Alureon-K residue?

Steener19 · February 14, 2012

I have damage or residue from a recent Alureon-K virus infection.

After reading the postings regarding this virus I was able to get rid of it using TDSS killer. The process appeared to go fine; I have run several scans with my resident avast! as well as several scans using Malwarebytes and Trendmicro Housecall. They all read clean but I have some residual problems.

I seem to have "lost" my Administrator priviledges and while I can still install programs, I can't access various previously installed programs; I can't update Windows; I can't do a system restore.

After removal of the virus the majority of existing file icons were greyed out (like hiddenfiles). When I installed a new program the new icons were fine and the program runs without problems. Based on that, I tried re-setting the File Attributes. That corrected all the greyed out icons but I can't figure out what to do about the lost Adminisrator status issue.

Should I re-install the O/S or will that just create a different set of problems? My O/S is XP Pro.

In preparation for any assitance you can give me, I have downloaded and run DDS and I will attach the scans as suggested.

dds.txt attach.txt

Thanks,

Steener19

Maniac · February 14, 2012

Hello Steener19! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Please follow the instructions here:

www.bleepingcomputer.com/combofix/how-to-use-combofix#use

Please post the log file from ComboFix and a new fresh DDS log files.

Steener19 · February 14, 2012

Hello Maniac!

Thanks for the response and instructions. I will do as you say and post the results later today.

Steener19 (from Canada, in case you were wondering)

Steener19 · February 15, 2012

Hello Maniac,

Here are the scans you requested. I truly appreciate your taking the time to help ...it looks like a lot of reading here and not much of it makes sense to me.

1)

ComboFix 12-02-13.01 - Steen 02/14/2012 23:16:23.3.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2832 [GMT -8:00]

Running from: d:\program files\Utilities\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: PC Cleaner Pro *Disabled/Updated* {737A8864-C2D9-4337-B49A-B5E35815B9BB}

.

((((((((((((((((((((((((( Files Created from 2012-01-15 to 2012-02-15 )))))))))))))))))))))))))))))))

.

2012-02-07 10:03 . 2012-01-06 04:19 6557240 ----a-r- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{97F319C8-7397-46F1-A7A4-7E9BA13A06F9}\mpengine.dll

2012-02-07 04:24 . 2012-02-07 04:24 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple

2012-01-31 23:14 . 2009-05-18 21:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-01-31 23:14 . 2008-04-17 20:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2012-01-31 23:13 . 2012-01-31 23:13 -------- d-----w- c:\program files\iPod

2012-01-31 23:13 . 2012-01-31 23:14 -------- d-----w- c:\program files\iTunes

2012-01-31 23:13 . 2012-01-31 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2012-01-31 23:13 . 2012-01-31 23:13 -------- d-----w- c:\program files\Apple Software Update

2012-01-31 23:13 . 2012-01-31 23:13 -------- d-----w- c:\documents and settings\LocalService\Application Data\Apple Computer

2012-01-31 23:12 . 2012-01-31 23:12 -------- d-----w- c:\program files\Bonjour

2012-01-25 08:44 . 2012-01-25 08:49 -------- d-----w- c:\documents and settings\Steen\Application Data\PCPro

2012-01-25 08:44 . 2012-01-25 08:44 -------- d-----w- c:\documents and settings\Steen\Application Data\PC Cleaners

2012-01-25 08:44 . 2012-01-25 08:44 -------- d-----w- c:\documents and settings\All Users\Application Data\PC1Data

2012-01-24 05:19 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-01-24 05:19 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-01-24 05:19 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2012-01-24 05:19 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-01-24 05:19 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-01-24 05:19 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2012-01-24 05:19 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys

2012-01-24 05:19 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2012-01-24 05:19 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr

2012-01-24 05:05 . 2011-11-28 18:01 199816 ------w- c:\windows\system32\aswBoot.exe

2012-01-24 05:04 . 2012-01-24 05:19 -------- d-----w- c:\program files\AVAST Software

2012-01-23 07:34 . 2012-01-23 19:15 -------- d-----w- c:\documents and settings\Steen\Application Data\Registry Mechanic

2012-01-23 07:25 . 2012-01-23 07:31 -------- d-----w- c:\program files\RegZooka

2012-01-23 06:10 . 2012-01-23 06:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{1C7CC8E2-CFCF-41E6-A863-7C7A45CE8A78}\IconD7F16134.exe

