Getting IP Blocking Notices

drgnfr · December 12, 2011

Hello, Im getting the IP blocked notice balloons. I ran the anti-virus, adware, mwab, ms sec essentials scans and all came up clean. The following are the dds & attach txt logs. Thanks in advance!

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Crackers at 19:45:48 on 2011-12-11

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.3343 [GMT -5:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}

FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe

C:\windows\system32\svchost.exe -k RPCSS

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\windows\system32\svchost.exe -k NetworkService

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\windows\system32\svchost.exe -k LocalService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\windows\system32\WLANExt.exe

C:\windows\system32\conhost.exe

C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\windows\system32\taskhost.exe

C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

C:\windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\System32\igfxpers.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\windows\system32\wbem\unsecapp.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

C:\Program Files\DellTPad\Apntex.exe

C:\windows\system32\conhost.exe

C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files (x86)\AWS\WeatherBug\Weather.exe

C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

C:\Program Files (x86)\Earth Alerts\EarthAlerts.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe

C:\windows\system32\taskeng.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\windows\SysWOW64\ctfmon.exe

C:\windows\System32\svchost.exe -k swprv

C:\windows\system32\msiexec.exe

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

C:\windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/?rlz=1V1IPYX

BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre1.6.0_22\bin\jp2ssv.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll

uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

uRun: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1

uRun: [EarthAlerts] C:\Program Files (x86)\Earth Alerts\EarthAlerts.exe

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup

mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"

dRunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f

dRunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: HideFastUserSwitching = 1 (0x1)

mPolicies-system: DisableStartupSound = 1 (0x1)

mPolicies-system: DisplayLastLogonInfo = 1 (0x1)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

TCP: DhcpNameServer = 24.233.167.167 24.233.167.168

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B} : DhcpNameServer = 24.233.167.167 24.233.167.168

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B}\24963736579647 : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B}\24963736579647 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{BC2C2E2B-931F-4D09-B11F-D6285CC2C7EE} : NameServer = 8.26.56.26,156.154.70.22

Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: C:\WINDOWS\SysWOW64\guard32.dll

BHO-X64: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

BHO-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll

BHO-X64: Ad-Aware Security Toolbar - No File

BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.6.0_22\bin\jp2ssv.dll

TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

TB-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup

mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"

AppInit_DLLs-X64: C:\WINDOWS\SysWOW64\guard32.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Crackers\AppData\Roaming\Mozilla\Firefox\Profiles\e31mi06j.default\

FF - prefs.js: browser.search.selectedEngine - Search the Web

FF - prefs.js: browser.startup.homepage - hxxp://www.commondreams.org

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=utf-8&rlz=1V2IPYX&q=

FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre1.6.0_22\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre1.6.0_22\bin\new_plugin\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;C:\windows\system32\DRIVERS\Lbd.sys --> C:\windows\system32\DRIVERS\Lbd.sys [?]

R0 PxHlpa64;PxHlpa64;C:\windows\system32\Drivers\PxHlpa64.sys --> C:\windows\system32\Drivers\PxHlpa64.sys [?]

R1 aswSnx;aswSnx;C:\windows\system32\drivers\aswSnx.sys --> C:\windows\system32\drivers\aswSnx.sys [?]

R1 aswSP;aswSP;C:\windows\system32\drivers\aswSP.sys --> C:\windows\system32\drivers\aswSP.sys [?]

R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\windows\system32\DRIVERS\cmdguard.sys --> C:\windows\system32\DRIVERS\cmdguard.sys [?]

R1 cmdHlp;COMODO Internet Security Helper Driver;C:\windows\system32\DRIVERS\cmdhlp.sys --> C:\windows\system32\DRIVERS\cmdhlp.sys [?]

R1 MpFilter;Microsoft Malware Protection Driver;C:\windows\system32\DRIVERS\MpFilter.sys --> C:\windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-3 89600]

R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-8-8 1166848]

R2 aswFsBlk;aswFsBlk;C:\windows\system32\drivers\aswFsBlk.sys --> C:\windows\system32\drivers\aswFsBlk.sys [?]

R2 aswMonFlt;aswMonFlt;\??\C:\windows\system32\drivers\aswMonFlt.sys --> C:\windows\system32\drivers\aswMonFlt.sys [?]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-12-7 44768]

R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-5-19 921664]

R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-5-19 995392]

R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-6-3 134928]

R2 CLPSLS;COMODO livePCsupport Service;C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-11-23 1267000]

R2 DellDigitalDelivery;Dell Digital Delivery Service;C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-10-26 162816]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-3 13336]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-12-2 2152152]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-7 366152]

R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]

R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-12-7 1153368]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-11-3 1692480]

R2 TurboB;Turbo Boost UI Monitor driver;C:\windows\system32\DRIVERS\TurboB.sys --> C:\windows\system32\DRIVERS\TurboB.sys [?]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-3 2655768]

R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;C:\windows\system32\DRIVERS\AMPPAL.sys --> C:\windows\system32\DRIVERS\AMPPAL.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]

R3 iwdbus;IWD Bus Enumerator;C:\windows\system32\DRIVERS\iwdbus.sys --> C:\windows\system32\DRIVERS\iwdbus.sys [?]

R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-12-7 17152]

R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]

R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\windows\system32\DRIVERS\nusb3hub.sys --> C:\windows\system32\DRIVERS\nusb3hub.sys [?]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\windows\system32\DRIVERS\nusb3xhc.sys --> C:\windows\system32\DRIVERS\nusb3xhc.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-7 136176]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;C:\windows\system32\DRIVERS\amppal.sys --> C:\windows\system32\DRIVERS\amppal.sys [?]

