nikeflyair

Apparenty while I was running combo fix norton was on but I don't have norton installed on my computer.

And the following is the fixlog Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-11-2012 Ran by SYSTEM at 2012-12-02 12:49:32 Run:1 Running from F:\ ============================================== startHKU\Daniel\...\Run: [FqgJqgst] C:\Users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exe [102056 2012-11-30] ()C:\Users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exeC:\Users\Daniel\Start Menu\Programs\Startup\fqgjqgst.exe2012-11-30 16:46 - 2012-12-01 16:01 - 00000000 ____A C:\Users\Daniel\AppData\Local\aadwrsfq.log2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\fchlvidc.log2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\cwvbxftk.log2012-11-30 16:41 - 2012-11-30 22:19 - 00000000 ____D C:\Users\Daniel\AppData\Local\wkowggjd2012-11-30 16:41 - 2012-11-30 16:41 - 00000064 ____A C:\Users\All Users\txbahwro.log2012-12-01 15:54 - 2012-11-30 19:18 - 00195770 ____A C:\Users\Daniel\AppData\Local\ikpidmue.log2012-11-30 22:19 - 2012-11-30 16:41 - 00000000 ____D C:\Users\Daniel\AppData\Local\wkowggjd2012-11-30 19:18 - 2012-11-30 19:18 - 00455142 ____A C:\Users\Daniel\AppData\Local\rfkdpsof.log2012-11-30 19:18 - 2012-11-30 19:18 - 00003307 ____A C:\Users\Daniel\AppData\Local\pmtgduve.log2012-11-30 19:18 - 2012-11-30 19:18 - 00003247 ____A C:\Users\Daniel\AppData\Local\vtdsudwf.log2012-11-30 19:17 - 2012-11-30 19:17 - 00446448 ____A C:\Users\Daniel\AppData\Local\enapffrn.log2012-11-30 19:17 - 2012-11-30 19:17 - 00005370 ____A C:\Users\Daniel\AppData\Local\lgnaobbi.log2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\fchlvidc.log2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\cwvbxftk.log2012-11-30 16:41 - 2012-11-30 16:41 - 00000064 ____A C:\Users\All Users\txbahwro.logend not found. HKEY_USERS\startDaniel\Software\Microsoft\Windows\CurrentVersion\Run\\startFqgJqgst Value not found. ==== End of Fixlog ====

Hi Sorry for the late replay but the following is the Combo Fix log. ComboFix 12-12-01.02 - Daniel 02/12/2012 14:04:25.3.8 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.6072.4806 [GMT 11:00] Running from: c:\users\Daniel\Desktop\ComboFix.exe AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exe c:\users\Daniel\Desktop\Personal\Origami\Origami_1\Origami eBooks\Ghep monum\Ebook\Chinese origami book (full)\_desktop.ini . . ((((((((((((((((((((((((( Files Created from 2012-11-02 to 2012-12-02 ))))))))))))))))))))))))))))))) . . 2012-12-02 03:13 . 2012-12-02 03:13 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-12-02 03:13 . 2012-12-02 03:13 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp 2012-12-02 03:13 . 2012-12-02 03:13 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-12-01 21:29 . 2012-12-01 21:29 -------- d-----w- C:\FRST 2012-12-01 06:04 . 2012-10-30 22:51 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys 2012-12-01 06:04 . 2012-10-30 22:51 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-12-01 06:04 . 2012-10-30 22:51 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2012-12-01 06:04 . 2012-10-15 15:59 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys 2012-12-01 06:04 . 2012-10-30 22:51 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-12-01 06:04 . 2012-10-30 22:51 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-12-01 06:04 . 2012-10-30 22:50 285328 ----a-w- c:\windows\system32\aswBoot.exe 2012-12-01 06:03 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr 2012-12-01 06:03 . 2012-10-30 22:50 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe 2012-12-01 06:03 . 2012-12-01 06:03 -------- d-----w- c:\programdata\AVAST Software 2012-12-01 06:03 . 2012-12-01 06:03 -------- d-----w- c:\program files\AVAST Software 2012-12-01 00:41 . 2012-12-02 02:12 -------- d-----w- c:\users\Daniel\AppData\Local\wkowggjd 2012-12-01 00:41 . 2012-12-01 00:41 102056 --s---w- c:\users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fqgjqgst.exe 2012-11-21 06:01 . 2012-11-21 06:01 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi 2012-11-16 09:10 . 2012-11-16 09:10 -------- d-----w- c:\program files (x86)\Guild Wars 2 2012-11-16 08:31 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-16 08:31 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-16 08:31 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-16 08:31 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-16 08:29 . 2012-10-09 18:17 226816 ----a-w- c:\windows\system32\dhcpcore6.dll 2012-11-16 08:29 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll 2012-11-16 08:29 . 2012-10-09 17:40 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll 2012-11-16 08:29 . 2012-10-09 17:40 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll 2012-11-16 08:27 . 2012-10-03 17:56 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-11-16 08:27 . 2012-10-03 17:44 303104 ----a-w- c:\windows\system32\nlasvc.dll 2012-11-16 08:27 . 2012-10-03 17:44 246272 ----a-w- c:\windows\system32\netcorehc.dll 2012-11-16 08:27 . 2012-10-03 17:44 216576 ----a-w- c:\windows\system32\ncsi.dll 2012-11-16 08:27 . 2012-10-03 17:42 569344 ----a-w- c:\windows\system32\iphlpsvc.dll 2012-11-16 08:27 . 2012-10-03 16:42 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll 2012-11-16 08:27 . 2012-10-03 16:42 156672 ----a-w- c:\windows\SysWow64\ncsi.dll 2012-11-16 08:27 . 2012-10-03 17:44 70656 ----a-w- c:\windows\system32\nlaapi.dll 2012-11-16 08:27 . 2012-10-03 17:44 18944 ----a-w- c:\windows\system32\netevent.dll 2012-11-16 08:27 . 2012-10-03 16:42 18944 ----a-w- c:\windows\SysWow64\netevent.dll 2012-11-16 08:27 . 2012-10-03 16:07 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2012-11-16 08:27 . 2012-01-13 07:12 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll 2012-11-16 08:26 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll 2012-11-16 08:26 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll 2012-11-04 11:16 . 2012-10-25 23:50 258352 ----a-w- c:\windows\SysWow64\unicows.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-20 06:54 . 2011-05-26 06:31 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll 2012-11-20 06:54 . 2011-06-17 07:08 336208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-11-17 10:02 . 2011-06-14 05:58 336208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-11-16 08:29 . 2011-04-07 04:50 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-11-14 10:16 . 2012-03-28 09:48 283032 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-11-14 10:16 . 2011-04-20 14:28 283032 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-11-14 10:12 . 2011-04-20 14:28 298016 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-11-11 05:18 . 2011-05-03 09:14 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll 2012-10-26 01:36 . 2012-10-26 01:36 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-24 16:12 . 2012-10-24 16:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-10-24 16:12 . 2012-10-24 16:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2012-10-21 07:27 . 2011-04-20 14:28 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-10-15 07:59 . 