2012-01-23 06:10 . 2012-01-23 06:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{1C7CC8E2-CFCF-41E6-A863-7C7A45CE8A78}\IconCF33A0CE.exe

2012-01-23 06:10 . 2012-01-23 06:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{1C7CC8E2-CFCF-41E6-A863-7C7A45CE8A78}\IconF7A21AF7.exe

2012-01-23 06:10 . 2012-01-25 08:16 -------- d-----w- C:\sh4ldr

2012-01-23 06:09 . 2012-01-25 08:16 -------- d-----w- c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP

2012-01-23 06:09 . 2012-01-23 06:09 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2012-01-23 05:47 . 2012-01-23 05:47 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2012-01-23 05:44 . 2012-01-23 05:44 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2012-01-23 05:44 . 2012-01-23 05:44 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-27 08:21 . 2010-04-07 05:52 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-01-25 08:49 . 2009-04-28 17:24 5276432 ----a-w- c:\windows\uninst.exe

2012-01-24 20:01 . 2008-04-13 18:36 43008 ---ha-w- c:\windows\system32\drivers\amdagp.sys

2012-01-11 20:33 . 2012-01-10 21:10 5836 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2012-01-06 04:19 . 2010-04-07 05:52 6557240 ----a-r- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-12-10 23:24 . 2010-04-09 01:48 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-07 01:20 . 2011-12-07 01:20 23552 ----a-w- c:\windows\system32\drivers\dfg.sys

2011-11-23 13:25 . 2006-02-28 12:00 1859584 ---ha-w- c:\windows\system32\win32k.sys

2005-12-15 21:54 . 2009-04-10 14:11 5037072 ------w- c:\program files\spybotsd14.exe

2010-03-18 09:47 203776 --sh--w- c:\windows\system32\unrar.exe

.

((((((((((((((((((((((((((((( SnapShot@2012-01-24_02.50.52 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-12 08:02 . 2009-07-12 08:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll

- 2009-07-12 07:02 . 2009-07-12 07:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll

+ 2011-08-31 07:05 . 2011-08-31 07:05 50536 c:\windows\system32\jdns_sd.dll

+ 2012-01-31 23:13 . 2011-08-03 01:38 42496 c:\windows\system32\DRVSTORE\usbaapl_091115F4EDEB41DBA0EC91574CE905B4E0482482\usbaapl.sys

+ 2012-01-31 23:13 . 2011-08-03 01:38 18432 c:\windows\system32\DRVSTORE\netaapl_63AA05C4700EB9CAF2D048DAC1D06D764A0D4C41\netaapl.sys

+ 2012-01-31 23:14 . 2009-05-18 21:17 26600 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspiWDM.sys

+ 2011-08-31 07:05 . 2011-08-31 07:05 73064 c:\windows\system32\dnssd.dll

+ 2011-08-31 07:05 . 2011-08-31 07:05 83816 c:\windows\system32\dns-sd.exe

+ 2008-04-13 18:36 . 2012-01-24 20:01 43008 c:\windows\system32\dllcache\amdagp.sys

+ 2009-04-10 00:12 . 2002-07-03 18:44 29697 c:\windows\system32\bdckp32.dll

+ 2012-01-31 23:13 . 2012-01-31 23:13 27136 c:\windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe

+ 2012-01-29 19:32 . 2012-01-29 19:32 69632 c:\windows\Installer\{12CAA28E-56CA-4C3D-B3F2-7311540DD410}\NewShortcut5_22EC35BDF8F245EB8DCB1C7FB65D0A71.exe

+ 2012-01-29 19:32 . 2012-01-29 19:32 69632 c:\windows\Installer\{12CAA28E-56CA-4C3D-B3F2-7311540DD410}\NewShortcut1_22EC35BDF8F245EB8DCB1C7FB65D0A71.exe

+ 2012-01-29 19:32 . 2012-01-29 19:32 69632 c:\windows\Installer\{12CAA28E-56CA-4C3D-B3F2-7311540DD410}\ARPPRODUCTICON.exe

+ 2012-01-25 08:15 . 2012-01-25 08:15 27499 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCall.dll

- 2009-07-12 07:02 . 2009-07-12 07:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll

+ 2009-07-12 08:02 . 2009-07-12 08:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll

+ 2011-05-14 09:17 . 2011-05-14 09:17 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcr80.dll

+ 2011-05-14 09:12 . 2011-05-14 09:12 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcp80.dll