S3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-5-19 1335360]

S3 btmaudio;Intel Bluetooth Audio Service;C:\windows\system32\drivers\btmaud.sys --> C:\windows\system32\drivers\btmaud.sys [?]

S3 btmaux;Intel Bluetooth Auxiliary Service;C:\windows\system32\DRIVERS\btmaux.sys --> C:\windows\system32\DRIVERS\btmaux.sys [?]

S3 btmhsf;btmhsf;C:\windows\system32\DRIVERS\btmhsf.sys --> C:\windows\system32\DRIVERS\btmhsf.sys [?]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-7 136176]

S3 iBtFltCoex;iBtFltCoex;C:\windows\system32\DRIVERS\iBtFltCoex.sys --> C:\windows\system32\DRIVERS\iBtFltCoex.sys [?]

S3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\windows\system32\drivers\intelaud.sys --> C:\windows\system32\drivers\intelaud.sys [?]

S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\windows\system32\DRIVERS\MpNWMon.sys --> C:\windows\system32\DRIVERS\MpNWMon.sys [?]

S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-7-27 340240]

S3 NisDrv;Microsoft Network Inspection System;C:\windows\system32\DRIVERS\NisDrvWFP.sys --> C:\windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]

S3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2011-12-12 00:35:20 41272 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-12-12 00:18:58 -------- d-sh--w- C:\$RECYCLE.BIN

2011-12-12 00:18:36 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E903A67F-D9AC-475C-BC93-9576230F783E}\offreg.dll

2011-12-12 00:16:01 8822856 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E903A67F-D9AC-475C-BC93-9576230F783E}\mpengine.dll

2011-12-11 22:48:40 208896 ----a-w- C:\windows\MBR.exe

2011-12-11 22:48:39 98816 ----a-w- C:\windows\sed.exe

2011-12-11 22:48:39 518144 ----a-w- C:\windows\SWREG.exe

2011-12-11 22:48:39 256000 ----a-w- C:\windows\PEV.exe

2011-12-11 21:32:07 -------- d-----w- C:\Program Files (x86)\FoxTabFLVPlayer

2011-12-11 18:24:28 -------- d-----w- C:\Program Files (x86)\Wallpaper Master

2011-12-11 17:04:13 -------- d-----w- C:\Program Files\Dell Support Center

2011-12-09 14:00:14 8822856 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-12-08 20:22:02 472808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

2011-12-08 19:11:18 158056 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10139.bin

2011-12-08 18:54:41 -------- d-----w- C:\Users\Crackers\AppData\Roaming\images

2011-12-08 18:54:41 -------- d-----w- C:\Program Files (x86)\Earth Alerts

2011-12-08 15:15:07 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Auslogics

2011-12-08 15:13:42 -------- d-----w- C:\Program Files (x86)\Auslogics

2011-12-08 15:10:42 230864 ----a-w- C:\windows\System32\drivers\truecrypt.sys

2011-12-08 15:10:33 -------- d-----w- C:\Program Files\TrueCrypt

2011-12-08 15:07:17 -------- d-----w- C:\Program Files (x86)\uTorrent

2011-12-08 15:06:20 -------- d-----w- C:\Users\Crackers\AppData\Roaming\uTorrent

2011-12-08 15:06:20 -------- d-----w- C:\Users\Crackers\AppData\Local\uTorrent

2011-12-08 14:58:02 -------- d-----w- C:\Program Files (x86)\Common Files\Spigot

2011-12-08 14:57:52 -------- d-----w- C:\ProgramData\YouTube Downloader

2011-12-08 14:57:44 -------- d-----w- C:\Program Files (x86)\YouTube Downloader

2011-12-08 14:37:57 -------- d-----w- C:\Users\Crackers\AppData\Local\Diagnostics

2011-12-08 07:43:52 -------- d-----w- C:\Users\Crackers\AppData\Roaming\PCDr

2011-12-08 07:06:37 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Earth Alerts

2011-12-08 05:27:46 -------- d-----w- C:\Program Files (x86)\Winamp Detect

2011-12-08 05:24:20 -------- d-----w- C:\Users\Crackers\AppData\Roaming\ACD Systems

2011-12-08 05:24:20 -------- d-----w- C:\Users\Crackers\AppData\Local\ACD Systems

2011-12-08 05:22:48 -------- d-----w- C:\ProgramData\ACD Systems

2011-12-08 05:22:37 -------- d-----w- C:\Program Files (x86)\Common Files\ACD Systems

2011-12-08 05:22:37 -------- d-----w- C:\Program Files (x86)\ACD Systems

2011-12-08 04:05:44 -------- d-----w- C:\Users\Crackers\AppData\Local\Intel WiDi

2011-12-08 04:01:27 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{69B9F589-7121-40A8-BC65-92D44BA55739}\gapaengine.dll

2011-12-08 03:55:53 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2011-12-08 03:55:49 -------- d-----w- C:\Program Files\Microsoft Security Client

2011-12-08 03:43:32 -------- d-----w- C:\Program Files (x86)\JDownloader

2011-12-08 03:22:56 -------- d-----w- C:\Program Files (x86)\K-NFB Reading Technology Inc

2011-12-08 03:21:59 -------- d-----w- C:\Users\Crackers\AppData\Local\Downloaded Installations

2011-12-08 03:20:55 -------- d-----w- C:\Users\Crackers\AppData\Local\Kjs.AppLife.Update

2011-12-08 03:19:24 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Blio

2011-12-08 03:17:08 -------- d-----w- C:\Program Files (x86)\VideoLAN

2011-12-08 03:03:57 -------- d-----w- C:\Users\Crackers\AppData\Roaming\com.pandora.desktop.FB9956FD96E03239939108614098AD95535EE674.1