2012-10-15 07:59 3584 ----a-r- c:\users\Daniel\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe 2012-09-29 08:54 . 2012-04-15 09:38 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-20 04:35 . 2012-10-15 21:20 203104 ----a-w- c:\windows\system32\drivers\ssudmdm.sys 2012-09-20 04:35 . 2012-10-15 21:20 102368 ----a-w- c:\windows\system32\drivers\ssudbus.sys 2012-09-14 19:19 . 2012-10-10 07:25 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-10 07:25 2048 ----a-w- c:\windows\SysWow64\tzres.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] "KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2012-10-11 966072] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-11-02 843208] "KiesAirMessage"="c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe" [2012-10-09 580096] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-10-15 1353080] "FqgJqgst"="c:\users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exe" [bU] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-05-01 2454840] "TRCMan"="c:\program files (x86)\TOSHIBA\TRCMan\TRCMan.exe" [2010-08-20 714104] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-02-11 1295736] "TOSDCR"="c:\program files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe" [2007-08-28 169296] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-10-11 309688] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776] "ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-11-19 2254768] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-24 421888] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136] . c:\users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ fqgjqgst.exe [2012-12-1 102056] Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDockFree\ObjectDock.exe [N/A] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2012-1-9 107720] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 . R1 aswSnx;aswSnx; [x] R1 aswSP;aswSP; [x] R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120317.002\BHDrvx64.sys [2012-03-02 1157240] R1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1306010.008\ccSetx64.sys [2011-11-29 167048] R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120321.001\IDSvia64.sys [2012-03-06 488568] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1306010.008\Ironx64.SYS [2012-01-17 190072] R1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1306010.008\SYMNETS.SYS [2012-01-17 405624] R2 aswFsBlk;aswFsBlk; [x] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600] R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-01-28 249200] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448] R2 Crazy Johns Broadband. RunOuc;Crazy Johns Broadband. OUC;c:\program files (x86)\Crazy Johns Broadband\UpdateDog\ouc.exe [2012-05-15 246112] R2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336] R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.6.1.8\ccSvcHst.exe [2012-01-17 138232] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 14112] R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2010-08-19 386344] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-29 382272] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-07-28 267192] R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-03 2320920] R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe [2012-04-26 2438696] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-02-04 138360] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2012-05-15 117248] R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [2012-05-15 98816] R3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2011-12-20 29184] R3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-23 35008] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-02-11 54136] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560] R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-07-22 822192] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 USBTINSP;TI-Nspire Handheld or TI Network Bridge Device Driver;c:\windows\system32\DRIVERS\tinspusb.sys [2010-03-29 142848] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-05 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1306010.008\SYMDS64.SYS [2011-07-26 451192] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1306010.008\SYMEFA64.SYS [2012-01-17 1092728] S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880] S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2009-06-29 14784] S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2010-09-02 482384] S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-11-19 2462128] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [2009-07-02 60416] S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [2010-05-08 80384] S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [2011-04-25 53760] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 14472] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-06-24 52320] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-08-31 6656] S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2012-05-15 86016] S3 nuvotonhidcir;Nuvoton HID CIR Receiver;c:\windows\system32\DRIVERS\nuvotonhidcir.sys [2009-08-31 26624] S3 nuvotonir;Nuvoton CIR Transceiver;c:\windows\system32\DRIVERS\nuvotonir.sys [2009-08-31 68096] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-09 539240] S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-06-11 1110560] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . Contents of the 'Scheduled Tasks' folder . 2012-12-01 c:\windows\Tasks\avast! Emergency Update.job - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-12-01 22:50] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 06:31] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 06:31] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-67684466-253165790-691636694-1001Core.job - c:\users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-07 16:59] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-67684466-253165790-691636694-1001UA.job - c:\users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-07 16:59] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ThpSrv"="c:\windows\system32\thpsrv" [X] "TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [bU] "TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [bU] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976] "TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [bU] "TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [bU] "Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [bU] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [bU] "SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [bU] "SmartFaceVWatcher"="c:\program files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [bU] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-10 10103840] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-10 896032] "HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [bU] "HDMICtrlMan"="c:\program files (x86)\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [bU] "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [bU] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-05 500208] "00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [bU] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-07-22 464744] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105 FF - ProfilePath - c:\users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\kvrd2il1.