+ 2011-05-14 09:11 . 2011-05-14 09:11 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcm80.dll

+ 2011-02-08 20:52 . 2011-02-08 20:52 145688 c:\windows\system32\MicrosoftUpdateCatalogWebControl.dll

+ 2009-04-04 11:08 . 2012-01-30 16:03 295664 c:\windows\system32\FNTCACHE.DAT

+ 2012-01-31 23:14 . 2008-04-17 20:12 107368 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspi.dll

+ 2011-08-31 07:05 . 2011-08-31 07:05 178536 c:\windows\system32\dnssdX.dll

+ 2012-01-31 23:15 . 2012-01-31 23:15 380928 c:\windows\Installer\{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}\iTunesIco.exe

+ 2012-01-26 09:26 . 2012-01-26 09:26 233472 c:\windows\ERDNTbackup\1-26-2012\Users\00000002\UsrClass.dat

+ 2012-01-26 09:26 . 2005-10-20 19:02 163328 c:\windows\ERDNTbackup\1-26-2012\ERDNT.EXE

+ 2012-01-25 08:15 . 2012-01-25 08:15 180382 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla21.dll

+ 2012-01-25 08:15 . 2012-01-25 08:15 175992 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla20.dll

+ 2012-01-25 08:15 . 2012-01-25 08:15 176035 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla2.dll

+ 2012-01-25 08:15 . 2012-01-25 08:15 176035 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla19.dll

+ 2012-01-25 08:15 . 2012-01-25 08:15 179340 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla18.exe

+ 2012-01-25 08:15 . 2012-01-25 08:15 176545 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla17.dll

+ 2012-01-25 08:15 . 2012-01-25 08:15 179340 c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP\WiseCustomCalla.dll

+ 2012-01-31 23:13 . 2011-08-03 01:38 4517664 c:\windows\system32\DRVSTORE\usbaapl_091115F4EDEB41DBA0EC91574CE905B4E0482482\usbaaplrc.dll

+ 2012-01-31 23:13 . 2011-08-03 01:38 1461992 c:\windows\system32\DRVSTORE\netaapl_63AA05C4700EB9CAF2D048DAC1D06D764A0D4C41\wdfcoinstaller01009.dll

+ 2012-01-31 23:15 . 2012-01-31 23:15 5421056 c:\windows\Installer\166858.msi

+ 2012-01-31 23:13 . 2012-01-31 23:13 1769984 c:\windows\Installer\166854.msi

+ 2012-01-31 23:13 . 2012-01-31 23:13 1717248 c:\windows\Installer\166823.msi

+ 2012-01-31 23:12 . 2012-01-31 23:12 2002432 c:\windows\Installer\16681c.msi

+ 2012-01-31 23:11 . 2012-01-31 23:11 1530368 c:\windows\Installer\1667f1.msi

+ 2012-01-29 19:32 . 2012-01-29 19:32 13460480 c:\windows\Installer\11981f.msi

+ 2012-01-26 09:26 . 2012-01-26 09:26 16723968 c:\windows\ERDNTbackup\1-26-2012\Users\00000001\NTUSER.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [bU]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"dvd43"="" [bU]

"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]

"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-10-13 614400]

"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-01-30 503808]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-08 13880424]

"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-17 421736]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

c:\documents and settings\Chuck.STEEN-APR3-2009\Start Menu\Programs\Startup\

Logitech . Product Registration.lnk - c:\program files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-12-3 113664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2010-01-29 21:17 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]

2008-10-07 10:59 33538048 ------w- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"d:\\Program Files\\BitLord\\BitLord.exe"=

"c:\\Program Files\\FrostWire\\FrostWire.exe"=

"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=

"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=

"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\SUPDSvc.exe"=

"c:\\Program Files\\VIA\\VIAudioi\\HDADeck\\HDeck.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8701:TCP"= 8701:TCP:Bitlord

"7212:TCP"= 7212:TCP:c:\\Program Files\\Bitlord

"1:TCP"= 1:TCP:Intel HaM Data Fax Voice

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1/23/2012 9:19 PM 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/23/2012 9:19 PM 314456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/23/2012 9:19 PM 20568]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [8/6/2010 10:02 PM 12184]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [4/10/2009 6:11 AM 13592]

R3 ham50;Intel V92 HaM Data Fax Voice;c:\windows\system32\drivers\IntelH51.sys [6/21/2002 1:39 PM 469935]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [4/5/2009 3:50 PM 100456]

R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [5/20/2009 10:17 PM 47360]

R3 SNPP106;PC Camera (6029 CIF);c:\windows\system32\drivers\snpp106.sys [4/9/2009 4:12 PM 238080]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [4/5/2009 3:47 PM 876288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 dfg;dfg;c:\windows\system32\drivers\dfg.sys [12/6/2011 5:20 PM 23552]

S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]

S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [4/15/2010 12:10 PM 132464]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

.

