-----------------------------

21:26:53.734 OS Version: Windows 5.1.2600 Service Pack 3

21:26:53.734 Number of processors: 2 586 0x1C02

21:26:53.734 ComputerName: GLENNEEEPC UserName: GBLOCK

21:26:54.218 Initialize success

21:32:31.546 AVAST engine defs: 12111401

21:32:42.281 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

21:32:42.296 Disk 0 Vendor: Hitachi_ FB2O Size: 152627MB BusType: 3

21:32:42.328 Disk 0 MBR read successfully

21:32:42.328 Disk 0 MBR scan

21:32:42.375 Disk 0 Windows XP default MBR code

21:32:42.390 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 73790 MB offset 63

21:32:42.421 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 73782 MB offset 151123455

21:32:42.453 Disk 0 Partition 3 00 1C Hidd FAT32 LBA MSDOS5.0 5004 MB offset 302230845

21:32:42.484 Disk 0 Partition 4 00 EF EFI FAT A1311 47 MB offset 312480315

21:32:42.500 Disk 0 scanning sectors +312576705

21:32:42.578 Disk 0 scanning C:\WINDOWS\system32\drivers

21:32:55.078 Service scanning

21:33:21.046 Modules scanning

21:33:27.312 Disk 0 trace - called modules:

21:33:27.359 ntkrnlpa.exe CLASSPNP.SYS disk.sys tsk32.tmp hal.dll iaStor.sys

21:33:27.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a3a3030]

21:33:27.375 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000073[0x8a38d8d8]

21:33:27.390 5 tsk32.tmp[b9f51620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x89de5028]

21:33:27.921 AVAST engine scan C:\WINDOWS

21:33:56.968 AVAST engine scan C:\WINDOWS\system32

21:37:59.921 AVAST engine scan C:\WINDOWS\system32\drivers

21:38:16.812 AVAST engine scan C:\Documents and Settings\GBLOCK

21:44:45.031 AVAST engine scan C:\Documents and Settings\All Users

21:45:59.734 Scan finished successfully

21:50:40.250 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\GBLOCK\Desktop\MBR.dat"

21:50:40.281 The log file has been saved successfully to "C:\Documents and Settings\GBLOCK\Desktop\aswMBR.txt"

November 14, 2012

Oops.... sorry..., I may have jumped the gun to soon on this one by saying everything was working. I'm still having the same problem, though this morning, it seemed to have worked fine for a little bit. I will wait for further instructions from you, but in the meantime, I followwed your request, and here is the output log:

ComboFix 12-11-14.01 - GBLOCK 11/14/2012 18:10:58.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1435 [GMT -5:00]

Running from: c:\documents and settings\GBLOCK\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\GBLOCK\Desktop\CFScript1.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\GBLOCK\WINDOWS

c:\windows\IsUn0407.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-14 to 2012-11-14 )))))))))))))))))))))))))))))))

.

2012-11-12 02:45 . 2012-10-24 17:50 16864 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe

2012-11-11 16:32 . 2012-11-11 16:32 8282192 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\BingBar\BBSvc\7.1.391.0oemBingBarSetup-Partner.EXE

2012-11-11 16:28 . 2012-11-11 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2012-11-11 16:28 . 2012-11-11 16:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-11-11 16:28 . 2012-09-30 00:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-09 01:47 . 2012-09-18 22:23 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys

2012-10-14 02:41 . 2012-04-25 03:19 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-10-14 02:41 . 2011-06-04 20:53 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-08-28 15:14 . 2009-05-20 19:07 916992 ------w- c:\windows\system32\wininet.dll

2012-08-28 15:14 . 2009-05-20 19:07 43520 ------w- c:\windows\system32\licmgr10.dll

2012-08-28 15:14 . 2009-05-20 19:07 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-08-28 12:07 . 2009-05-20 19:07 385024 ------w- c:\windows\system32\html.iec

2012-08-24 13:53 . 2009-05-20 19:07 177664 ----a-w- c:\windows\system32\wintrust.dll

2012-08-21 13:33 . 2008-04-14 00:54 2148864 ------w- c:\windows\system32\ntoskrnl.exe

2012-08-21 12:58 . 2008-04-14 00:01 2027520 ------w- c:\windows\system32\ntkrnlpa.exe

2012-10-24 17:50 . 2012-11-12 02:47 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{CC5FC992-B0AA-47CD-9DC2-83445083CBB8}"

[HKEY_CLASSES_ROOT\CLSID\{CC5FC992-B0AA-47CD-9DC2-83445083CBB8}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{618A47A2-528B-4D9A-AFC8-97D3233511E2}"

[HKEY_CLASSES_ROOT\CLSID\{618A47A2-528B-4D9A-AFC8-97D3233511E2}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2009-06-08 397312]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2009-03-25 1840424]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2009-04-17 630784]

"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-03-13 98304]

"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-04-17 118784]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-27 17567744]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-04-10 1512744]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-07-08 3054136]