2011-12-08 03:03:54 -------- d-----w- C:\Program Files (x86)\Pandora

2011-12-08 02:57:07 -------- d-----w- C:\Program Files (x86)\Foxit Software

2011-12-08 00:40:08 16432 ----a-w- C:\windows\System32\lsdelete.exe

2011-12-07 23:47:49 -------- d-----w- C:\Users\Crackers\AppData\Local\WeatherBug

2011-12-07 23:47:46 -------- d-----w- C:\Users\Crackers\AppData\Roaming\WeatherBug

2011-12-07 23:47:39 -------- d-----w- C:\Program Files (x86)\AWS

2011-12-07 23:43:39 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3

2011-12-07 23:30:07 55384 ----a-w- C:\windows\System32\drivers\SBREDrv.sys

2011-12-07 23:29:19 -------- d-----w- C:\ProgramData\PCDr

2011-12-07 23:27:20 -------- d-----w- C:\Users\Crackers\AppData\Local\adaware

2011-12-07 23:27:18 -------- d-----w- C:\ProgramData\Ad-Aware Browsing Protection

2011-12-07 23:27:11 -------- d-----w- C:\Program Files (x86)\Toolbar Cleaner

2011-12-07 23:26:35 -------- d-----w- C:\Program Files (x86)\adawaretb

2011-12-07 23:26:18 69376 ----a-w- C:\windows\System32\drivers\Lbd.sys

2011-12-07 23:26:00 -------- d-----w- C:\Program Files (x86)\Lavasoft

2011-12-07 23:19:42 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Malwarebytes

2011-12-07 23:19:36 -------- d-----w- C:\ProgramData\Malwarebytes

2011-12-07 23:19:32 25416 ----a-w- C:\windows\System32\drivers\mbam.sys

2011-12-07 23:19:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-12-07 23:10:14 -------- d-----w- C:\ProgramData\CPA_VA

2011-12-07 22:59:20 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2011-12-07 22:59:20 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2011-12-07 22:55:45 -------- d-----w- C:\ProgramData\Comodo

2011-12-07 22:55:41 1700352 ----a-w- C:\windows\SysWow64\gdiplus.dll

2011-12-07 22:55:41 -------- d-----w- C:\Program Files\COMODO

2011-12-07 22:54:31 -------- d-----w- C:\ProgramData\Comodo Downloader

2011-12-07 22:47:17 -------- d-----w- C:\Users\Crackers\AppData\Local\Google

2011-12-07 22:47:11 66904 ----a-w- C:\windows\System32\drivers\aswMonFlt.sys

2011-12-07 22:47:11 591192 ----a-w- C:\windows\System32\drivers\aswSnx.sys

2011-12-07 22:46:55 41184 ----a-w- C:\windows\avastSS.scr

2011-12-07 22:46:46 -------- d-----w- C:\ProgramData\AVAST Software

2011-12-07 22:46:46 -------- d-----w- C:\Program Files\AVAST Software

2011-12-07 22:43:23 -------- d-----w- C:\Users\Crackers\AppData\Local\Adobe

2011-12-07 22:20:51 -------- d-----w- C:\Users\Crackers\AppData\Local\Thunderbird

2011-12-07 21:06:24 -------- d-----w- C:\TrustedID IDMonitor Identity Protection

2011-12-07 21:05:45 -------- d-----w- C:\Program Files (x86)\Dell Digital Delivery

2011-12-07 21:01:40 -------- d-----w- C:\windows\SysWow64\Wat

2011-12-07 21:01:40 -------- d-----w- C:\windows\System32\Wat

2011-12-07 20:57:30 870912 ----a-w- C:\windows\SysWow64\XpsPrint.dll

2011-12-07 20:57:30 1465344 ----a-w- C:\windows\System32\XpsPrint.dll

2011-12-07 20:57:25 2048 ----a-w- C:\windows\SysWow64\tzres.dll

2011-12-07 20:57:25 2048 ----a-w- C:\windows\System32\tzres.dll

2011-12-07 20:56:59 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll

2011-12-07 20:56:58 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll

2011-12-07 20:56:57 3144704 ----a-w- C:\windows\System32\win32k.sys

2011-12-07 20:56:50 142336 ----a-w- C:\windows\System32\poqexec.exe

2011-12-07 20:56:50 123904 ----a-w- C:\windows\SysWow64\poqexec.exe

2011-12-07 20:56:49 1923952 ----a-w- C:\windows\System32\drivers\tcpip.sys

2011-12-07 20:56:46 75776 ----a-w- C:\windows\SysWow64\psisrndr.ax

2011-12-07 20:56:46 613888 ----a-w- C:\windows\System32\psisdecd.dll

2011-12-07 20:56:46 465408 ----a-w- C:\windows\SysWow64\psisdecd.dll

2011-12-07 20:56:46 108032 ----a-w- C:\windows\System32\psisrndr.ax

2011-12-07 20:50:42 -------- d-----w- C:\Users\Crackers\AppData\Local\Nero_AG

2011-12-07 20:50:08 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2011-12-07 20:43:21 -------- d-----w- C:\Users\Crackers\AppData\Local\Nero

2011-12-07 20:38:25 861696 ----a-w- C:\windows\System32\oleaut32.dll

2011-12-07 20:38:25 571904 ----a-w- C:\windows\SysWow64\oleaut32.dll

2011-12-07 20:38:25 331776 ----a-w- C:\windows\System32\oleacc.dll

2011-12-07 20:38:25 233472 ----a-w- C:\windows\SysWow64\oleacc.dll

2011-12-07 20:35:09 -------- d-----w- C:\Program Files (x86)\Dell Touch Software Suite

2011-12-07 20:35:09 -------- d-----w- C:\FIND_EULA_PATH

2011-12-07 20:28:43 -------- d-----w- C:\Users\Crackers\AppData\Local\Dell

2011-12-07 20:28:09 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Fingertapps

2011-12-07 20:28:09 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Dell

2011-12-07 20:28:02 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Dell Touch Zone

2011-12-07 20:27:56 -------- d-----w- C:\Users\Crackers\AppData\Roaming\Intel Corporation

2011-12-07 20:27:25 -------- d-----w- C:\Users\Crackers\AppData\Local\VirtualStore

.