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Freecorder Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT1060933&SearchSource=13 FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.6.1.8\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.6.1.8\diMaster.dll\" /prefetch:1" "ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z [\]^_†\00\00†\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~†\00\00†\00\00\00\00†\00\00\00\00\00\00\00\00‘’“" . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-67684466-253165790-691636694-1001\Software\SecuROM\License information*] "datasecu"=hex:a8,ae,bd,fd,24,e1,02,2d,a4,ba,e9,38,35,44,19,7a,e8,de,c5,68,d6, 27,5e,c4,7f,1a,83,9a,ff,4b,fb,07,54,ae,31,8f,1b,b8,22,3b,1e,7c,3c,37,58,e4,\ "rkeysecu"=hex:93,20,4b,c4,19,cf,c0,26,f9,5f,bd,66,d2,45,f6,3b . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\12116EC4637FFCA42B5405005035D8EC\9C8928403D4AB094F99FBA20A329833F] @DACL=(02 0000) "PatchGUID"="" "MediaCabinet"="" "File"="SteamService.exe" "ComponentVersion"="1.5.31.0" "ProductVersion"="1.0.0" "PatchSize"="0" "PatchAttributes"="0" "PatchSequence"="0" "SharedComponent"="0" "IsFullFile"="0" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\7C5BEC8A0707BFF4FB4A686C99C69900\9C8928403D4AB094F99FBA20A329833F] @DACL=(02 0000) "PatchGUID"="" "MediaCabinet"="" "File"="Steam.exe1" "ComponentVersion"="1.0.968.628" "ProductVersion"="1.0.0" "PatchSize"="0" "PatchAttributes"="0" "PatchSequence"="0" "SharedComponent"="0" "IsFullFile"="0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\http://schemas.microsoft.com/office/smartdocuments/2003\0] "Key"="http://schemas.microsoft.com/office/smartdocuments/2003" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\http://schemas.microsoft.com/office/smartdocuments/2003\0\{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}\Alias] "0"="Microsoft Actions Pane 3" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-12-02 14:17:30 ComboFix-quarantined-files.txt 2012-12-02 03:17 ComboFix2.txt 2012-12-02 02:19 ComboFix3.txt 2012-12-01 02:57 . Pre-Run: 116,958,449,664 bytes free Post-Run: 116,644,884,480 bytes free . - - End Of File - - FF4B022D79B2E640C5F76CEA9F3EEEB4

Thankyou for the quick reply and a appreciate your help. Below is the FRST log. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-11-2012 (ATTENTION: FRST version is 9 days old) Ran by SYSTEM at 02-12-2012 11:53:55 Running from F:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [x] HKLM\...\Run: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe [x] HKLM\...\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation) HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [x] HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [x] HKLM\...\Run: [ThpSrv] C:\windows\system32\thpsrv /logon [x] HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [x] HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [x] HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [x] HKLM\...\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [x] HKLM\...\Run: [smartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [x] HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10103840 2010-03-09] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 [896032 2010-03-09] (Realtek Semiconductor) HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [x] HKLM\...\Run: [HDMICtrlMan] %ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe [x] HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [x] HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [500208 2010-03-05] (Adobe Systems Incorporated) HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [x] HKLM-x32\...\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun [2454840 2010-05-01] (TOSHIBA CORPORATION.) HKLM-x32\...\Run: [TRCMan] C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe [714104 2010-08-20] (TOSHIBA Corporation) HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1295736 2011-02-10] (TOSHIBA Corporation) HKLM-x32\...\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe [x] HKLM-x32\...\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [309688 2012-10-10] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.) HKLM-x32\...\Run: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START [x] HKLM-x32\...\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation) HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [402432 2010-07-22] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2254768 2012-11-19] (LogMeIn Inc.) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-27] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-24] (Apple Inc.) HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4297136 2012-10-30] (AVAST Software) HKU\Daniel\...\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [59240 2012-02-22] (Apple Inc.) HKU\Daniel\...\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload [966072 2012-10-10] (Samsung) HKU\Daniel\...\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [843208 2012-11-02] (Samsung) HKU\Daniel\...\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup [580096 2012-10-08] (Samsung Electronics) HKU\Daniel\...\Run: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [1353080 2012-10-15] (Valve Corporation) HKU\Daniel\...\Run: [FqgJqgst] C:\Users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exe [102056 2012-11-30] () HKU\Daniel\...\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [843208 2012-11-02] (Samsung) HKU\UpdatusUser\...\RunOnce: [spchecker] "C:\Program Files (x86)\AVG\AVG10\Notification\SPCheckerTE.exe" [x] Startup: C:\Users\All Users\Start Menu\Programs\Startup\Rainmeter.lnk ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe () Startup: C:\Users\Daniel\Start Menu\Programs\Startup\fqgjqgst.exe () Startup: C:\Users\Daniel\Start Menu\Programs\Startup\Stardock ObjectDock.lnk ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (No File) ==================== Services (Whitelisted) =================== 2 avast! Antivirus; "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" [44808 2012-10-30] (AVAST Software) 3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-25] (mobile concepts GmbH) 2 Crazy Johns Broadband. RunOuc; C:\Program Files (x86)\Crazy Johns Broadband\UpdateDog\ouc.exe [246112 2012-05-14] () 2 HWDeviceService64.exe; "C:\ProgramData\DatacardService\HWDeviceService64.exe" -/service [346976 2011-03-14] () 2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\19.6.1.8\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\19.6.1.8\diMaster.dll" /prefetch:1 [309688 2012-01-24] (Symantec Corporation) 2 PnkBstrA; C:\windows\SysWow64\PnkBstrA.exe [76888 2012-10-20] () 2 RichVideo64; "C:\Program Files\CyberLink\Shared files\RichVideo64.exe" [386344 2010-08-18] () 2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) 2 W3SVC; C:\Windows\SysWow64\inetsrv\iisw3adm.dll [397824 2010-11-20] (Microsoft Corporation) 2 mi-raysat_3dsmax9_32; "C:\Program Files (x86)\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe" [x] ==================== Drivers (Whitelisted) ===================== 2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [25232 2012-10-30] (AVAST Software) 2 aswMonFlt; C:\Windows\System32\Drivers\aswMonFlt.sys [71600 2012-10-30] (AVAST Software) 1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [54072 2012-10-15] (AVAST Software) 1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [984144 2012-10-30] (AVAST Software) 1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [370288 2012-10-30] (AVAST Software) 1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [59728 2012-10-30] (AVAST Software) 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120317.002\BHDrvx64.sys [1157240 2012-03-02] (Symantec Corporation) 1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1306010.008\ccSetx64.sys [167048 2011-11-29] (Symantec Corporation) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [482936 2012-03-21] (Symantec Corporation) 3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138360 2012-02-03] (Symantec Corporation) 3 hidshim; C:\Windows\System32\Drivers\hidshim.sys [6656 2009-08-31] (Windows ® Win 7 DDK provider) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120321.001\IDSvia64.sys [488568 2012-03-05] (Symantec Corporation) 3 libusb0; C:\Windows\System32\Drivers\libusb0.sys [29184 2011-12-19] (http://libusb-win32.sourceforge.net) 3 libusb0; C:\Windows\SysWow64\Drivers\libusb0.sys [21504 2011-12-19] (http://libusb-win32.sourceforge.net) 3 mod7700; C:\Windows\System32\Drivers\mod7700.sys [1001472 2012-05-14] (DiBcom SA) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120321.032\ENG64.SYS [117880 2012-03-21] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120321.032\EX64.SYS [2048632 2012-03-21] (Symantec Corporation) 3 nuvotonhidcir; C:\Windows\System32\Drivers\nuvotonhidcir.sys [26624 2009-08-31] (Nuvoton Technology Corporation) 3 nuvotonir; C:\Windows\System32\Drivers\nuvotonir.sys [68096 2009-08-31] (Nuvoton Technology Corporation) 3 SRTSP; C:\Windows\System32\Drivers\NISx64\1306010.008\SRTSP64.SYS [738936 2012-01-17] (Symantec Corporation) 1 SRTSPX; C:\Windows\system32\drivers\NISx64\1306010.008\SRTSPX64.SYS [37496 2012-01-17] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\NISx64\1306010.008\SYMDS64.SYS [451192 2011-07-25] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\NISx64\1306010.008\SYMEFA64.SYS [1092728 2012-01-17] (Symantec Corporation) 3 SymEvent; \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-03-08] (Symantec Corporation) 1 SymIRON; C:\Windows\system32\drivers\NISx64\1306010.008\Ironx64.SYS [190072 2012-01-17] (Symantec Corporation) 1 SymNetS; C:\Windows\System32\Drivers\NISx64\1306010.008\SYMNETS.SYS [405624 2012-01-17] (Symantec Corporation) 3 toshidpt; C:\Windows\System32\Drivers\toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.) 3 USBTINSP; C:\Windows\System32\DRIVERS\tinspusb.sys [142848 2010-03-28] (Texas Instruments) 3 catchme; \??\C:\ComboFix\catchme.sys [x] 3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2012-12-01 13:29 - 2012-12-01 13:29 - 00000000 ____D C:\FRST 2012-11-30 22:04 - 2012-11-30 23:29 - 00002013 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2012-11-30 22:04 - 2012-11-30 22:04 - 00000350 ___AH C:\Windows\Tasks\avast! Emergency Update.job 2012-11-30 22:04 - 2012-11-30 22:04 - 00000000 ____A C:\Windows\SysWOW64\config.nt 2012-11-30 22:04 - 2012-10-30 14:51 - 00984144 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys 2012-11-30 22:04 - 2012-10-30 14:51 - 00370288 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys 2012-11-30 22:04 - 2012-10-30 14:51 - 00071600 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys 2012-11-30 22:04 - 2012-10-30 14:51 - 00059728 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys 2012-11-30 22:04 - 2012-10-30 14:51 - 00025232 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys 2012-11-30 22:04 - 2012-10-30 14:50 - 00285328 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe 2012-11-30 22:04 - 2012-10-15 07:59 - 00054072 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys 2012-11-30 22:03 - 2012-11-30 22:03 - 00000000 ____D C:\Users\All Users\AVAST Software 2012-11-30 22:03 - 2012-11-30 22:03 - 00000000 ____D C:\Program Files\AVAST Software 2012-11-30 22:03 - 2012-10-30 14:51 - 00041224 ____A (AVAST Software) C:\Windows\avastSS.scr 2012-11-30 22:03 - 2012-10-30 14:50 - 00227648 ____A (AVAST Software) C:\Windows\SysWOW64\aswBoot.exe 2012-11-30 21:52 - 2012-11-30 21:59 - 97495576 ____A C:\Users\Daniel\Downloads\avast_free_antivirus_setup.exe 2012-11-30 21:30 - 2012-11-30 21:30 - 00001816 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-11-30 19:18 - 2012-12-01 15:54 - 00195770 ____A C:\Users\Daniel\AppData\Local\ikpidmue.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00455142 ____A C:\Users\Daniel\AppData\Local\rfkdpsof.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00003307 ____A C:\Users\Daniel\AppData\Local\pmtgduve.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00003247 ____A C:\Users\Daniel\AppData\Local\vtdsudwf.log 2012-11-30 19:17 - 2012-12-01 16:01 - 00000028 ____A C:\Users\Daniel\AppData\Local\cltedshe.log 2012-11-30 19:17 - 2012-11-30 19:17 - 00446448 ____A C:\Users\Daniel\AppData\Local\enapffrn.log 2012-11-30 19:17 - 2012-11-30 19:17 - 00005370 ____A C:\Users\Daniel\AppData\Local\lgnaobbi.log 2012-11-30 18:57 - 2012-11-30 18:57 - 00030566 ____A C:\ComboFix.txt 2012-11-30 18:38 - 2012-11-30 18:57 - 00000000 ____D C:\Qoobox 2012-11-30 18:38 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2012-11-30 18:38 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2012-11-30 18:38 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-11-30 18:38 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-11-30 18:38 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-11-30 18:38 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2012-11-30 18:38 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2012-11-30 18:38 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2012-11-30 18:37 - 2012-11-30 18:54 - 00000000 ____D C:\Windows\erdnt 2012-11-30 18:19 - 2012-11-30 18:20 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9C46E994-8221-4733-BDC2-736644582BDF} 2012-11-30 17:51 - 2012-11-30 17:51 - 00000000 ____D C:\Users\Daniel\AppData\Local\{CE7CB58E-1783-41AC-9A79-205300E6215C} 2012-11-30 16:46 - 2012-12-01 16:01 - 00000000 ____A C:\Users\Daniel\AppData\Local\aadwrsfq.log 2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\fchlvidc.log 2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\cwvbxftk.log 2012-11-30 16:41 - 2012-11-30 22:19 - 00000000 ____D C:\Users\Daniel\AppData\Local\wkowggjd 2012-11-30 16:41 - 2012-11-30 16:41 - 00000064 ____A C:\Users\All Users\txbahwro.log 2012-11-30 16:20 - 2012-11-30 16:21 - 00000000 ____D C:\Users\Daniel\AppData\Local\{4B224279-CB30-4899-B5BD-B106B42A2867} 2012-11-30 03:16 - 2008-09-21 02:16 - 00003146 ____A C:\Users\Daniel\Downloads\bossa_basic_pattern.gp5 2012-11-29 21:54 - 2012-11-29 21:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{477281B0-7ED0-43D0-880B-7E30CB8CEA5B} 2012-11-29 13:02 - 2012-11-29 13:04 - 17672068 ____A C:\Users\Daniel\Downloads\Amber Bayani- These Thoughts (uke cover).mp4 2012-11-29 12:58 - 2012-11-29 13:00 - 80274689 ____A C:\Users\Daniel\Downloads\Gorillaz - Feel good inc. - Acoustic guitar cover by Jamé Forbes.mp4 2012-11-29 02:49 - 2012-11-29 02:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A5FFD923-ACAB-4D46-880F-E846F7A2C066} 2012-11-28 23:03 - 2012-11-28 23:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B67858BC-1393-4238-B44F-3B66C47780AE} 2012-11-28 12:08 - 2012-11-28 12:14 - 86904875 ____A C:\Users\Daniel\Downloads\GG-GG2-GAP-K2N.rar 2012-11-28 11:49 - 2012-11-28 11:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{ECBCD6BB-6224-4421-B524-624ADDCA4097} 2012-11-28 04:30 - 2012-11-28 04:32 - 86235479 ____A C:\Users\Daniel\Downloads\Park Kahi [After School] - Ultimate Dance Collection.mp4 2012-11-27 21:02 - 2012-11-27 21:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{27CF164A-EB81-41AF-BD31-41D47148C3F2} 2012-11-26 20:58 - 2012-11-26 20:58 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DC024820-DBB6-4877-BA08-9533577A2448} 2012-11-25 21:18 - 2012-11-25 21:19 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9F6FA202-1102-4235-8C9E-74C186856F3F} 2012-11-24 15:50 - 2012-11-24 15:50 - 00000000 ____D C:\Users\Daniel\AppData\Local\{FB2B4090-ED04-48D0-977C-B0FA4B807210} 2012-11-23 15:47 - 2012-11-23 15:47 - 00000000 ____D C:\Users\Daniel\AppData\Local\{63358A2F-115C-4661-96A7-2E6FEC8D19CB} 2012-11-23 02:48 - 2012-11-23 02:50 - 53557183 ____A C:\Users\Daniel\Downloads\Dumb Ways to Die.mp4 2012-11-22 23:35 - 2012-11-22 23:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{79970399-3230-4DFC-B985-AFBCE49CC26D} 2012-11-21 23:45 - 2012-11-21 23:46 - 02368434 ____A C:\Users\Daniel\Downloads\Ward_Template.zip 2012-11-21 22:03 - 2012-11-21 22:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\{529DBEE8-09B1-4DE2-8D7D-F024033834ED} 2012-11-20 22:03 - 2012-11-20 22:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B8A61442-F266-42DC-85C3-C4BA6C9B172A} 2012-11-20 22:01 - 2012-11-20 22:01 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi 2012-11-19 21:49 - 2012-11-19 21:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{50738D66-13FA-4137-9249-3A7A27EF1B3A} 2012-11-19 00:49 - 2012-11-19 00:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A1F1F73B-80A7-4462-B00C-7AA37FC776CF} 2012-11-18 21:27 - 2012-11-18 21:27 - 00000000 ____D C:\Users\Daniel\AppData\Local\{97B56523-EB64-484E-8D86-6BA301BDD147} 2012-11-18 13:12 - 2012-11-18 13:12 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E363595D-0745-46D4-8C12-64891B3E0779} 2012-11-17 19:00 - 2012-11-17 19:01 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B7B22879-FE8A-4382-8BCD-4FF55F209BDA} 2012-11-17 17:46 - 2012-11-17 17:46 - 00000000 ____D C:\Users\Daniel\AppData\Local\{5039BE42-6A09-4F4D-8B9A-2592B45F3B49} 2012-11-17 00:56 - 2012-11-17 00:56 - 00000000 ____D C:\Users\Daniel\AppData\Local\{EA904533-3DF4-4318-B2D7-2EC61026CF7E} 2012-11-16 03:58 - 2012-10-08 04:19 - 17811968 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-11-16 03:58 - 2012-10-08 03:42 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-11-16 03:58 - 2012-10-08 03:31 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-11-16 03:58 - 2012-10-08 03:24 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-11-16 03:58 - 2012-10-08 03:23 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-11-16 03:58 - 2012-10-08 03:22 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-11-16 03:58 - 2012-10-08 03:22 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-11-16 03:58 - 2012-10-08 03:20 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-11-16 03:58 - 2012-10-08 03:18 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-11-16 03:58 - 2012-10-08 03:17 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-11-16 03:58 - 2012-10-08 03:17 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2012-11-16 03:58 - 2012-10-08 03:15 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-11-16 03:58 - 2012-10-08 03:15 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-11-16 03:58 - 2012-10-08 03:13 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-11-16 03:58 - 2012-10-08 03:13 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-11-16 03:58 - 2012-10-08 03:09 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-11-16 03:58 - 2012-10-08 00:28 - 12320768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-11-16 03:58 - 2012-10-08 00:02 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-11-16 03:58 - 2012-10-07 23:56 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-11-16 03:58 - 2012-10-07 23:48 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-11-16 03:58 - 2012-10-07 23:48 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-11-16 03:58 - 2012-10-07 23:47 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-11-16 03:58 - 2012-10-07 23:46 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-11-16 03:58 - 2012-10-07 23:45 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-11-16 03:58 - 2012-10-07 23:44 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-11-16 03:58 - 2012-10-07 23:43 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-11-16 03:58 - 2012-10-07 23:43 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2012-11-16 03:58 - 2012-10-07 23:42 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-11-16 03:58 - 2012-10-07 23:41 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-11-16 03:58 - 2012-10-07 23:41 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-11-16 03:58 - 2012-10-07 23:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-11-16 03:58 - 2012-10-07 23:37 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-11-16 01:10 - 2012-11-16 01:10 - 00000899 ____A C:\Users\Public\Desktop\Guild Wars 2.lnk 2012-11-16 01:10 - 2012-11-16 01:10 - 00000000 ____D C:\Program Files (x86)\Guild Wars 2 2012-11-16 01:08 - 2012-11-16 02:36 - 00000000 ____D C:\Users\Daniel\Documents\Guild Wars 2 2012-11-16 01:06 - 2012-11-16 01:08 - 22716480 ____A (ArenaNet) C:\Users\Daniel\Downloads\Gw2Setup.exe 2012-11-16 00:31 - 2012-07-25 20:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys 2012-11-16 00:31 - 2012-07-25 20:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys 2012-11-16 00:31 - 2012-07-25 18:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll 2012-11-16 00:31 - 2012-06-02 06:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2012-11-16 00:29 - 2012-10-09 10:17 - 00226816 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcore6.dll 2012-11-16 00:29 - 2012-10-09 10:17 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcsvc6.dll 2012-11-16 00:29 - 2012-10-09 09:40 - 00193536 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll 2012-11-16 00:29 - 2012-10-09 09:40 - 00044032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll 2012-11-16 00:28 - 2012-10-18 10:25 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-11-16 00:28 - 2012-07-25 19:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll 2012-11-16 00:28 - 2012-07-25 19:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe 2012-11-16 00:28 - 2012-07-25 19:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll 2012-11-16 00:28 - 2012-07-25 19:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll 2012-11-16 00:28 - 2012-07-25 19:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll 2012-11-16 00:28 - 2012-07-25 18:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys 2012-11-16 00:28 - 2012-07-25 18:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys 2012-11-16 00:28 - 2012-06-02 06:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2012-11-16 00:28 - 2012-05-31 21:39 - 00014848 ____A (Microsoft Corporation) C:\Windows\System32\wamregps.dll 2012-11-16 00:28 - 2012-05-31 21:36 - 00192000 ____A (Microsoft Corporation) C:\Windows\System32\iisRtl.dll 2012-11-16 00:28 - 2012-05-31 21:36 - 00011264 ____A (Microsoft Corporation) C:\Windows\System32\iisrstap.dll 2012-11-16 00:28 - 2012-05-31 21:35 - 00060928 ____A (Microsoft Corporation) C:\Windows\System32\ahadmin.dll 2012-11-16 00:28 - 2012-05-31 21:34 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\admwprox.dll 2012-11-16 00:28 - 2012-05-31 21:33 - 00016896 ____A (Microsoft Corporation) C:\Windows\System32\iisreset.exe 2012-11-16 00:28 - 2012-05-31 20:40 - 00010752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wamregps.dll 2012-11-16 00:28 - 2012-05-31 20:37 - 00154624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iisRtl.dll 2012-11-16 00:28 - 2012-05-31 20:37 - 00008192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iisrstap.dll 2012-11-16 00:28 - 2012-05-31 20:35 - 00050688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\admwprox.dll 2012-11-16 00:28 - 2012-05-31 20:35 - 00026624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ahadmin.dll 2012-11-16 00:28 - 2012-05-31 20:34 - 00015360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iisreset.exe 2012-11-16 00:27 - 2012-10-03 09:56 - 01914248 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-11-16 00:27 - 2012-10-03 09:44 - 00303104 ____A (Microsoft Corporation) C:\Windows\System32\nlasvc.dll 2012-11-16 00:27 - 2012-10-03 09:44 - 00246272 ____A (Microsoft Corporation) C:\Windows\System32\netcorehc.dll 2012-11-16 00:27 - 2012-10-03 09:44 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\ncsi.dll 2012-11-16 00:27 - 2012-10-03 09:44 - 00070656 ____A (Microsoft Corporation) C:\Windows\System32\nlaapi.dll 2012-11-16 00:27 - 2012-10-03 09:44 - 00018944 ____A (Microsoft Corporation) C:\Windows\System32\netevent.dll 2012-11-16 00:27 - 2012-10-03 09:42 - 00569344 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll 2012-11-16 00:27 - 2012-10-03 08:42 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll 2012-11-16 00:27 - 2012-10-03 08:42 - 00156672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2012-11-16 00:27 - 2012-10-03 08:42 - 00018944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll 2012-11-16 00:27 - 2012-10-03 08:07 - 00045568 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys 2012-11-16 00:27 - 2012-01-12 23:12 - 00052224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2012-11-16 00:26 - 2012-09-25 14:47 - 00078336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll 2012-11-16 00:26 - 2012-09-25 14:46 - 00095744 ____A (Microsoft Corporation) C:\Windows\System32\synceng.dll 2012-11-15 23:54 - 2012-11-15 23:55 - 00000000 ____D C:\Users\Daniel\AppData\Local\{CD4B8E7A-D568-4170-816F-A87C8D647A9A} 2012-11-15 01:00 - 2012-11-15 01:02 - 82838367 ____A C:\Users\Daniel\Downloads\JJ Project - Bounce.mp4 2012-11-14 12:54 - 2012-11-14 12:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{4CEF8006-4A12-456C-873B-60BB3B51BD9E} 2012-11-13 22:43 - 2012-11-13 22:43 - 00000000 ____D C:\Users\Daniel\AppData\Local\{30741556-1072-43E6-BDC0-E1B8823C12AA} 2012-11-12 20:48 - 2012-11-12 20:48 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37C065FC-E42F-42C1-A0EC-5D42A42588ED} 2012-11-12 11:28 - 2012-11-12 11:28 - 00000000 ____D C:\Users\Daniel\AppData\Local\{F0DD200F-7008-41A5-AB83-4D9253B772CF} 2012-11-10 21:15 - 2012-11-10 21:16 - 00000000 ____D C:\Users\Daniel\AppData\Local\{08FDE675-6593-43FB-8D74-BE44BE6F9292} 2012-11-10 19:47 - 2012-11-10 19:47 - 00000000 ____D C:\Users\Daniel\AppData\Local\{42308EFC-914F-4F66-9DC3-EE1BFCB1142E} 2012-11-10 19:34 - 2012-11-10 19:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B740D62F-34B5-4366-8821-9E90582A5379} 2012-11-09 21:35 - 2012-11-09 21:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{379C1BA3-017E-44AC-A8A1-8D3EAA1DC485} 2012-11-08 22:23 - 2012-11-08 22:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{24A921FF-7EAC-40AF-9677-E2E376223FA8} 2012-11-06 23:23 - 2012-11-06 23:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A45BA3AD-0524-46BC-BC56-B736E1FDB829} 2012-11-05 17:06 - 2012-11-05 17:06 - 00000000 ____D C:\Users\Daniel\AppData\Local\{98C0C51B-E912-4E23-BCA8-6775BC6747D4} 2012-11-04 15:08 - 2012-11-04 15:08 - 00000000 ____D C:\Users\Daniel\AppData\Local\{1D41A43C-711A-4504-8C7A-90206E30692C} 2012-11-04 03:16 - 2012-10-25 15:50 - 00258352 ____A (Microsoft Corporation) C:\Windows\SysWOW64\unicows.dll 2012-11-04 03:05 - 2012-11-04 03:07 - 84272824 ____A C:\Users\Daniel\Downloads\Girls' Generation - Flower Power.mp4 2012-11-04 02:42 - 2012-11-04 02:44 - 75701720 ____A C:\Users\Daniel\Downloads\Miss A - I Don't Need A Man.mp4 2012-11-03 17:13 - 2012-11-03 17:13 - 00000000 ____D C:\Users\Daniel\AppData\Local\{C941CDCF-3089-4B65-8C0F-E5E32A926ACB} 2012-11-02 17:52 - 2012-11-02 17:53 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B098A105-226B-476B-873C-0356E54301C5} 2012-11-02 03:08 - 2012-11-02 03:08 - 00000000 ____D C:\Users\Public\Documents\CrashDump ==================== One Month Modified Files and Folders ======= 2012-12-01 16:17 - 2012-12-01 16:17 - 00602112 ____A (OldTimer Tools) C:\Users\Daniel\Desktop\OTL.exe 2012-12-01 16:15 - 2011-04-02 14:05 - 01947143 ____A C:\Windows\WindowsUpdate.log 2012-12-01 16:12 - 2012-10-15 00:08 - 00000000 ____D C:\Program Files (x86)\Steam 2012-12-01 16:02 - 2011-04-07 08:59 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-67684466-253165790-691636694-1001UA.job 2012-12-01 16:01 - 2012-11-30 19:17 - 00000028 ____A C:\Users\Daniel\AppData\Local\cltedshe.log 2012-12-01 16:01 - 2012-11-30 16:46 - 00000000 ____A C:\Users\Daniel\AppData\Local\aadwrsfq.log 2012-12-01 16:00 - 2009-07-13 20:45 - 00016304 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-12-01 16:00 - 2009-07-13 20:45 - 00016304 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-12-01 15:54 - 2012-11-30 19:18 - 00195770 ____A C:\Users\Daniel\AppData\Local\ikpidmue.log 2012-12-01 15:53 - 2011-05-09 02:09 - 00000000 ____D C:\Users\Daniel\AppData\Local\LogMeIn Hamachi 2012-12-01 15:51 - 2011-08-19 03:05 - 00156615 ____A C:\Windows\setupact.log 2012-12-01 15:51 - 2011-06-02 22:31 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-12-01 15:51 - 2011-04-02 14:08 - 00000000 ____D C:\Users\All Users\NVIDIA 2012-12-01 15:51 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-12-01 13:29 - 2012-12-01 13:29 - 00000000 ____D C:\FRST 2012-12-01 03:08 - 2011-06-16 23:03 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype 2012-12-01 03:02 - 2011-04-07 08:59 - 00000860 