Trojan.FakeAlert not being caught by Malwarebytes :-(

Fcvolunteer · March 28, 2012

I noticed redirects for google search results and when I did image results i was only being shown the top two rows of results. I did a scan with Malwarebytes with both the quick scan and full scan and the results are "no malicious items were detected"

Now I can't even open a new browser window without getting the error "this webpage is not available". I know my internet connection is working though. I have streaming music that is still playing I just can't go to any new sites.

(I'm posting this from a different computer :-) )

I was following instructions i found on 2-viruses.com and I did steps 1-5 checking the hosts, DNS settings, Proxy settings, and IE add-ons. When I got to #6 I rescanned with Malwarebytes and still got nothing. Then I downloaded and scanned with Spyware Doctor from PC Tools and it found:

Trojan.Fake.Alert (4 infections)
- Registry Key:
HKEY_USERS\S-1-5-18\Software\avsoft
- Registry Value to be Repaired:
HKEY_LOCAL _MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Userinit
HKEY_USERS\S-1-5-21-2136418324-59859425-3307268990-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt
HKEY_USERS\S-1-5-21-2136418324-59859425-3307268990-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden
Trackware.Tracking Cookies!rem (1 infections)
- Browser Cookie:
content, yieldmanager.com/ content.yieldmanager.com
Application.TrackingCookies (21 infections)
Adware.DiscoveryLive!rem (1 infections)
Spyware.Known_Bad_Sites (1 infections)
RogueAntiSpyware.AntivirusSystemPro (43 infections)

I'm also seeing a pop-up window from Internet Explorer (which I didn't open) that says, "The webpage you are viewing is trying to close the window. Do you want to close this window?"

What do I do? I also have Trend Micro Titanium Maximum Security 2012 and their quick and full scans haven't found anything either. (I hate paying for Anti-virus software that doesn't work and I then need to spend more money covering its tracks :-( )

Thanks in advance for any help!

Larusso · March 30, 2012

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Let me look a little bit closer over your system. You can use an USB drive to transfer the tools and the logs I need for review

Download DDS and save it to your desktop from here or here

Double click dds to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
[*]Save both reports to your desktop and post them in your next reply

Fcvolunteer · March 30, 2012

Hi Daniel,

Thanks for your response. Here's what changes since I first posted. I tried to run the dds in safe mode and it kept freezing. I had a deadline I had to meet and I really needed my computer and files so I contacted our computer person at work who told me to use combofix via flash drive (since I couldnt access the internet on my computer). It also froze and didnt work. Then she told me to try Kaspersky's remover at this link: http://www.bleepingc...sing-tdsskiller. That worked! I now have my computer back and am even using it to reply. I've just ran the dds and posted the results below so you can tell me if I'm all clean.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14

Run by Rochel at 13:10:56 on 2012-03-30

Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.3061.1588 [GMT -4:00]

.

AV: Trend Micro Titanium Maximum Security 2012 *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

FW: ZoneAlarm Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Logicool\Logicool Vid\vid.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Akamai\netsession_win.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\Rochel\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe

C:\Program Files\Southwest Airlines\Ding\Ding.exe

C:\Documents and Settings\Rochel\Application Data\Dropbox\bin\Dropbox.exe

C:\Program Files\MamaBargains\MamaBargains\MamaBargains.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\Spoon-Sandbox.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\Client\Console\0.3.7.8\Spoon-Console.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

C:\Program Files\IObit\Advanced SystemCare 5\Asc.exe

C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

C:\Program Files\Adobe\Adobe Dreamweaver CS5.5\Dreamweaver.exe

C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://chabadnc.org/

uSearch Page = hxxp://www.live.com

uInternet Settings,ProxyOverride = *.local;<local>

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll

BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search

BHO: TSToolbarBHO: {43c6d902-a1c5-45c9-91f6-fd9e90337e18} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - c:\program files\somototoolbar\vmntemplateX.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: {8854823A-E915-ADFF-BA70-E2C1456C2F56} - No File

BHO: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Video Download Toolbar Intercept: {b29002a0-87a1-4dc4-ac55-5982034eb61e} - c:\progra~1\videod~1\VIDEOD~1.DLL

BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

TB: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File

TB: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - c:\program files\somototoolbar\vmntemplateX.dll

TB: Trend Micro Toolbar: {ccac5586-44d7-4c43-b64a-f042461a97d2} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB: {2B171655-A70C-5C18-B693-6CB5DC269D41} - No File

EB: Developer Tools: {1a6fe369-f28c-4ad9-a3e6-2bcb50807cf1} - c:\program files\internet explorer\iedvtool.dll

uRun: [Logicool Vid] "c:\program files\logicool\logicool vid\vid.exe" -bootmode

uRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler

uRun: [Google Update] "c:\documents and settings\rochel\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart

uRun: [Akamai NetSession Interface] "c:\documents and settings\rochel\local settings\application data\akamai\netsession_win.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Trend Micro Titanium] "c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe" -set Silent "1" SplashURL ""

mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe"

dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

StartupFolder: c:\docume~1\rochel\startm~1\programs\startup\cnette~1.lnk - c:\documents and settings\rochel\application data\cbs interactive\cnet techtracker\TechTracker.exe

StartupFolder: c:\docume~1\rochel\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe

StartupFolder: c:\docume~1\rochel\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\rochel\application data\dropbox\bin\Dropbox.exe

StartupFolder: c:\docume~1\rochel\startm~1\programs\startup\mamaba~1.lnk - c:\program files\mamabargains\mamabargains\MamaBargains.exe

StartupFolder: c:\docume~1\rochel\startm~1\programs\startup\spoons~1.lnk - c:\documents and settings\rochel\local settings\application data\spoon\3.32.2.12\Spoon-Sandbox-Native.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

uPolicies-explorer: NoInstrumentation = 1 (0x1)

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{BD92DCD7-91FF-45DA-A8C2-724596A291F2} : DhcpNameServer = 192.168.1.254

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - c:\program files\trend micro\titanium\uiframework\ProToolbarIMRatingActiveX.dll

Notify: igfxcui - igfxdev.dll

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

mASetup: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - c:\program files\pixiepack codec pack\InstallerHelper.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\rochel\application data\mozilla\firefox\profiles\foef8ybj.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\rochel\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\rochel\application data\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\rochel\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\documents and settings\rochel\local settings\application data\spoon\3.32.2.12\npMozillaSpoonPlugin.dll

FF - plugin: c:\program files\adobe\acrobat 10.0\acrobat\air\nppdf32.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\program files\nos\bin\np_gp.dll

FF - plugin: c:\program files\trend micro\titanium\uiframework\toolbar\firefoxextension\components\npToolbarChrome.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

.

---- FIREFOX POLICIES ----

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 750000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 750000

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 0

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

============= SERVICES / DRIVERS ===============

.

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-4-16 24064]

R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-6-14 13496]

R1 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2012-3-29 68368]

R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2011-12-7 913752]

R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2012-3-29 200632]

R2 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2011-6-14 821080]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-5-12 47640]

R3 k57w2k;Broadcom NetLink ™ Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [2009-4-16 176640]

R3 RRNetCapMP;RRNetCapMP;c:\windows\system32\drivers\rrnetcap.sys [2010-7-9 31848]

S0 bhyylicz;bhyylicz; [x]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-25 136176]

S2 PEVSystemStart;PEVSystemStart;c:\combofix\pev.3XE [2011-6-26 256000]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-6-25 136176]

S3 RRNetCap;RRNetCap Service;c:\windows\system32\drivers\rrnetcap.sys [2010-7-9 31848]

S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2010-2-21 90240]

S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2010-2-21 14976]

S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2010-2-21 121856]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== Created Last 30 ================

.