==================== Find3M ====================

.

2011-12-08 20:24:20 521448 ----a-w- C:\windows\System32\deployJava1.dll

2011-12-07 23:42:53 472808 ----a-w- C:\windows\SysWow64\deployJava1.dll

2011-10-07 23:47:58 574216 ----a-w- C:\windows\System32\drivers\cmdGuard.sys

2011-10-07 23:47:58 43248 ----a-w- C:\windows\System32\drivers\cmdhlp.sys

2011-10-07 23:47:56 16528 ----a-w- C:\windows\System32\drivers\cmderd.sys

2011-10-07 23:47:14 41200 ----a-w- C:\windows\System32\cmdcsr.dll

2011-10-07 23:47:12 300200 ----a-w- C:\windows\SysWow64\guard32.dll

2011-10-07 23:47:10 388280 ----a-w- C:\windows\System32\guard64.dll

.

============= FINISH: 19:46:07.77 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 12/7/2011 3:24:08 PM

System Uptime: 12/11/2011 7:18:16 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0Y0RMG

Processor: Intel® Core i5-2430M CPU @ 2.40GHz | CPU 1 | 2401/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 581 GiB total, 412.449 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP20: 12/8/2011 2:05:18 AM - Installed Earth Alerts

RP21: 12/8/2011 2:31:21 AM - Installed Earth Alerts

RP22: 12/8/2011 2:31:42 AM - Installed Earth Alerts

RP23: 12/8/2011 2:54:51 AM - Installed Earth Alerts

RP24: 12/8/2011 2:55:33 AM - Windows Update

RP25: 12/8/2011 9:40:07 AM - Removed Earth Alerts

RP26: 12/8/2011 10:10:34 AM - TrueCrypt installation

RP27: 12/8/2011 10:31:30 AM - Auslogics Regisry Defrag - before defragmentation

RP28: 12/8/2011 10:32:40 AM - Device Driver Package Install: Microsoft Network adapters

RP29: 12/8/2011 1:54:19 PM - Installed Earth Alerts

RP30: 12/8/2011 3:21:30 PM - Removed Java 6 Update 29

RP31: 12/8/2011 3:22:47 PM - Removed Java 6 Update 27 (64-bit)

RP32: 12/8/2011 3:24:07 PM - Installed Java 6 Update 24 (64-bit)

RP33: 12/8/2011 4:56:02 PM - Windows Update

RP34: 12/11/2011 12:03:51 PM - Installed Dell Support Center

RP35: 12/11/2011 7:41:49 PM - Removed Skype™ 4.2

RP36: 12/11/2011 7:42:14 PM - Removed Skype Toolbars

.

==== Installed Programs ======================

.

µTorrent

Accidental Damage Services Agreement

ACDSee Pro 3

Ad-Aware

Ad-Aware Security Toolbar

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Advanced Audio FX Engine

Auslogics BoostSpeed

avast! Free Antivirus

Banctec Service Agreement

Blio

COMODO GeekBuddy

Complete Care Business Service Agreement

Consumer In-Home Service Agreement

Cozi

D3DX10

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell DataSafe Online

Dell Digital Delivery

Dell Getting Started Guide

Dell Home Systems Service Agreement

Dell MusicStage

Dell PhotoStage

Dell Stage

Dell VideoStage

DirectX 9 Runtime

Earth Alerts

Foxit Reader 5.1

Google Chrome

Google Earth

Google Update Helper

High-Definition Video Playback

IDT Audio

Intel PROSet Wireless

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Intel® Rapid Storage Technology

Intel® WiDi

Java Auto Updater

Java 6 Update 22

JDownloader 0.9

Junk Mail filter update

Malwarebytes' Anti-Malware version 1.51.2.1300

Mesh Runtime

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 8.0.1 (x86 en-US)

Mozilla Thunderbird (8.0)

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 10 Movie ThemePack Basic

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero Update

OpenOffice.org 3.3

Pandora

PhotoShowExpress

PlayReady PC Runtime x86

Premium Service Agreement

QualxServ Service Agreement

Realtek Ethernet Controller Driver

Realtek USB 2.0 Card Reader

Renesas Electronics USB 3.0 Host Controller Driver

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Sonic CinePlayer Decoder Pack

Spybot - Search & Destroy

SyncUP

TrueCrypt

TrustedID

TrustedID IDMonitor Identity Protection

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

VLC media player 1.1.11

Wallpaper Master v2.16

WeatherBug

Winamp

Winamp Detector Plug-in

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

YouTube Downloader 3.4

Zinio Reader 4

.

==== Event Viewer Messages From Past Week ========

.

12/9/2011 8:49:40 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 9:58:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Application Updater service to connect.

12/8/2011 9:30:55 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service service to connect.

