[Am I Infected?]

Hello, I keep getting the following:

2012/12/04 16:53:12 GMT CALUM-PC Calum IP-BLOCK 58.240.163.101 (Type: outgoing, Port: 57959, Process: svchost.exe)

Is this bad or can I ignore it?

Thanks for your help!

The IP address belongs to a known Chinese spam mail server so my guess is that you are infected and you should follow the instructions here

Done

I read in other topics that I wasn't allowed uTorrent and to post logs directly into the post.

attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8 Pro

Boot Device: \Device\HarddiskVolume4

Install Date: 26/11/2012 21:37:29

System Uptime: 28/11/2012 21:31:58 (141 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | Z68XP-UD4

Processor: Intel® Core i7-2600K CPU @ 3.40GHz | Socket 1155 | 3701/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 112 GiB total, 68.54 GiB free.

D: is FIXED (NTFS) - 111 GiB total, 108.678 GiB free.

E: is FIXED (NTFS) - 930 GiB total, 919.055 GiB free.

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1: 26/11/2012 23:25:17 - Installed Microsoft Office Home and Student 2010

RP2: 01/12/2012 09:58:04 - Installed Adobe Reader XI.

RP3: 02/12/2012 17:01:57 - Installed Java 7 Update 9 (64-bit)

.

==== Installed Programs ======================

.

7-Zip 9.20 (x64 edition)

Adobe Flash Player 11 Plugin

Adobe Reader XI

Amazon MP3 Downloader 1.0.17

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

Anki

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Google Chrome

Google Update Helper

Intel® Processor Graphics

Malwarebytes Anti-Malware version 1.65.1.1000

Microsoft Mathematics Add-in (64-bit)

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office Office 32-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 32-bit MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Mozilla Firefox 17.0 (x86 en-US)

Mozilla Maintenance Service

Security Update for Microsoft Excel 2010 (KB2597126) 64-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687417) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553260) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2589322) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 64-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 64-Bit Edition

Security Update for Microsoft Visio Viewer 2010 (KB2598287) 64-Bit Edition

Security Update for Microsoft Word 2010 (KB2553488) 64-Bit Edition

Sublime Text 2.0.1

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553272) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2687277) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition

VLC media player 2.0.4

.

==== Event Viewer Messages From Past Week ========

.

27/11/2012 01:05:46, Error: Microsoft-Windows-WMPNSS-Service [14353] - A media delivery engine with ID '0' was not initialised due to error '0x80070005' when adding the URL 'http://+:10243/WMPNSSv4/1287810425/'. Restart your computer, then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.

27/11/2012 01:05:46, Error: Microsoft-Windows-WMPNSS-Service [14349] - A new media server was not initialised because the Windows Media Delivery Engine did not initialise due to error '0x80070005'. Restart your computer, then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.

03/12/2012 23:27:13, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

01/12/2012 16:22:51, Error: Schannel [36887] - A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.

.

==== End Of File =========================

dds

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16442

Run by Calum at 18:52:47 on 2012-12-04

Microsoft Windows 8 Pro 6.2.9200.0.1252.44.2057.18.16301.13697 [GMT 0:00]

.

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k RPCSS

C:\WINDOWS\system32\atiesrxx.exe

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\System32\dwm.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\taskhostex.exe

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\LiveComm.exe

C:\Windows\System32\RuntimeBroker.exe

C:\WINDOWS\system32\wwahost.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\WINDOWS\system32\atieclxx.exe

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\vssvc.exe

C:\WINDOWS\System32\svchost.exe -k swprv

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\WINDOWS\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

StartupFolder: C:\Users\Calum\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

TCP: NameServer = 194.168.4.100 194.168.8.100

TCP: Interfaces\{3284CA4D-1C05-482F-AD55-506A3411AC6A} : DHCPNameServer = 194.168.4.100 194.168.8.100

TCP: Interfaces\{DAA5DE5E-72FD-443E-BDDB-B9CF0C888463} : DHCPNameServer = 194.168.4.100 194.168.8.100