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-67684466-253165790-691636694-1001Core.job 2012-12-01 02:49 - 2011-06-02 22:31 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-11-30 23:29 - 2012-11-30 22:04 - 00002013 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2012-11-30 23:28 - 2011-06-08 23:33 - 00000000 ____D C:\Users\Daniel\AppData\Local\PMB Files 2012-11-30 23:28 - 2011-06-08 23:33 - 00000000 ____D C:\Users\All Users\PMB Files 2012-11-30 22:19 - 2012-11-30 16:41 - 00000000 ____D C:\Users\Daniel\AppData\Local\wkowggjd 2012-11-30 22:04 - 2012-11-30 22:04 - 00000350 ___AH C:\Windows\Tasks\avast! Emergency Update.job 2012-11-30 22:04 - 2012-11-30 22:04 - 00000000 ____A C:\Windows\SysWOW64\config.nt 2012-11-30 22:03 - 2012-11-30 22:03 - 00000000 ____D C:\Users\All Users\AVAST Software 2012-11-30 22:03 - 2012-11-30 22:03 - 00000000 ____D C:\Program Files\AVAST Software 2012-11-30 21:59 - 2012-11-30 21:52 - 97495576 ____A C:\Users\Daniel\Downloads\avast_free_antivirus_setup.exe 2012-11-30 21:30 - 2012-11-30 21:30 - 00001816 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-11-30 21:30 - 2011-10-06 23:33 - 00000000 ____D C:\Program Files (x86)\QuickTime 2012-11-30 21:16 - 2011-08-19 23:04 - 00030318 ____A C:\Windows\PFRO.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00455142 ____A C:\Users\Daniel\AppData\Local\rfkdpsof.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00003307 ____A C:\Users\Daniel\AppData\Local\pmtgduve.log 2012-11-30 19:18 - 2012-11-30 19:18 - 00003247 ____A C:\Users\Daniel\AppData\Local\vtdsudwf.log 2012-11-30 19:17 - 2012-11-30 19:17 - 00446448 ____A C:\Users\Daniel\AppData\Local\enapffrn.log 2012-11-30 19:17 - 2012-11-30 19:17 - 00005370 ____A C:\Users\Daniel\AppData\Local\lgnaobbi.log 2012-11-30 18:57 - 2012-11-30 18:57 - 00030566 ____A C:\ComboFix.txt 2012-11-30 18:57 - 2012-11-30 18:38 - 00000000 ____D C:\Qoobox 2012-11-30 18:57 - 2012-04-15 01:38 - 00001076 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-11-30 18:57 - 2011-09-09 02:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-11-30 18:57 - 2009-07-13 19:20 - 00000000 __RHD C:\users\Default 2012-11-30 18:54 - 2012-11-30 18:37 - 00000000 ____D C:\Windows\erdnt 2012-11-30 18:53 - 2009-07-13 18:34 - 00000215 ____A C:\Windows\system.ini 2012-11-30 18:20 - 2012-11-30 18:19 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9C46E994-8221-4733-BDC2-736644582BDF} 2012-11-30 18:15 - 2012-05-04 05:41 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Rainmeter 2012-11-30 18:15 - 2011-09-16 21:36 - 00000000 ____D C:\users\DefaultAppPool 2012-11-30 18:15 - 2011-04-01 22:25 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Macromedia 2012-11-30 18:15 - 2011-04-01 22:13 - 00000000 ____D C:\users\Daniel 2012-11-30 18:15 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration 2012-11-30 18:14 - 2011-08-27 20:01 - 00000000 ___RD C:\MSOCache 2012-11-30 18:14 - 2011-04-07 08:51 - 00000000 ____D C:\Program Files (x86)\Google 2012-11-30 17:51 - 2012-11-30 17:51 - 00000000 ____D C:\Users\Daniel\AppData\Local\{CE7CB58E-1783-41AC-9A79-205300E6215C} 2012-11-30 17:32 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV 2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\fchlvidc.log 2012-11-30 16:43 - 2012-11-30 16:43 - 00000000 ____A C:\Users\Daniel\AppData\Local\cwvbxftk.log 2012-11-30 16:41 - 2012-11-30 16:41 - 00000064 ____A C:\Users\All Users\txbahwro.log 2012-11-30 16:21 - 2012-11-30 16:20 - 00000000 ____D C:\Users\Daniel\AppData\Local\{4B224279-CB30-4899-B5BD-B106B42A2867} 2012-11-29 21:54 - 2012-11-29 21:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{477281B0-7ED0-43D0-880B-7E30CB8CEA5B} 2012-11-29 13:17 - 2011-06-02 22:36 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Google 2012-11-29 13:04 - 2012-11-29 13:02 - 17672068 ____A C:\Users\Daniel\Downloads\Amber Bayani- These Thoughts (uke cover).mp4 2012-11-29 13:00 - 2012-11-29 12:58 - 80274689 ____A C:\Users\Daniel\Downloads\Gorillaz - Feel good inc. - Acoustic guitar cover by Jamé Forbes.mp4 2012-11-29 02:49 - 2012-11-29 02:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A5FFD923-ACAB-4D46-880F-E846F7A2C066} 2012-11-28 23:03 - 2012-11-28 23:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B67858BC-1393-4238-B44F-3B66C47780AE} 2012-11-28 13:08 - 2012-09-05 02:06 - 00000000 ____D C:\Users\Daniel\MSYNC 2012-11-28 12:14 - 2012-11-28 12:08 - 86904875 ____A C:\Users\Daniel\Downloads\GG-GG2-GAP-K2N.rar 2012-11-28 11:49 - 2012-11-28 11:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{ECBCD6BB-6224-4421-B524-624ADDCA4097} 2012-11-28 04:32 - 2012-11-28 04:30 - 86235479 ____A C:\Users\Daniel\Downloads\Park Kahi [After School] - Ultimate Dance Collection.mp4 2012-11-27 21:02 - 2012-11-27 21:02 - 00000000 ____D C:\Users\Daniel\AppData\Local\{27CF164A-EB81-41AF-BD31-41D47148C3F2} 2012-11-27 00:22 - 2011-04-07 04:40 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\uTorrent 2012-11-26 21:04 - 2012-08-15 03:23 - 00002497 ____A C:\Users\Daniel\Desktop\Google Chrome.lnk 2012-11-26 20:58 - 2012-11-26 20:58 - 00000000 ____D C:\Users\Daniel\AppData\Local\{DC024820-DBB6-4877-BA08-9533577A2448} 2012-11-25 21:19 - 2012-11-25 21:18 - 00000000 ____D C:\Users\Daniel\AppData\Local\{9F6FA202-1102-4235-8C9E-74C186856F3F} 2012-11-24 20:03 - 2011-04-08 07:57 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps 2012-11-24 17:41 - 2009-07-13 21:13 - 00859564 ____A C:\Windows\System32\PerfStringBackup.INI 2012-11-24 15:50 - 2012-11-24 15:50 - 00000000 ____D C:\Users\Daniel\AppData\Local\{FB2B4090-ED04-48D0-977C-B0FA4B807210} 2012-11-23 15:47 - 2012-11-23 15:47 - 00000000 ____D C:\Users\Daniel\AppData\Local\{63358A2F-115C-4661-96A7-2E6FEC8D19CB} 2012-11-23 02:50 - 2012-11-23 02:48 - 53557183 ____A C:\Users\Daniel\Downloads\Dumb Ways to Die.mp4 2012-11-22 23:35 - 2012-11-22 23:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{79970399-3230-4DFC-B985-AFBCE49CC26D} 2012-11-21 23:46 - 2012-11-21 23:45 - 02368434 ____A C:\Users\Daniel\Downloads\Ward_Template.zip 2012-11-21 22:04 - 2012-11-21 22:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{529DBEE8-09B1-4DE2-8D7D-F024033834ED} 2012-11-20 22:03 - 2012-11-20 22:03 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B8A61442-F266-42DC-85C3-C4BA6C9B172A} 2012-11-20 22:01 - 2012-11-20 22:01 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi 2012-11-19 21:49 - 2012-11-19 21:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{50738D66-13FA-4137-9249-3A7A27EF1B3A} 2012-11-19 00:49 - 2012-11-19 00:49 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A1F1F73B-80A7-4462-B00C-7AA37FC776CF} 2012-11-19 00:31 - 2011-04-06 18:42 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\vlc 2012-11-18 21:27 - 2012-11-18 21:27 - 00000000 ____D C:\Users\Daniel\AppData\Local\{97B56523-EB64-484E-8D86-6BA301BDD147} 2012-11-18 13:12 - 2012-11-18 13:12 - 00000000 ____D C:\Users\Daniel\AppData\Local\{E363595D-0745-46D4-8C12-64891B3E0779} 2012-11-17 19:23 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache 2012-11-17 19:01 - 2012-11-17 19:00 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B7B22879-FE8A-4382-8BCD-4FF55F209BDA} 2012-11-17 17:46 - 2012-11-17 17:46 - 