12/8/2011 9:30:55 AM, Error: Service Control Manager [7000] - The Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

12/8/2011 6:23:55 PM, Error: NetBT [4321] - The name "CRACKERS-PC :0" could not be registered on the interface with IP address 192.168.0.101. The computer with the IP address 192.168.0.102 did not allow the name to be claimed by this computer.

12/8/2011 6:11:38 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{080770FD-6B9E-4968-91F1-15F91B08D53B} because another computer on the network has the same name. The server could not start.

12/8/2011 6:11:38 PM, Error: NetBT [4321] - The name "CRACKERS-PC :20" could not be registered on the interface with IP address 192.168.0.101. The computer with the IP address 192.168.0.102 did not allow the name to be claimed by this computer.

12/8/2011 3:27:07 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 2:21:35 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 2:17:37 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 12:46:30 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 11:05:00 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 10:43:37 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

12/8/2011 10:39:22 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/8/2011 1:48:45 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/7/2011 6:23:41 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

12/7/2011 5:56:24 PM, Error: Service Control Manager [7030] - The COMODO Internet Security Helper Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

12/7/2011 4:05:40 PM, Error: Service Control Manager [7034] - The Dell Digital Delivery Service service terminated unexpectedly. It has done this 1 time(s).

12/7/2011 4:03:38 PM, Error: Service Control Manager [7023] -

12/7/2011 11:27:11 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/7/2011 11:04:47 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.

12/7/2011 11:01:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

12/11/2011 9:30:31 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/11/2011 7:19:15 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

12/11/2011 7:12:30 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

12/11/2011 6:01:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

12/11/2011 5:57:41 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Bluetooth Device Monitor service.

12/11/2011 5:55:30 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

12/11/2011 5:47:55 PM, Error: Service Control Manager [7034] - The COMODO livePCsupport Service service terminated unexpectedly. It has done this 1 time(s).

12/11/2011 5:45:32 PM, Error: Service Control Manager [7034] - The Bluetooth OBEX Service service terminated unexpectedly. It has done this 1 time(s).

12/11/2011 12:00:36 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

.

==== End Of File ===========================

drgnfr · December 22, 2011

Can anyone help with this ??

Thanks

LDTate · December 23, 2011

Hello and Welcome to the forum.

Looks like you're running 2 anti-virus programs.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!

The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.

Also because more than one Antivirus and Firewall installed are not compatible with each other, it can cause system performance problems and a serious system slowdown.

Please do not delete anything unless instructed to.

1.Click Start > Settings > Control Panel.

2.Next, open Add/Remove Programs and remove 2 of them.

drgnfr · December 24, 2011

Ok thats interesting. I deleted the Lavasoft Adware & MS security essentials. I kept Avast AV.

LDTate · December 24, 2011

Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

drgnfr · December 26, 2011

I ran a new scan, pc is still showing a few blocked ip balloons, not nearly as many as before.

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 911122602

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

12/26/2011 9:56:13 AM

mbam-log-2011-12-26 (09-56-13).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 313460

Time elapsed: 36 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

LDTate · December 26, 2011

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

drgnfr · December 26, 2011

I ran combofix, results attached:

ComboFix 11-12-26.02 - Crackers 12/26/2011 13:50:03.3.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.4080 [GMT -5:00]

Running from: c:\users\Crackers\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\java.exe

.

((((((((((((((((((((((((( Files Created from 2011-11-26 to 2011-12-26 )))))))))))))))))))))))))))))))

.

2011-12-26 18:54 . 2011-12-26 18:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-26 18:54 . 2011-12-26 18:54 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2011-12-25 15:55 . 2011-12-26 14:03 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{53623D49-E951-4D33-95FC-C78594BD8BFA}\offreg.dll

2011-12-25 15:55 . 2011-11-30 07:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{53623D49-E951-4D33-95FC-C78594BD8BFA}\mpengine.dll

2011-12-24 13:44 . 2011-12-24 13:44 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-12-23 18:11 . 2011-12-23 18:11 -------- d-----w- c:\program files (x86)\FlashGet

2011-12-21 16:18 . 2010-07-26 03:23 56496 ----a-w- c:\windows\SysWow64\wbhelp2.dll

2011-12-21 16:18 . 2010-07-26 03:23 544768 ----a-w- c:\windows\SysWow64\wbocx.ocx

2011-12-21 16:18 . 2010-07-26 03:23 33968 ----a-w- c:\windows\SysWow64\anim.dll

2011-12-21 16:18 . 2010-07-26 03:23 258352 ----a-w- c:\windows\SysWow64\unicows.dll

2011-12-21 16:18 . 2011-12-23 02:49 -------- d-----w- c:\program files (x86)\WinUtilities

2011-12-21 16:18 . 2010-07-26 03:23 4608 ----a-w- c:\windows\SysWow64\W95INF32.DLL

2011-12-21 16:18 . 2010-07-26 03:23 2272 ----a-w- c:\windows\SysWow64\W95INF16.DLL

2011-12-17 19:57 . 2011-12-17 19:57 -------- d-----w- c:\program files (x86)\7-Zip

2011-12-14 03:52 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll

2011-12-14 03:52 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll

2011-12-14 03:52 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys

2011-12-14 03:50 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll

2011-12-14 03:50 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2011-12-14 03:50 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-13 03:57 . 2011-12-13 03:57 -------- d-----w- c:\program files (x86)\Megaupload

2011-12-12 01:22 . 2010-01-10 23:40 118784 ----a-w- c:\windows\SysWow64\MSSTDFMT.DLL

2011-12-12 01:22 . 2011-12-12 01:24 -------- d-----w- c:\program files (x86)\SpywareBlaster