2012-03-30 02:06:09 -------- d-----w- c:\program files\Windows Media Connect 2

2012-03-30 02:04:48 -------- d-----w- c:\windows\system32\LogFiles

2012-03-30 00:56:51 92432 ----a-w- c:\windows\system32\drivers\tmtdi.sys

2012-03-30 00:56:46 81168 ----a-w- c:\windows\system32\drivers\tmactmon.sys

2012-03-30 00:56:46 68368 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys

2012-03-30 00:56:46 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2012-03-30 00:46:00 -------- d-----w- c:\program files\Trend Micro

2012-03-30 00:06:35 -------- d-----w- C:\TDSSKiller_Quarantine

2012-03-29 22:01:03 -------- d-sha-r- C:\cmdcons

2012-03-29 21:48:54 -------- d-s---w- C:\ComboFix

2012-03-29 19:11:58 98816 ----a-w- c:\windows\sed.exe

2012-03-29 19:11:58 518144 ----a-w- c:\windows\SWREG.exe

2012-03-29 19:11:58 256000 ----a-w- c:\windows\PEV.exe

2012-03-29 19:11:58 208896 ----a-w- c:\windows\MBR.exe

2012-03-27 23:42:49 -------- d-----w- C:\temp

2012-03-27 20:12:41 -------- d-----w- c:\documents and settings\rochel\local settings\application data\Trend Micro

2012-03-27 20:10:44 56 ----a-w- c:\windows\system32\SupportTool.exe.bat

2012-03-27 20:09:44 -------- d-----w- c:\documents and settings\all users\application data\Trend Micro

2012-03-27 19:36:33 -------- d-----w- c:\documents and settings\rochel\local settings\application data\Akamai

2012-03-21 22:42:30 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll

2012-03-21 22:42:30 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll

.

==================== Find3M ====================

.

2012-02-06 23:42:06 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-03 09:26:17 1869184 ----a-w- c:\windows\system32\win32k.sys

2012-02-02 04:40:23 538200 ----a-w- c:\program files\smartdraw_11E_QDO56_setup.exe

2012-01-31 21:57:00 32853760 ----a-w- c:\program files\spoon-plugin-dotnet.exe

2012-01-22 18:42:08 30218224 ----a-w- c:\program files\asc-setup.exe

2012-01-11 19:06:47 3072 ------w- c:\windows\system32\iacenc.dll

2012-01-09 16:20:25 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-01-02 00:51:06 15292208 ----a-w- c:\program files\Firefox Setup 9.0.1.exe

2011-12-12 04:22:42 64207032 ----a-w- c:\program files\setup_av_free_cnet.exe

2011-12-08 20:55:12 108 ----a-w- c:\program files\hirtcamp.com

2011-08-19 15:16:26 3089056 ----a-w- c:\program files\install_flash_player.exe

2011-07-24 16:14:49 65981368 ----a-w- c:\program files\AVSVideoConverter.exe

2011-07-24 15:17:47 6062368 ----a-w- c:\program files\video-download-toolbar-setup.exe

2011-07-24 15:08:49 858940 ----a-w- c:\program files\toolbar_setup411.exe

2011-07-24 15:02:39 5153792 ----a-w- c:\program files\YouTubeDownloaderSetup32.exe

2011-07-24 14:40:59 8532623 ----a-w- c:\program files\gfsetup.exe

2011-07-17 19:08:28 14276088 ----a-w- c:\program files\picasa38-setup.exe

2011-06-15 01:46:53 4117040 ----a-w- c:\program files\CNET_TechTracker_2_0_3_59_a_Setup.exe

2011-05-29 21:55:13 56923744 ----a-w- c:\program files\setup_av_free.exe

2011-05-25 23:03:06 30459048 ----a-w- c:\program files\asc4-setup-cnet.exe

2011-05-13 15:48:06 2431520 ----a-w- c:\program files\AdobeDownloadAssistant.exe

2011-04-29 17:06:26 12521992 ----a-w- c:\program files\Firefox Setup 4.0.1.exe

2011-04-12 00:54:39 51349520 ----a-w- c:\program files\avira_antivir_personal_en.exe