"LiveUpdate"="c:\program files\Asus\LiveUpdate\LiveUpdate.exe" [2010-01-29 751592]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-04-10 79144]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-08-31 996616]

"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-03-26 135168]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-19 421736]

"ASUSWebStorage"="c:\program files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-11-09 997320]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2009-04-08 570664]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-6-22 376832]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-3 1153824]

VPN Client.lnk - c:\windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico [2009-11-25 6144]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK32.EXE [2012-4-4 603536]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-10-15 05:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2009-02-07 01:51 3885408 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=

"c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Honeywell\\Fusion\\Remote\\Utility\\IP_Finder.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2010\\QBDBMgrN.exe"=

"c:\\Documents and Settings\\GBLOCK\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [7/7/2010 5:18 PM 11448]

R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [9/18/2012 5:23 PM 26984]

R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [10/20/2009 1:19 PM 50704]

R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [11/8/2012 8:47 PM 711112]

R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [6/11/2012 4:22 PM 240208]

R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [6/1/2009 2:26 AM 38912]

R3 uvclf;uvclf;c:\windows\system32\drivers\uvclf.sys [6/1/2009 2:26 AM 39040]

S2 Agent;Agent;c:\windows\agent.exe [2/11/2012 5:10 PM 155648]

S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [6/11/2012 4:22 PM 193616]

S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7/13/2012 12:28 PM 160944]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6/22/2009 10:49 PM 1684736]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [10/16/2009 11:36 PM 17408]

S3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [4/3/2010 9:19 PM 252032]

S3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [4/3/2010 9:19 PM 398720]

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 02:41]

.

2012-09-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2514897835-882076413-806336791-1005Core.job

- c:\documents and settings\GBLOCK\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-26 04:54]

.

2012-11-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2514897835-882076413-806336791-1005UA.job

- c:\documents and settings\GBLOCK\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-26 04:54]

.

------- Supplementary Scan -------

.

uStart Page = https://isearch.avg.com/?cid={A52AF0D5-672F-4D00-969B-B636178B590D}&mid=0ecffd51abd64f1bb9b4546f4fb78a47-4d2e5c41e3d76b204bb6bca41bc2a2f08b6b494a〈=en&ds=hk011&pr=sa&d=2012-09-18 18:23&v=12.2.5.34&sap=hp

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 107.17.124.1 64.134.255.2 64.134.255.10

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll

FF - ProfilePath - c:\documents and settings\GBLOCK\Application Data\Mozilla\Firefox\Profiles\ie191ljh.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.ebay.com

FF - ExtSQL: 2012-11-11 21:45; avg@toolbar; c:\documents and settings\All Users\Application Data\AVG Secure Search\FireFoxExt\13.2.0.5

FF - ExtSQL: !HIDDEN! 2009-10-20 23:01; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

- - - - ORPHANS REMOVED - - - -

.

HKLM_ActiveSetup-Neat ADF Scanner 2008 - reg copy HKLM\Software\The Neat Company\Neat ADF Scanner 2008 HKCU\Software\The Neat Company\Neat ADF Scanner 2008

HKLM_ActiveSetup-Send To Neat - reg copy HKLM\Software\The Neat Company\Send To Neat HKCU\Software\The Neat Company\Send To Neat

AddRemove-EDIABAS WinKFP Uninstall - c:\windows\IsUn0407.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-14 18:18

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2012-11-14 18:21:26

ComboFix-quarantined-files.txt 2012-11-14 23:21

ComboFix2.txt 2012-11-14 05:12

.

Pre-Run: 17,660,731,392 bytes free

Post-Run: 17,640,415,232 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - D59E67A2AF84556C708D88AD371E9465

November 14, 2012

I did go to your links...., not sure how I ended up with an old copy......, but the good news is when I turned on my computer today, all seems to be working just fine. Perhaps a reboot did the trick. In any event, I thank you very very much for all of your support.

Glenn

November 14, 2012

Still not working.... here is combofix log. Thanks.

ComboFix 09-11-25.01 - GBLOCK 11/14/2012 0:05.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1450 [GMT -5:00]

Running from: c:\documents and settings\GBLOCK\My Documents\Downloads\ComboFix.exe

.

- REDUCED FUNCTIONALITY MODE -

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\Cache

c:\windows\system32\Cache\272512937d9e61a4.fb

c:\windows\system32\Cache\287204568329e189.fb

c:\windows\system32\Cache\28bc8f716fd76a47.fb

c:\windows\system32\Cache\31a0997e9a5b5eb3.fb

c:\windows\system32\Cache\32c84fe32bb74d60.fb

c:\windows\system32\Cache\3917078cb68ec657.fb

c:\windows\system32\Cache\590ba23ce359fd0c.fb

c:\windows\system32\Cache\610289e025a3ee9a.fb

c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb

c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb

c:\windows\system32\Cache\6d03dad1035885d3.fb

c:\windows\system32\Cache\79908ce3cf8c3a41.fb

c:\windows\system32\Cache\a8556537add6dfc5.fb

c:\windows\system32\Cache\ad10a52aff5e038d.fb

c:\windows\system32\Cache\c1fa887b03019701.fb

c:\windows\system32\Cache\c4d28dca2e7648be.fb

c:\windows\system32\Cache\d201ef9910cd39de.fb

c:\windows\system32\Cache\d2e94710a5708128.fb

c:\windows\system32\Cache\d79b9dfe81484ec4.fb

c:\windows\system32\Cache\f998975c9cc711ee.fb

c:\windows\system32\twain_32.dll

.