2011-12-11 21:32 . 2011-12-11 21:36 -------- d-----w- c:\program files (x86)\FoxTabFLVPlayer

2011-12-11 18:24 . 2011-12-11 23:01 -------- d-----w- c:\program files (x86)\Wallpaper Master

2011-12-09 02:01 . 2011-12-09 02:01 -------- d-----w- c:\windows\Sun

2011-12-08 20:24 . 2011-12-08 20:24 -------- d-----w- c:\program files\Java

2011-12-08 19:11 . 2011-12-08 19:11 158056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10139.bin

2011-12-08 18:54 . 2011-12-11 14:49 -------- d-----w- c:\program files (x86)\Earth Alerts

2011-12-08 15:13 . 2011-12-08 15:13 -------- d-----w- c:\program files (x86)\Auslogics

2011-12-08 15:10 . 2011-12-08 15:10 230864 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2011-12-08 15:10 . 2011-12-08 15:10 -------- d-----w- c:\program files\TrueCrypt

2011-12-08 15:07 . 2011-12-08 15:07 -------- d-----w- c:\program files (x86)\uTorrent

2011-12-08 14:58 . 2011-12-08 14:58 -------- d-----w- c:\program files (x86)\Common Files\Spigot

2011-12-08 14:57 . 2011-12-08 14:57 -------- d-----w- c:\programdata\YouTube Downloader

2011-12-08 14:57 . 2011-12-08 14:57 -------- d-----w- c:\program files (x86)\YouTube Downloader

2011-12-08 05:27 . 2011-12-08 06:00 -------- d-----w- c:\program files (x86)\Winamp Detect

2011-12-08 05:27 . 2011-12-08 06:00 -------- d-----w- c:\program files (x86)\Winamp

2011-12-08 05:22 . 2011-12-08 05:22 -------- d-----w- c:\programdata\ACD Systems

2011-12-08 05:22 . 2011-12-08 05:22 -------- d-----w- c:\program files (x86)\Common Files\ACD Systems

2011-12-08 05:22 . 2011-12-08 05:22 -------- d-----w- c:\program files (x86)\ACD Systems

2011-12-08 03:43 . 2011-12-26 18:49 -------- d-----w- c:\program files (x86)\JDownloader

2011-12-08 03:22 . 2011-12-08 03:22 -------- d-----w- c:\users\Public\Blio

2011-12-08 03:22 . 2011-12-08 03:22 -------- d-----w- c:\program files (x86)\K-NFB Reading Technology Inc

2011-12-08 03:17 . 2011-12-08 03:17 -------- d-----w- c:\program files (x86)\VideoLAN

2011-12-08 03:03 . 2011-12-08 03:03 -------- d-----w- c:\program files (x86)\Pandora

2011-12-08 02:57 . 2011-12-08 02:57 -------- d-----w- c:\program files (x86)\Foxit Software

2011-12-07 23:47 . 2011-12-07 23:47 -------- d-----w- c:\program files (x86)\AWS

2011-12-07 23:43 . 2011-12-07 23:44 -------- d-----w- c:\program files (x86)\OpenOffice.org 3

2011-12-07 23:30 . 2011-12-07 23:30 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-12-07 23:29 . 2011-12-11 17:09 -------- d-----w- c:\programdata\PCDr

2011-12-07 23:27 . 2011-12-07 23:27 -------- d-----w- c:\program files (x86)\Toolbar Cleaner

2011-12-07 23:26 . 2011-12-24 14:17 -------- dc----w- c:\windows\system32\DRVSTORE

2011-12-07 23:26 . 2011-12-24 14:17 -------- d-----w- c:\programdata\Lavasoft

2011-12-07 23:19 . 2011-12-07 23:19 -------- d-----w- c:\programdata\Malwarebytes

2011-12-07 23:19 . 2011-08-31 22:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-07 23:19 . 2011-12-07 23:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-12-07 23:10 . 2011-12-07 23:10 -------- d-----w- c:\programdata\CPA_VA

2011-12-07 22:59 . 2011-12-26 18:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2011-12-07 22:59 . 2011-12-07 23:02 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

2011-12-07 22:55 . 2011-12-07 22:56 -------- d-----w- c:\programdata\Comodo

2011-12-07 22:55 . 2011-12-07 22:55 -------- d-----w- c:\program files\COMODO

2011-12-07 22:55 . 2011-12-07 22:55 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll

2011-12-07 22:54 . 2011-12-07 22:55 -------- d-----w- c:\programdata\Comodo Downloader

2011-12-07 22:47 . 2011-12-08 03:25 -------- d-----w- c:\program files (x86)\Google

2011-12-07 22:47 . 2011-11-28 17:53 304472 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-12-07 22:47 . 2011-11-28 17:52 42328 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-12-07 22:47 . 2011-11-28 17:51 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-12-07 22:47 . 2011-11-28 18:01 256960 ----a-w- c:\windows\system32\aswBoot.exe

2011-12-07 22:47 . 2011-11-28 17:54 591192 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-12-07 22:47 . 2011-11-28 17:52 58712 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-12-07 22:47 . 2011-11-28 17:52 66904 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-12-07 22:46 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr

2011-12-07 22:46 . 2011-11-28 18:01 199816 ----a-w- c:\windows\SysWow64\aswBoot.exe

2011-12-07 22:46 . 2011-12-07 22:46 -------- d-----w- c:\programdata\AVAST Software

2011-12-07 22:46 . 2011-12-07 22:46 -------- d-----w- c:\program files\AVAST Software

2011-12-07 22:20 . 2011-12-21 16:38 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird

2011-12-07 21:06 . 2011-12-07 21:06 -------- d-----w- C:\TrustedID IDMonitor Identity Protection