2011-04-11 20:27:11 5689312 ----a-w- c:\program files\ARO2011_tbt.exe

2011-04-06 17:58:21 80298280 ----a-w- c:\program files\iTunesSetup.exe

2010-11-23 20:48:32 13525424 ----a-w- c:\program files\Dropbox 0.7.110.exe

2010-11-14 04:02:39 2443360 ----a-w- c:\program files\divine-setup.exe

2010-10-04 18:26:50 947592 ----a-w- c:\program files\SkypeSetup.exe

2010-09-28 15:42:01 225672 ----a-w- c:\program files\CrucialScan.exe

2010-09-27 00:53:46 469504 ----a-w- c:\program files\ACTPrinterSetup.exe

2010-09-15 22:39:25 7633259 ----a-w- c:\program files\fmcjsetup.exe

2010-09-15 22:31:20 4585944 ----a-w- c:\program files\mp3-splitter-joiner.exe

2010-09-15 05:02:32 2007072 ----a-w- c:\program files\mp3joiner_setup.exe

2010-07-21 02:42:10 3087086 ----a-w- c:\program files\mp3cutterjoiner.exe

2010-07-21 02:38:11 689560 ----a-w- c:\program files\iobituninstaller.exe

2010-07-19 21:59:01 2411072 ----a-w- c:\program files\MP3Cutter.EXE

2010-07-19 20:52:01 38084600 ----a-w- c:\program files\tunebite.exe

2010-06-24 18:32:11 8587672 ----a-w- c:\program files\Firefox Setup 3.6.4.exe

2010-06-22 18:43:31 32532792 ----a-w- c:\program files\SafariSetup.exe

2010-05-06 20:35:21 562864 ----a-w- c:\program files\GoogleVoiceAndVideoSetup.exe

2010-04-19 03:01:09 562848 ----a-w- c:\program files\GoogleEarthSetup.exe

2010-04-19 02:08:54 529800 ----a-w- c:\program files\smartdraw_10E_H3HE9_A_setup.exe

2010-04-16 21:47:38 4071176 ----a-w- c:\program files\registrybooster.exe

2010-02-22 02:35:11 82452960 ----a-w- c:\program files\a897_PCStudio.exe

2010-01-08 03:20:15 11029387 ----a-w- c:\program files\aoaaudioextractor.exe

2009-12-02 18:38:58 6599680 ----a-w- c:\program files\DingInstall-1.05.exe

2009-11-10 05:28:41 72946 ----a-w- c:\program files\ears.com

2009-11-02 00:40:48 21785928 ----a-w- c:\program files\cuteftppro.exe

2009-10-30 18:03:32 1505049 ----a-w- c:\program files\Mp3nity_2.1_Setup.exe

2009-10-23 01:01:31 7492592 ----a-w- c:\program files\CoffeeFreeFTPInstaller4.2.exe

2009-09-08 17:35:07 4938616 ----a-w- c:\program files\Silverlight.exe

2009-07-28 04:05:17 1876292 ----a-w- c:\program files\freeripmp3.exe

2009-07-28 03:51:46 2693610 ----a-w- c:\program files\swmsetup.exe

2009-07-28 02:57:43 12154344 ----a-w- c:\program files\SFTPMSI.exe

2009-07-23 15:26:02 7858801 ----a-w- c:\program files\Freeware_PrimoPDF.exe

2009-07-17 16:37:23 3654395 ----a-w- c:\program files\ybkfull.exe

2009-07-10 16:46:12 1234120 ----a-w- c:\program files\wrar380.exe

2009-07-08 19:02:41 21935408 ----a-w- c:\program files\QuickTimeInstaller.exe

2009-04-30 23:14:45 16883056 ----a-w- c:\program files\IE8-WindowsXP-x86-ENU.exe

2009-04-29 17:09:51 63049904 ----a-w- c:\program files\avg_free_stf_en_85_285a1462.exe

2009-04-29 17:04:51 2967800 ----a-w- c:\program files\mbam-setup.exe

2009-04-24 20:49:12 1878888 ----a-w- c:\program files\Adobe Acrobat 9 Pro.lnk.exe

2009-04-24 20:33:09 342437920 ----a-w- c:\program files\AcroPro90_efg.exe

2004-05-25 03:01:46 1155635 ----a-w- c:\program files\EasyScreenCaptureVideo.exe

.

============= FINISH: 13:12:25.26 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 4/23/2009 9:34:20 PM

System Uptime: 3/29/2012 9:18:58 PM (16 hours ago)

.