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

SSODL: WebCheck - <orphaned>

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

x64-Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Calum\AppData\Roaming\Mozilla\Firefox\Profiles\txu8b47a.default-1354553513147\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll

FF - plugin: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll

FF - ExtSQL: 2012-12-03 16:52; omnibar@ajitk.com; C:\Users\Calum\AppData\Roaming\Mozilla\Firefox\Profiles\txu8b47a.default-1354553513147\extensions\omnibar@ajitk.com.xpi

FF - ExtSQL: 2012-12-03 16:53; {73a6fe31-595d-460b-a920-fcc0f8843232}; C:\Users\Calum\AppData\Roaming\Mozilla\Firefox\Profiles\txu8b47a.default-1354553513147\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF - ExtSQL: 2012-12-03 16:55; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; C:\Users\Calum\AppData\Roaming\Mozilla\Firefox\Profiles\txu8b47a.default-1354553513147\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

============= SERVICES / DRIVERS ===============

.

R2 AMD External Events Utility;AMD External Events Utility;C:\WINDOWS\System32\atiesrxx.exe [2012-10-18 239616]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-26 399432]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-26 676936]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\WINDOWS\System32\Drivers\AtihdW86.sys [2012-8-21 91648]

R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\Drivers\mbam.sys [2012-11-26 25928]

R3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE [2010-1-9 174440]

R3 RTL8168;Realtek 8168 NT Driver;C:\WINDOWS\System32\Drivers\Rt630x64.sys [2012-6-2 589824]

S3 vmbusr;Virtual Machine Bus Provider;C:\WINDOWS\System32\Drivers\vmbusr.sys [2012-7-26 117248]

S3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\Drivers\WUDFRd.sys [2012-7-26 198656]

S3 xusb22;Xbox 360 Wireless Receiver Driver Service 22;C:\WINDOWS\System32\Drivers\xusb22.sys [2012-7-26 89088]

.

=============== Created Last 30 ================

.

2012-12-04 18:46:13 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C112CEF5-8CA1-4D11-9B23-85FDA31458AC}\mpengine.dll

2012-12-03 16:05:32 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2012-12-03 14:01:54 -------- d-----w- C:\Program Files (x86)\xampp