2011-12-07 21:05 . 2011-12-07 21:05 -------- d-----w- c:\program files (x86)\Dell Digital Delivery

2011-12-07 21:01 . 2011-12-07 21:01 -------- d-----w- c:\windows\SysWow64\Wat

2011-12-07 21:01 . 2011-12-07 21:01 -------- d-----w- c:\windows\system32\Wat

2011-12-07 20:57 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll

2011-12-07 20:57 . 2011-03-12 11:23 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll

2011-12-07 20:56 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-12-07 20:56 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll

2011-12-07 20:56 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-12-07 20:56 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

2011-12-07 20:56 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-12-07 20:56 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll

2011-12-07 20:56 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax

2011-12-07 20:56 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll

2011-12-07 20:56 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax

2011-12-07 20:50 . 2011-12-07 20:50 -------- d-----w- c:\program files (x86)\MSXML 4.0

2011-12-07 20:38 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll

2011-12-07 20:38 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll

2011-12-07 20:38 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll

2011-12-07 20:38 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll

2011-12-07 20:35 . 2011-12-07 20:35 -------- d-----w- C:\FIND_EULA_PATH

2011-12-07 20:35 . 2011-12-07 20:35 -------- d-----w- c:\program files (x86)\Dell Touch Software Suite

2011-12-07 20:24 . 2011-12-26 18:51 -------- d-----w- c:\users\Crackers

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-19 18:59 . 2011-10-07 23:48 93200 ----a-w- c:\windows\system32\drivers\inspect.sys

2011-12-19 18:59 . 2011-10-07 23:47 43248 ----a-w- c:\windows\system32\drivers\cmdhlp.sys

2011-12-19 18:59 . 2011-10-07 23:47 577824 ----a-w- c:\windows\system32\drivers\cmdGuard.sys

2011-12-19 18:59 . 2011-10-07 23:47 22696 ----a-w- c:\windows\system32\drivers\cmderd.sys

2011-12-19 18:58 . 2011-10-07 23:47 41200 ----a-w- c:\windows\system32\cmdcsr.dll

2011-12-19 18:58 . 2011-10-07 23:47 301224 ----a-w- c:\windows\SysWow64\guard32.dll

2011-12-19 18:58 . 2011-10-07 23:47 389840 ----a-w- c:\windows\system32\guard64.dll

2011-12-08 20:24 . 2011-11-03 21:37 521448 ----a-w- c:\windows\system32\deployJava1.dll

2011-12-07 23:42 . 2011-11-03 21:37 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-12-07 20:26 . 2010-06-24 16:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-11-15 19:29 . 2010-11-21 03:27 270720 ------w- c:\windows\system32\MpSigStub.exe

2011-11-03 21:38 . 2011-11-03 21:38 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-11-03 21:38 . 2011-11-03 21:38 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2011-11-03 21:38 . 2011-11-03 21:38 85504 ----a-w- c:\windows\system32\iesetup.dll

2011-11-03 21:38 . 2011-11-03 21:38 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2011-11-03 21:38 . 2011-11-03 21:38 76800 ----a-w- c:\windows\system32\tdc.ocx

2011-11-03 21:38 . 2011-11-03 21:38 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2011-11-03 21:38 . 2011-11-03 21:38 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2011-11-03 21:38 . 2011-11-03 21:38 603648 ----a-w- c:\windows\system32\vbscript.dll

2011-11-03 21:38 . 2011-11-03 21:38 49664 ----a-w- c:\windows\system32\imgutil.dll

2011-11-03 21:38 . 2011-11-03 21:38 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2011-11-03 21:38 . 2011-11-03 21:38 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-11-03 21:38 . 2011-11-03 21:38 448512 ----a-w- c:\windows\system32\html.iec

2011-11-03 21:38 . 2011-11-03 21:38 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2011-11-03 21:38 . 2011-11-03 21:38 367104 ----a-w- c:\windows\SysWow64\html.iec

2011-11-03 21:38 . 2011-11-03 21:38 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2011-11-03 21:38 . 2011-11-03 21:38 30720 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-03 21:38 . 2011-11-03 21:38 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2011-11-03 21:38 . 2011-11-03 21:38 222208 ----a-w- c:\windows\system32\msls31.dll

2011-11-03 21:38 . 2011-11-03 21:38 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2011-11-03 21:38 . 2011-11-03 21:38 165888 ----a-w- c:\windows\system32\iexpress.exe

2011-11-03 21:38 . 2011-11-03 21:38 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2011-11-03 21:38 . 2011-11-03 21:38 160256 ----a-w- c:\windows\system32\wextract.exe

2011-11-03 21:38 . 2011-11-03 21:38 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2011-11-03 21:38 . 2011-11-03 21:38 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2011-11-03 21:38 . 2011-11-03 21:38 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2011-11-03 21:38 . 2011-11-03 21:38 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-11-03 21:38 . 2011-11-03 21:38 12288 ----a-w- c:\windows\system32\mshta.exe

2011-11-03 21:38 . 2011-11-03 21:38 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2011-11-03 21:38 . 2011-11-03 21:38 114176 ----a-w- c:\windows\system32\admparse.dll

2011-11-03 21:38 . 2011-11-03 21:38 111616 ----a-w- c:\windows\system32\iesysprep.dll

2011-11-03 21:38 . 2011-11-03 21:38 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2011-11-03 21:38 . 2011-11-03 21:38 101888 ----a-w- c:\windows\SysWow64\admparse.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"Weather"="c:\program files (x86)\AWS\WeatherBug\Weather.exe" [2011-10-05 1652736]