Contents of the 'Scheduled Tasks' folder

.

2012-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 01:57]

.

2010-11-21 c:\windows\Tasks\expressburnShakeIcon.job

- c:\program files\NCH Swift Sound\ExpressBurn\expressburn.exe [2010-11-21 07:01]

.

2012-02-15 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2009-04-10 01:20]

.

2012-01-25 c:\windows\Tasks\prismShakeIcon.job

- c:\program files\NCH Software\Prism\prism.exe [2012-01-07 05:05]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dogpile.com/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000

IE: SmarThru4 Capture Selection - c:\program files\SmarThru 4\WebCapture.dll2.htm

IE: SmarThru4 Save as HTML - c:\program files\SmarThru 4\WebCapture.dll1.htm

IE: SmarThru4 Save Selected Text - c:\program files\SmarThru 4\WebCapture.dll.htm

IE: SmarThru4 Web Capture - c:\program files\SmarThru 4\WebCapture.dll

TCP: DhcpNameServer = 64.59.160.13 64.59.160.15 64.59.161.68

Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - d:\program files\TAX\2009QuickTax\ic2007pp.dll

Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - d:\program files\TAX\ic2011pp.dll

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

FF - ProfilePath - c:\documents and settings\Steen\Application Data\Mozilla\Firefox\Profiles\g7rgvzoa.default\

FF - prefs.js: browser.search.selectedEngine - Dogpile

FF - prefs.js: browser.startup.homepage - hxxp://dogpile.com/

FF - prefs.js: keyword.URL - hxxp://search.bearshare.com//web?src=ffb&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-PC Cleaners - c:\program files\PC Cleaners\PCCleaners.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-02-14 23:30

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(760)

c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

.

- - - - - - - > 'explorer.exe'(3576)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

d:\program files\ZenMicro\Zen Micro Media Explorer\CTJBNS2.dll

d:\program files\ZenMicro\Zen Micro Media Explorer\CTIntrfc.dll

d:\program files\ZenMicro\Zen Micro Media Explorer\CTConfig.DLL

d:\program files\ZenMicro\Zen Micro Media Explorer\JBNSRES.DLL

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2012-02-14 23:36:25

ComboFix-quarantined-files.txt 2012-02-15 07:36

ComboFix2.txt 2012-01-24 04:10

.

Pre-Run: 126,635,298,816 bytes free

Post-Run: 126,791,835,648 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot Loader]

Timeout=2

Default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[Operating Systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

.

- - End Of File - - D458E35FE368F2E725095CB29C9DD21E

2)

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Steen at 23:42:14 on 2012-02-14

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2792 [GMT -8:00]

.

AV: PC Cleaner Pro *Disabled/Updated* {737A8864-C2D9-4337-B49A-B5E35815B9BB}

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe

C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.dogpile.com/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /S

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [dvd43]

mRun: [Conime] %windir%\system32\conime.exe

mRun: [samsung PanelMgr] c:\windows\samsung\panelmgr\SSMMgr.exe /autorun

mRun: [3170 Scan2PC] "c:\windows\twain_32\samsung\clx3170\Scan2pc.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000

IE: SmarThru4 Capture Selection - c:\program files\smarthru 4\WebCapture.dll2.htm

IE: SmarThru4 Save as HTML - c:\program files\smarthru 4\WebCapture.dll1.htm

IE: SmarThru4 Save Selected Text - c:\program files\smarthru 4\WebCapture.dll.htm

IE: SmarThru4 Web Capture - c:\program files\smarthru 4\WebCapture.dll

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

DPF: {4D054067-DE3A-48F9-B19B-BCD229B9AE8D} - hxxp://www.samsungdp.com/printerhelp/ActiveX/DrPrinter.cab

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1327572877859

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1268715045218

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - d:\program files\tax\2009quicktax\ic2007pp.dll

Handler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - d:\program files\tax\2008quicktax\ic2008pp.dll

Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - d:\program files\tax\2009quicktax\ic2009pp.dll

Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - d:\program files\tax\2010turbotax\ic2010pp.dll

Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - d:\program files\tax\ic2011pp.dll

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\steen\application data\mozilla\firefox\profiles\g7rgvzoa.default\

FF - prefs.js: browser.search.selectedEngine - Dogpile

FF - prefs.js: browser.startup.homepage - hxxp://dogpile.com/

FF - prefs.js: keyword.URL - hxxp://search.bearshare.com//web?src=ffb&q=

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\avast software\avast\webrep\FF

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-23 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-23 314456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-23 20568]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-1-23 44768]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-8-6 12184]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2009-4-10 13592]

R3 ham50;Intel V92 HaM Data Fax Voice;c:\windows\system32\drivers\IntelH51.sys [2002-6-21 469935]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-4-5 100456]

R3 SNPP106;PC Camera (6029 CIF);c:\windows\system32\drivers\snpp106.sys [2009-4-9 238080]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-4-5 876288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys --> c:\windows\system32\drivers\SSPORT.sys [?]

S3 dfg;dfg;c:\windows\system32\drivers\dfg.sys [2011-12-6 23552]

S3 esgiguard;esgiguard;\??\c:\program files\enigma software group\spyhunter\esgiguard.sys --> c:\program files\enigma software group\spyhunter\esgiguard.sys [?]

S3 Samsung UPD Service;Samsung UPD Service;c:\windows\system32\SUPDSvc.exe [2010-4-15 132464]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== File Associations ===============

.

JSEFile=NOTEPAD.EXE %1

.

=============== Created Last 30 ================

.

2012-02-15 07:14:03 -------- d-sha-r- C:\cmdcons

2012-02-15 07:10:03 98816 ----a-w- c:\windows\sed.exe

2012-02-15 07:10:03 518144 ----a-w- c:\windows\SWREG.exe

2012-02-15 07:10:03 256000 ----a-w- c:\windows\PEV.exe

2012-02-15 07:10:03 208896 ----a-w- c:\windows\MBR.exe

2012-02-07 10:03:41 6557240 ----a-r- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{97f319c8-7397-46f1-a7a4-7e9ba13a06f9}\mpengine.dll

2012-01-31 23:14:53 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-01-31 23:14:53 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2012-01-31 23:13:56 -------- d-----w- c:\program files\iPod

2012-01-31 23:13:53 -------- d-----w- c:\program files\iTunes

2012-01-31 23:13:53 -------- d-----w- c:\documents and settings\all users\application data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2012-01-31 23:12:46 -------- d-----w- c:\program files\Bonjour

2012-01-26 09:26:29 -------- d-----w- c:\windows\ERDNTbackup

2012-01-25 08:44:15 -------- d-----w- c:\documents and settings\steen\application data\PCPro

2012-01-25 08:44:15 -------- d-----w- c:\documents and settings\steen\application data\PC Cleaners

2012-01-25 08:44:01 -------- d-----w- c:\documents and settings\all users\application data\PC1Data

2012-01-24 05:19:45 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-01-24 05:19:29 41184 ----a-w- c:\windows\avastSS.scr

2012-01-24 05:04:53 -------- d-----w- c:\program files\AVAST Software

2012-01-23 07:34:03 -------- d-----w- c:\documents and settings\steen\application data\Registry Mechanic

2012-01-23 07:25:50 -------- d-----w- c:\program files\RegZooka

2012-01-23 06:10:23 -------- d-----w- C:\sh4ldr

2012-01-23 06:09:55 -------- d-----w- c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP

2012-01-23 06:09:50 -------- d-----w- c:\program files\common files\Wise Installation Wizard

.

==================== Find3M ====================

.

2012-01-27 08:21:24 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-01-25 08:49:00 5276432 ----a-w- c:\windows\uninst.exe

2012-01-24 20:01:12 43008 ---ha-w- c:\windows\system32\drivers\amdagp.sys

2012-01-11 20:33:17 5836 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2011-12-10 23:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-07 01:20:42 23552 ----a-w- c:\windows\system32\drivers\dfg.sys

2011-11-23 13:25:32 1859584 ---ha-w- c:\windows\system32\win32k.sys

2005-12-15 21:54:10 5037072 ------w- c:\program files\spybotsd14.exe

2010-03-18 09:47:12 203776 --sh--w- c:\windows\system32\unrar.exe

.

============= FINISH: 23:44:13.51 ===============

3)