00000000 ____D C:\Users\Daniel\AppData\Local\{5039BE42-6A09-4F4D-8B9A-2592B45F3B49} 2012-11-17 00:56 - 2012-11-17 00:56 - 00000000 ____D C:\Users\Daniel\AppData\Local\{EA904533-3DF4-4318-B2D7-2EC61026CF7E} 2012-11-17 00:52 - 2011-09-14 01:51 - 00024822 ____A C:\Windows\iis7.log 2012-11-17 00:51 - 2009-07-13 20:45 - 05003408 ____A C:\Windows\System32\FNTCACHE.DAT 2012-11-17 00:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\inetsrv 2012-11-17 00:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\inetsrv 2012-11-16 02:36 - 2012-11-16 01:08 - 00000000 ____D C:\Users\Daniel\Documents\Guild Wars 2 2012-11-16 01:10 - 2012-11-16 01:10 - 00000899 ____A C:\Users\Public\Desktop\Guild Wars 2.lnk 2012-11-16 01:10 - 2012-11-16 01:10 - 00000000 ____D C:\Program Files (x86)\Guild Wars 2 2012-11-16 01:08 - 2012-11-16 01:06 - 22716480 ____A (ArenaNet) C:\Users\Daniel\Downloads\Gw2Setup.exe 2012-11-16 00:41 - 2011-04-01 22:20 - 00124920 ____A C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT 2012-11-16 00:31 - 2011-04-01 22:24 - 00000000 ____D C:\Users\All Users\Microsoft Help 2012-11-16 00:29 - 2011-04-06 20:50 - 66395536 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-11-15 23:55 - 2012-11-15 23:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{CD4B8E7A-D568-4170-816F-A87C8D647A9A} 2012-11-15 01:02 - 2012-11-15 01:00 - 82838367 ____A C:\Users\Daniel\Downloads\JJ Project - Bounce.mp4 2012-11-14 12:54 - 2012-11-14 12:54 - 00000000 ____D C:\Users\Daniel\AppData\Local\{4CEF8006-4A12-456C-873B-60BB3B51BD9E} 2012-11-14 02:16 - 2012-03-28 01:48 - 00283032 ____A C:\Windows\SysWOW64\PnkBstrB.xtr 2012-11-14 02:16 - 2011-04-20 06:28 - 00283032 ____A C:\Windows\SysWOW64\PnkBstrB.exe 2012-11-14 02:12 - 2011-04-20 06:28 - 00298016 ____A C:\Windows\SysWOW64\PnkBstrB.ex0 2012-11-13 22:43 - 2012-11-13 22:43 - 00000000 ____D C:\Users\Daniel\AppData\Local\{30741556-1072-43E6-BDC0-E1B8823C12AA} 2012-11-12 20:48 - 2012-11-12 20:48 - 00000000 ____D C:\Users\Daniel\AppData\Local\{37C065FC-E42F-42C1-A0EC-5D42A42588ED} 2012-11-12 11:28 - 2012-11-12 11:28 - 00000000 ____D C:\Users\Daniel\AppData\Local\{F0DD200F-7008-41A5-AB83-4D9253B772CF} 2012-11-10 21:16 - 2012-11-10 21:15 - 00000000 ____D C:\Users\Daniel\AppData\Local\{08FDE675-6593-43FB-8D74-BE44BE6F9292} 2012-11-10 19:47 - 2012-11-10 19:47 - 00000000 ____D C:\Users\Daniel\AppData\Local\{42308EFC-914F-4F66-9DC3-EE1BFCB1142E} 2012-11-10 19:34 - 2012-11-10 19:34 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B740D62F-34B5-4366-8821-9E90582A5379} 2012-11-10 19:33 - 2009-07-13 21:08 - 00032576 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-11-09 21:35 - 2012-11-09 21:35 - 00000000 ____D C:\Users\Daniel\AppData\Local\{379C1BA3-017E-44AC-A8A1-8D3EAA1DC485} 2012-11-08 22:23 - 2012-11-08 22:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{24A921FF-7EAC-40AF-9677-E2E376223FA8} 2012-11-06 23:23 - 2012-11-06 23:23 - 00000000 ____D C:\Users\Daniel\AppData\Local\{A45BA3AD-0524-46BC-BC56-B736E1FDB829} 2012-11-05 17:06 - 2012-11-05 17:06 - 00000000 ____D C:\Users\Daniel\AppData\Local\{98C0C51B-E912-4E23-BCA8-6775BC6747D4} 2012-11-04 22:19 - 2011-10-01 16:01 - 00000000 ____D C:\Seagate 2012-11-04 15:08 - 2012-11-04 15:08 - 00000000 ____D C:\Users\Daniel\AppData\Local\{1D41A43C-711A-4504-8C7A-90206E30692C} 2012-11-04 03:24 - 2012-03-20 21:46 - 00000000 ____D C:\Perfect World Entertainment 2012-11-04 03:07 - 2012-11-04 03:05 - 84272824 ____A C:\Users\Daniel\Downloads\Girls' Generation - Flower Power.mp4 2012-11-04 02:44 - 2012-11-04 02:42 - 75701720 ____A C:\Users\Daniel\Downloads\Miss A - I Don't Need A Man.mp4 2012-11-03 17:13 - 2012-11-03 17:13 - 00000000 ____D C:\Users\Daniel\AppData\Local\{C941CDCF-3089-4B65-8C0F-E5E32A926ACB} 2012-11-02 17:53 - 2012-11-02 17:52 - 00000000 ____D C:\Users\Daniel\AppData\Local\{B098A105-226B-476B-873C-0356E54301C5} 2012-11-02 03:08 - 2012-11-02 03:08 - 00000000 ____D C:\Users\Public\Documents\CrashDump ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2012-11-06 23:08:46 Restore point made on: 2012-11-16 00:27:26 Restore point made on: 2012-11-16 03:58:31 Restore point made on: 2012-11-23 16:43:28 Restore point made on: 2012-11-28 04:44:29 Restore point made on: 2012-11-29 13:16:12 Restore point made on: 2012-11-30 17:27:49 ==================== Memory info =========================== Percentage of memory in use: 11% Total physical RAM: 6072.43 MB Available physical RAM: 5357.09 MB Total Pagefile: 6070.57 MB Available Pagefile: 5340.65 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ==================== Partitions ============================= 1 Drive c: (S3A5912D001) (Fixed) (Total:686.34 GB) (Free:109 GB) NTFS ==>[system with boot components (obtained from reading drive)] 2 Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.24 GB) NTFS ==>[system with boot components (obtained from reading drive)] 4 Drive f: (GN Drive) (Fixed) (Total:298.09 GB) (Free:107.45 GB) NTFS 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 698 GB 0 B Disk 1 Online 298 GB 1024 KB Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Recovery 1500 MB 1024 KB Partition 2 Primary 686 GB 1501 MB Partition 3 Primary 10 GB 687 GB ================================================================================== Disk: 0 Partition 1 Type : 27 Hidden: Yes Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 D System NTFS Partition 1500 MB Healthy Hidden ========================================================= Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 C S3A5912D001 NTFS Partition 686 GB Healthy ========================================================= Disk: 0 Partition 3 Type : 17 (Suspicious Type) Hidden: Yes Active: No There is no volume associated with this partition. ========================================================= Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 298 GB 31 KB ================================================================================== Disk: 1 Partition 1 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 F GN Drive NTFS Partition 298 GB Healthy ========================================================= Last Boot: 2012-11-24 21:18 ==================== End Of Log =============================

Hi guys, My computer has recently been infected with Hijack.userinit. I cannot access google chrome or malware bytes unless I start it in safe mode. The only browser that I can access in normal mode is Internet explorer and I cannot go on any websites that have certain words such a malware or virus. I cannot turn on windows security centre service aswell. Below is my scan log. Thankyou so much for your time. Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.01.03 Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 Daniel :: DANIEL-PC [administrator] 2/12/2012 11:05:14 AM mbam-log-2012-12-02 (11-12-35).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 259592 Time elapsed: 7 minute(s), 6 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 4 HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bad: (userinit.exe,,C:\Users\Daniel\AppData\Local\wkowggjd\fqgjqgst.exe) Good: (userinit.exe) -> No action taken. Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)