((((((((((((((((((((((((( Files Created from 2012-10-14 to 2012-11-14 )))))))))))))))))))))))))))))))

.

2012-11-12 02:47 . 2012-11-12 02:47 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-11-11 16:32 . 2012-11-11 16:32 8282192 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\BingBar\BBSvc\7.1.391.0oemBingBarSetup-Partner.EXE

2012-11-11 16:28 . 2012-11-11 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2012-11-11 16:28 . 2012-11-11 16:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-11-11 16:28 . 2012-09-30 00:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-10-26 19:00 . 2012-10-26 19:00 4735512 ----a-w- c:\documents and settings\GBLOCK\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll

2012-10-26 18:59 . 2012-10-26 18:59 329240 ----a-w- c:\documents and settings\GBLOCK\Application Data\Mozilla\plugins\npgoogletalk.dll

2012-10-26 18:17 . 2012-10-26 18:17 3734536 ----a-w- c:\documents and settings\GBLOCK\Application Data\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-14 04:48 . 2012-09-18 22:23 -------- d-----w- c:\program files\AVG Secure Search

2012-11-14 04:44 . 2009-10-09 23:44 -------- d-----w- c:\program files\Mozilla Thunderbird

2012-11-11 03:03 . 2009-10-21 21:40 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLbz.DAT

2012-11-10 21:55 . 2010-10-26 02:18 -------- d-----w- c:\documents and settings\GBLOCK\Application Data\vlc

2012-11-09 01:47 . 2012-09-18 22:23 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Secure Search

2012-11-09 01:47 . 2012-09-18 22:23 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys

2012-10-14 19:56 . 2009-06-23 04:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2012-10-14 19:49 . 2009-06-23 03:51 -------- d-----w- c:\program files\Microsoft Works

2012-10-14 02:41 . 2012-04-25 03:19 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-10-05 01:25 . 2012-10-05 01:25 -------- d-----w- c:\program files\7-Zip

2012-10-01 16:30 . 2009-10-09 23:17 -------- d-----w- c:\documents and settings\GBLOCK\Application Data\Skype

2012-10-01 16:28 . 2009-06-23 04:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2012-10-01 16:28 . 2012-10-01 16:28 -------- d-----w- c:\program files\Common Files\Skype

2012-10-01 16:28 . 2012-10-01 16:28 -------- d-----r- c:\program files\Skype

2012-09-18 23:00 . 2009-10-21 16:38 -------- d-----w- c:\program files\Common Files\Nero

2012-09-18 22:59 . 2012-09-18 22:59 -------- d-----w- c:\program files\Nero

2012-09-18 22:58 . 2009-10-21 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero

2012-09-18 22:24 . 2012-09-18 22:24 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip

2012-09-18 22:23 . 2012-09-18 22:23 -------- d-----w- c:\documents and settings\GBLOCK\Application Data\AVG Secure Search

2012-09-18 22:23 . 2012-09-18 22:23 -------- d-----w- c:\program files\Common Files\AVG Secure Search

2012-08-28 15:14 . 2009-05-20 19:07 916992 ----a-w- c:\windows\system32\wininet.dll

2012-08-28 15:14 . 2009-05-20 19:07 43520 ------w- c:\windows\system32\licmgr10.dll

2012-08-24 13:53 . 2009-05-20 19:07 177664 ----a-w- c:\windows\system32\wintrust.dll

2012-08-21 13:33 . 2008-04-14 00:54 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-21 12:58 . 2008-04-14 00:01 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-10-24 17:50 . 2012-11-12 02:47 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{CC5FC992-B0AA-47CD-9DC2-83445083CBB8}"

[HKEY_CLASSES_ROOT\CLSID\{CC5FC992-B0AA-47CD-9DC2-83445083CBB8}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{618A47A2-528B-4D9A-AFC8-97D3233511E2}"

[HKEY_CLASSES_ROOT\CLSID\{618A47A2-528B-4D9A-AFC8-97D3233511E2}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020" [X]

"Eee Docking"="c:\program files\ASUS\Eee Docking\Eee Docking.exe" [2009-06-08 397312]

"Google Update"="c:\documents and settings\GBLOCK\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2011-03-26 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup" [X]

"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe VMUVC" [X]