2012-12-02 17:02:51 -------- d-----w- C:\Users\Calum\AppData\Roaming\.minecraft

2012-12-01 19:15:55 -------- d-----w- C:\WINDOWS\System32\appmgmt

2012-12-01 19:08:53 916456 ----a-w- C:\WINDOWS\System32\deployJava1.dll

2012-12-01 19:08:53 1034216 ----a-w- C:\WINDOWS\System32\npDeployJava1.dll

2012-12-01 09:58:34 -------- d-----w- C:\Users\Calum\AppData\Local\Adobe

2012-11-30 18:27:14 -------- d-----w- C:\Program Files (x86)\Amazon

2012-11-27 21:38:01 405504 ----a-w- C:\WINDOWS\System32\pcasvc.dll

2012-11-27 21:38:01 31232 ----a-w- C:\WINDOWS\System32\pcadm.dll

2012-11-27 21:38:01 13312 ----a-w- C:\WINDOWS\System32\pcalua.exe

2012-11-27 21:38:01 11776 ----a-w- C:\WINDOWS\System32\pcaevts.dll

2012-11-27 16:03:04 -------- d-----w- C:\Users\Calum\AppData\Roaming\aacs

2012-11-27 16:01:02 -------- d-----w- C:\Program Files\VideoLAN

2012-11-27 15:26:26 -------- d-----w- C:\Program Files (x86)\VideoLAN

2012-11-27 14:31:38 -------- d-----w- C:\Users\Calum\AppData\Local\Diagnostics

2012-11-27 14:18:32 -------- d-----w- C:\ProgramData\AMD

2012-11-27 14:18:32 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies

2012-11-27 14:18:32 -------- d-----w- C:\Program Files (x86)\AMD AVT

2012-11-27 14:18:30 -------- d-----w- C:\Program Files (x86)\AMD APP

2012-11-27 14:18:03 -------- d-----w- C:\Program Files\ATI Technologies

2012-11-27 14:18:01 -------- d-----w- C:\Program Files\ATI

2012-11-27 14:17:28 -------- d-----w- C:\AMD

2012-11-27 13:55:42 -------- d-----w- C:\Users\Calum\AppData\Local\ATI

2012-11-27 13:55:00 114704 ----a-w- C:\WINDOWS\System32\drivers\AtihdW76.sys

2012-11-27 13:54:52 462848 ----a-w- C:\WINDOWS\System32\ATIDEMGX.dll

2012-11-27 13:54:13 -------- d-----w- C:\Program Files (x86)\ATI Technologies

2012-11-27 13:49:12 -------- d-----w- C:\Program Files\Common Files\ATI Technologies

2012-11-27 13:46:00 0 ----a-w- C:\WINDOWS\ativpsrm.bin

2012-11-27 11:05:20 -------- d-----w- C:\Program Files (x86)\Anki

2012-11-27 01:26:57 -------- d-----w- C:\Program Files\Microsoft Mathematics Add-in

2012-11-27 01:24:10 5425496 ----a-w- C:\WINDOWS\System32\D3DX9_41.dll

2012-11-27 01:24:10 4178264 ----a-w- C:\WINDOWS\SysWow64\D3DX9_41.dll

2012-11-27 01:18:49 778856 ----a-w- C:\WINDOWS\SysWow64\PresentationNative_v0300.dll

2012-11-27 01:18:49 35400 ----a-w- C:\WINDOWS\SysWow64\TsWpfWrp.exe

2012-11-27 01:18:49 35400 ----a-w- C:\WINDOWS\System32\TsWpfWrp.exe