"EarthAlerts"="c:\program files (x86)\Earth Alerts\EarthAlerts.exe" [2011-12-11 2923520]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2011-05-30 885760]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"adaware"="reg.exe delete HKCU\Software\AppDataLow\Software\adaware" [X]

"adaware_XP"="reg.exe delete HKCU\Software\adaware" [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 1 (0x1)

"DisableStartupSound"= 1 (0x1)

"DisplayLastLogonInfo"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll c:\windows\SysWOW64\guard32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-05-19 995392]

R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-11-23 1267000]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-07 136176]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]

R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-05-19 1335360]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-07 136176]

R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys [x]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-07-28 340240]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]

S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-08 1166848]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-05-19 921664]

S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 134928]

S2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-10-26 162816]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]

S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-07-08 1692480]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]

S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]

S3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys [x]

S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]

S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]

S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-07 22:47]

.

2011-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-07 22:47]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-07-28 1935120]

"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-12-21 9454920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

"AppInit_DLLs"=c:\windows\System32\guard64.dll c:\windows\System32\guard64.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/?rlz=1V1IPYX

IE: &Download All with FlashGet - c:\program files (x86)\FlashGet\jc_all.htm

IE: &Download with FlashGet - c:\program files (x86)\FlashGet\jc_link.htm

TCP: DhcpNameServer = 24.233.167.167 24.233.167.168

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B}: NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{080770FD-6B9E-4968-91F1-15F91B08D53B}\24963736579647: NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{BC2C2E2B-931F-4D09-B11F-D6285CC2C7EE}: NameServer = 8.26.56.26,156.154.70.22

DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

FF - ProfilePath - c:\users\Crackers\AppData\Roaming\Mozilla\Firefox\Profiles\e31mi06j.default\

FF - prefs.js: browser.search.selectedEngine - Search the Web

FF - prefs.js: browser.startup.homepage - hxxp://www.commondreams.org

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=utf-8&rlz=1V2IPYX&q=

FF - prefs.js: network.proxy.type - 0

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.032"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.abr"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ani"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.apd"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.arw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.bay"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.bmp"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.bw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.cr2"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.crw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.cs1"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.cur"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.dcr"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.dcx"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.dib"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.djv"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.djvu"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.dng"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.emf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.eps"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.erf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.fff"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.fpx"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.gif"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.hdr"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.icl"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.icn"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]

@Denied: (2) (S-1-5-21-876841386-1137961804-4033056947-1001)

@Denied: (2) (LocalSystem)

"Progid"="Winamp.File.iff"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ilbm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.int"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.inta"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.iw4"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.j2c"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.j2k"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jbr"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jfif"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jif"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jp2"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpc"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpe"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpeg"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpg"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpk"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.jpx"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.kdc"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.lbm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.mef"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.mos"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.mrw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.nef"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.nrw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.orf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pbm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pbr"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pcd"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pct"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pcx"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pef"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pgm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pic"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pict"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pix"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.png"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ppm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.psd"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.psp"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pspbrush"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.pspimage"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.raf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ras"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]

@Denied: (2) (S-1-5-21-876841386-1137961804-4033056947-1001)

@Denied: (2) (LocalSystem)

"Progid"="Winamp.File.raw"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rgb"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rgba"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rle"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rsb"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rw2"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.rwl"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.sgi"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.sr2"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.srf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.tga"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.thm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.tif"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.tiff"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ttc"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.ttf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.v30po"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.v30pp"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.v30ppf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.wbm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.wbmp"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.wmf"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.xbm"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.xif"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.xmp"

.

[HKEY_USERS\S-1-5-21-876841386-1137961804-4033056947-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Pro 3.xpm"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2011-12-26 13:56:24

ComboFix-quarantined-files.txt 2011-12-26 18:56

ComboFix2.txt 2011-12-12 00:14

ComboFix3.txt 2011-12-11 22:57

.

Pre-Run: 100,847,128,576 bytes free

Post-Run: 100,668,903,424 bytes free

.

- - End Of File - - FD7CBDA1CCAF7A25DF0EDC82099C224B

LDTate · December 27, 2011

Did you set this as your start page?

FF - prefs.js: browser.startup.homepage - hxxp://www.commondreams.org

You also need to let me know how it's running

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

ClearJavaCache::

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"adaware"=-
"adaware_XP"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

drgnfr · December 27, 2011

The http://www.commondreams.org is set as my homepage. PC seems to be trying to connect to only One malicious website now. This is a sample of the malawarebytes log:

19:23:16 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57657, Process: avastsvc.exe)

19:23:16 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57658, Process: avastsvc.exe)

19:23:24 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57748, Process: avastsvc.exe)

19:23:24 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57750, Process: avastsvc.exe)

19:23:40 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57849, Process: avastsvc.exe)

19:23:40 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 57851, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58193, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58196, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58203, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58204, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58214, Process: avastsvc.exe)

19:23:56 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58215, Process: avastsvc.exe)

19:24:05 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58242, Process: avastsvc.exe)

19:24:05 Crackers IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 58243, Process: avastsvc.exe)

The results of the combofix with cfscript:

ComboFix 11-12-26.02 - Crackers 12/26/2011 22:32:19.5.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.4128 [GMT -5:00]

Running from: c:\users\Crackers\Desktop\ComboFix.exe

Command switches used :: c:\users\Crackers\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2011-11-27 to 2011-12-27 )))))))))))))))))))))))))))))))

.

2011-12-27 03:37 . 2011-12-27 03:37 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-27 03:37 . 2011-12-27 03:37 -------- d-----w- c:\users\Administrator\AppData\Local\temp