2012-11-27 01:18:49 124040 ----a-w- C:\WINDOWS\System32\PresentationCFFRasterizerNative_v0300.dll

2012-11-27 01:18:49 1166440 ----a-w- C:\WINDOWS\System32\PresentationNative_v0300.dll

2012-11-27 01:18:49 102528 ----a-w- C:\WINDOWS\SysWow64\PresentationCFFRasterizerNative_v0300.dll

2012-11-27 01:07:49 80728 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl

2012-11-27 01:07:49 695648 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe

2012-11-27 01:02:36 -------- d-----r- C:\WINDOWS\BrowserChoice

2012-11-27 00:59:34 11272192 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll

2012-11-27 00:59:34 10768384 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll

2012-11-27 00:55:51 279656 ------w- C:\WINDOWS\System32\MpSigStub.exe

2012-11-27 00:50:59 80896 ----a-w- C:\WINDOWS\SysWow64\SettingSyncHost.exe

2012-11-27 00:48:33 98304 ----a-w- C:\WINDOWS\System32\wudriver.dll

2012-11-27 00:47:50 8856576 ----a-w- C:\WINDOWS\SysWow64\twinui.dll

2012-11-26 23:28:51 -------- d-----w- C:\WINDOWS\PCHEALTH

2012-11-26 23:26:21 -------- d-----w- C:\Program Files\Microsoft Analysis Services

2012-11-26 23:26:21 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services

2012-11-26 23:26:06 -------- d-----w- C:\Users\Calum\AppData\Local\Microsoft Help

2012-11-26 23:25:42 -------- d-----w- C:\Users\Calum\AppData\Local\Google

2012-11-26 22:45:07 -------- d-----w- C:\Users\Calum\AppData\Roaming\Sublime Text 2

2012-11-26 22:43:07 -------- d-----w- C:\Program Files\Sublime Text 2

2012-11-26 22:04:31 206528 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10186.bin

2012-11-26 22:03:42 -------- d-----w- C:\Users\Calum\AppData\Local\Macromedia

2012-11-26 21:52:13 -------- d-----w- C:\Intel

2012-11-26 21:48:30 -------- d-----w- C:\Users\Calum\AppData\Local\Mozilla

2012-11-26 21:48:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service

2012-11-26 21:46:15 -------- d-----w- C:\Users\Calum\AppData\Roaming\Malwarebytes

2012-11-26 21:46:12 -------- d-----w- C:\ProgramData\Malwarebytes

2012-11-26 21:46:11 25928 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys

2012-11-26 21:46:11 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-11-26 21:43:38 50784 ----a-w- C:\ProgramData\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin

2012-11-26 21:43:37 18528 ----a-w- C:\ProgramData\Microsoft\windowssampling\Sqm\Manifest\Sqm2.bin

2012-11-26 21:34:07 -------- d-----w- C:\WINDOWS\Panther

2012-11-26 21:33:25 -------- d-sh--w- C:\Boot

.

==================== Find3M ====================

.

2012-11-02 05:22:08 34304 ----a-w- C:\WINDOWS\SysWow64\wuapp.exe

2012-11-02 05:21:44 83968 ----a-w- C:\WINDOWS\SysWow64\wudriver.dll

2012-11-02 05:21:44 125952 ----a-w- C:\WINDOWS\SysWow64\wuwebv.dll

2012-11-02 05:21:28 246784 ----a-w- C:\WINDOWS\SysWow64\ubpm.dll

2012-11-02 05:20:31 39424 ----a-w- C:\WINDOWS\System32\wuapp.exe

2012-11-02 05:20:28 77824 ----a-w- C:\WINDOWS\System32\taskhost.exe

2012-11-02 05:20:28 72192 ----a-w- C:\WINDOWS\System32\taskhostex.exe

2012-11-02 05:20:10 141824 ----a-w- C:\WINDOWS\System32\wuwebv.dll

2012-11-02 05:20:09 251904 ----a-w- C:\WINDOWS\System32\WUSettingsProvider.dll

2012-11-02 05:20:09 17408 ----a-w- C:\WINDOWS\System32\wuaext.dll

2012-11-02 05:20:09 1619968 ----a-w- C:\WINDOWS\System32\wucltux.dll

2012-11-02 05:19:50 318464 ----a-w- C:\WINDOWS\System32\ubpm.dll

2012-11-02 05:01:27 99328 ----a-w- C:\WINDOWS\System32\wushareduxresources.dll

2012-11-02 04:55:32 212992 ----a-w- C:\WINDOWS\System32\drivers\mrxsmb20.sys

2012-11-02 04:53:13 366080 ----a-w- C:\WINDOWS\System32\drivers\mrxsmb.sys

2012-10-29 05:04:47 522640 ----a-w- C:\WINDOWS\System32\AUDIOKSE.dll

2012-10-29 05:04:47 490064 ----a-w- C:\WINDOWS\System32\AudioEng.dll

2012-10-29 05:04:47 447792 ----a-w- C:\WINDOWS\System32\AudioSes.dll

2012-10-29 05:04:47 253512 ----a-w- C:\WINDOWS\System32\audiodg.exe

2012-10-29 03:21:53 1526784 ----a-w- C:\WINDOWS\System32\mfcore.dll

2012-10-29 03:21:21 267264 ----a-w- C:\WINDOWS\System32\EncDump.dll

2012-10-29 03:20:49 785920 ----a-w- C:\WINDOWS\System32\audiosrv.dll

2012-10-29 03:20:49 169472 ----a-w- C:\WINDOWS\System32\AudioEndpointBuilder.dll

2012-10-29 03:19:08 463768 ----a-w- C:\WINDOWS\SysWow64\AUDIOKSE.dll

2012-10-29 03:19:08 427568 ----a-w- C:\WINDOWS\SysWow64\AudioEng.dll

2012-10-29 03:19:08 324344 ----a-w- C:\WINDOWS\SysWow64\AudioSes.dll

2012-10-29 02:46:23 1451520 ----a-w- C:\WINDOWS\SysWow64\mfcore.dll

2012-10-24 04:54:06 6972136 ----a-w- C:\WINDOWS\System32\ntoskrnl.exe

2012-10-24 03:25:41 26624 ----a-w- C:\WINDOWS\System32\ReAgentc.exe

2012-10-24 03:24:42 439296 ----a-w- C:\WINDOWS\System32\ReAgent.dll

2012-10-24 03:06:12 2706432 ----a-w- C:\WINDOWS\System32\mshtml.tlb

2012-10-24 02:48:12 24064 ----a-w- C:\WINDOWS\SysWow64\ReAgentc.exe

2012-10-24 02:47:29 371712 ----a-w- C:\WINDOWS\SysWow64\ReAgent.dll

2012-10-24 02:27:01 2706432 ----a-w- C:\WINDOWS\SysWow64\mshtml.tlb

2012-10-20 03:22:05 39936 ----a-w- C:\WINDOWS\apppatch\apppatch64\acspecfc.dll

2012-10-20 02:44:53 431104 ----a-w- C:\WINDOWS\apppatch\AcSpecfc.dll

2012-10-20 02:25:35 310784 ----a-w- C:\WINDOWS\apppatch\AcRes.dll

2012-10-19 04:59:28 4056576 ----a-w- C:\WINDOWS\System32\win32k.sys

2012-10-18 06:17:18 69864 ----a-w- C:\WINDOWS\System32\drivers\pdc.sys

2012-10-18 03:20:46 10096640 ----a-w- C:\WINDOWS\System32\twinui.dll

2012-10-18 03:18:40 2302464 ----a-w- C:\WINDOWS\System32\authui.dll

2012-10-18 03:18:33 2146816 ----a-w- C:\WINDOWS\System32\actxprxy.dll

2012-10-18 02:44:38 2033664 ----a-w- C:\WINDOWS\SysWow64\authui.dll

2012-10-18 02:44:33 753664 ----a-w- C:\WINDOWS\SysWow64\actxprxy.dll

2012-10-17 04:32:52 1172992 ----a-w- C:\WINDOWS\System32\mfnetsrc.dll

2012-10-17 04:32:51 677888 ----a-w- C:\WINDOWS\System32\mfnetcore.dll

2012-10-17 04:32:51 673280 ----a-w- C:\WINDOWS\System32\mfmpeg2srcsnk.dll

2012-10-17 04:32:50 1048064 ----a-w- C:\WINDOWS\System32\mfasfsrcsnk.dll

2012-10-17 03:57:37 929792 ----a-w- C:\WINDOWS\SysWow64\mfnetsrc.dll

2012-10-17 03:57:37 568832 ----a-w- C:\WINDOWS\SysWow64\mfnetcore.dll

2012-10-17 03:57:37 513024 ----a-w- C:\WINDOWS\SysWow64\mfmpeg2srcsnk.dll

2012-10-17 03:57:36 850944 ----a-w- C:\WINDOWS\SysWow64\mfasfsrcsnk.dll

2012-10-12 08:08:01 27880 ----a-w- C:\WINDOWS\System32\drivers\rdpvideominiport.sys

2012-10-12 06:14:54 87040 ----a-w- C:\WINDOWS\System32\srmtrace.dll

2012-10-12 06:14:54 652800 ----a-w- C:\WINDOWS\System32\srmscan.dll

2012-10-12 06:14:54 30720 ----a-w- C:\WINDOWS\System32\srm_ps.dll

2012-10-12 06:14:54 279040 ----a-w- C:\WINDOWS\System32\srm.dll

2012-10-12 06:14:54 274432 ----a-w- C:\WINDOWS\System32\srmstormod.dll

2012-10-12 06:14:54 172032 ----a-w- C:\WINDOWS\System32\srmshell.dll

2012-10-12 06:14:54 1347072 ----a-w- C:\WINDOWS\System32\srmclient.dll

2012-10-12 06:14:54 134144 ----a-w- C:\WINDOWS\System32\adrclient.dll

2012-10-12 06:14:40 36352 ----a-w- C:\WINDOWS\System32\rfxvmt.dll

2012-10-12 06:14:39 3244032 ----a-w- C:\WINDOWS\System32\rdpcorets.dll

2012-10-12 06:14:34 115712 ----a-w- C:\WINDOWS\System32\wbem\PolicMan.dll

2012-10-12 06:13:32 109568 ----a-w- C:\WINDOWS\System32\dskquota.dll

2012-10-12 05:50:01 235520 ----a-w- C:\WINDOWS\System32\rdpudd.dll

2012-10-12 05:46:28 618496 ----a-w- C:\WINDOWS\System32\drivers\srv2.sys

2012-10-12 05:41:02 987648 ----a-w- C:\WINDOWS\SysWow64\srmclient.dll

2012-10-12 05:41:02 68096 ----a-w- C:\WINDOWS\SysWow64\srmtrace.dll

2012-10-12 05:41:02 487936 ----a-w- C:\WINDOWS\SysWow64\srmscan.dll

2012-10-12 05:41:02 278528 ----a-w- C:\WINDOWS\SysWow64\srm.dll

2012-10-12 05:41:02 202240 ----a-w- C:\WINDOWS\SysWow64\srmstormod.dll

2012-10-12 05:41:02 15872 ----a-w- C:\WINDOWS\SysWow64\srm_ps.dll

2012-10-12 05:41:02 128000 ----a-w- C:\WINDOWS\SysWow64\srmshell.dll

2012-10-12 05:41:02 104448 ----a-w- C:\WINDOWS\SysWow64\adrclient.dll

2012-10-12 05:40:49 84992 ----a-w- C:\WINDOWS\SysWow64\wbem\PolicMan.dll

2012-10-12 05:39:54 82944 ----a-w- C:\WINDOWS\SysWow64\dskquota.dll

2012-10-11 07:47:18 793200 ----a-w- C:\WINDOWS\System32\mfplat.dll

2012-10-11 07:35:16 2380944 ----a-w- C:\WINDOWS\explorer.exe

2012-10-11 07:26:44 336104 ----a-w- C:\WINDOWS\System32\drivers\Classpnp.sys

2012-10-11 07:25:48 56552 ----a-w- C:\WINDOWS\System32\drivers\sdstor.sys

2012-10-11 07:23:33 1001192 ----a-w- C:\WINDOWS\System32\drivers\ndis.sys

2012-10-11 07:23:32 441576 ----a-w- C:\WINDOWS\System32\drivers\netio.sys

2012-10-11 07:18:25 172264 ----a-w- C:\WINDOWS\System32\drivers\ksecpkg.sys

2012-10-11 07:16:20 1403784 ----a-w- C:\WINDOWS\System32\winload.efi

2012-10-11 07:16:20 1267424 ----a-w- C:\WINDOWS\System32\winload.exe

2012-10-11 07:16:20 1217328 ----a-w- C:\WINDOWS\System32\winresume.efi

2012-10-11 07:16:19 1093880 ----a-w- C:\WINDOWS\System32\winresume.exe

2012-10-11 07:13:54 194280 ----a-w- C:\WINDOWS\System32\drivers\sdbus.sys

2012-10-11 07:13:51 124648 ----a-w- C:\WINDOWS\System32\drivers\dumpsd.sys

2012-10-11 07:13:49 58088 ----a-w- C:\WINDOWS\System32\drivers\dam.sys

2012-10-11 07:13:37 33512 ----a-w- C:\WINDOWS\System32\drivers\battc.sys

2012-10-11 07:08:41 562392 ----a-w- C:\WINDOWS\System32\drivers\cng.sys

2012-10-11 07:02:27 1636672 ----a-w- C:\WINDOWS\System32\WMALFXGFXDSP.dll

2012-10-11 07:01:47 503080 ----a-w- C:\WINDOWS\System32\ci.dll

2012-10-11 05:56:41 2115952 ----a-w- C:\WINDOWS\SysWow64\explorer.exe

2012-10-11 05:45:58 907776 ----a-w- C:\WINDOWS\System32\uxtheme.dll

2012-10-11 05:45:58 53760 ----a-w- C:\WINDOWS\System32\UXInit.dll

2012-10-11 05:45:58 1045504 ----a-w- C:\WINDOWS\System32\usercpl.dll

2012-10-11 05:45:53 3554304 ----a-w- C:\WINDOWS\System32\tquery.dll

.

============= FINISH: 18:52:52.77 ===============

</orphaned></orphaned>

attach.txt

dds.txt