Motherboard: Dell Inc. | | 0T656F

Processor: Intel® Core™2 Duo CPU E7300 @ 2.66GHz | CPU | 2659/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 298 GiB total, 224.107 GiB free.

D: is CDROM (CDFS)

E: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP18: 1/1/2012 2:04:36 AM - System Checkpoint

RP19: 1/2/2012 1:33:43 PM - System Checkpoint

RP20: 1/3/2012 4:44:09 PM - System Checkpoint

RP21: 1/4/2012 7:14:00 PM - System Checkpoint

RP22: 1/8/2012 7:05:32 AM - System Checkpoint

RP23: 1/9/2012 5:44:57 PM - System Checkpoint

RP24: 1/11/2012 3:00:37 AM - Software Distribution Service 3.0

RP25: 1/11/2012 11:32:39 PM - Installed Windows XP KB2585542.

RP26: 1/11/2012 11:33:37 PM - Installed Windows XP KB2632503.

RP27: 1/16/2012 11:35:34 PM - System Checkpoint

RP28: 1/18/2012 3:36:18 AM - System Checkpoint

RP29: 1/19/2012 3:59:07 AM - System Checkpoint

RP30: 1/20/2012 4:17:45 AM - System Checkpoint

RP31: 1/22/2012 8:54:20 AM - System Checkpoint

RP32: 1/23/2012 10:24:10 AM - System Checkpoint

RP33: 1/24/2012 10:34:09 AM - System Checkpoint

RP34: 1/25/2012 4:50:01 PM - System Checkpoint

RP35: 1/27/2012 8:15:30 AM - System Checkpoint

RP36: 1/28/2012 8:34:09 AM - System Checkpoint

RP37: 1/29/2012 8:38:49 AM - System Checkpoint

RP38: 1/30/2012 8:12:39 PM - System Checkpoint

RP39: 2/1/2012 3:39:26 AM - System Checkpoint

RP40: 2/2/2012 12:50:38 AM - IObit Uninstaller restore point

RP41: 2/3/2012 3:01:58 PM - System Checkpoint

RP42: 2/5/2012 2:42:29 AM - System Checkpoint

RP43: 2/6/2012 7:47:52 PM - System Checkpoint

RP44: 2/8/2012 1:22:37 AM - System Checkpoint

RP45: 2/9/2012 8:34:29 AM - System Checkpoint

RP46: 2/10/2012 9:30:34 AM - System Checkpoint

RP47: 2/12/2012 1:42:32 PM - System Checkpoint

RP48: 2/13/2012 4:36:30 PM - System Checkpoint

RP49: 2/14/2012 7:58:01 PM - System Checkpoint

RP50: 2/16/2012 3:00:18 AM - Software Distribution Service 3.0

RP51: 2/17/2012 6:05:41 AM - System Checkpoint

RP52: 2/18/2012 10:34:05 PM - System Checkpoint

RP53: 2/20/2012 4:21:22 AM - System Checkpoint

RP54: 2/21/2012 6:49:17 AM - System Checkpoint

RP55: 2/22/2012 12:25:55 PM - System Checkpoint

RP56: 2/23/2012 2:35:08 PM - System Checkpoint

RP57: 2/24/2012 3:41:11 PM - System Checkpoint

RP58: 2/26/2012 9:50:25 AM - System Checkpoint

RP59: 2/27/2012 11:41:08 AM - System Checkpoint

RP60: 2/28/2012 1:40:23 PM - System Checkpoint

RP61: 3/1/2012 5:01:37 PM - System Checkpoint

RP62: 3/2/2012 5:50:56 PM - System Checkpoint

RP63: 3/3/2012 7:45:21 PM - System Checkpoint

RP64: 3/4/2012 9:08:56 PM - System Checkpoint

RP65: 3/7/2012 1:17:00 PM - System Checkpoint

RP66: 3/8/2012 3:00:44 AM - Software Distribution Service 3.0

RP67: 3/9/2012 1:13:38 PM - System Checkpoint

RP68: 3/11/2012 1:26:12 AM - System Checkpoint

RP69: 3/12/2012 1:43:49 AM - System Checkpoint

RP70: 3/13/2012 1:49:14 AM - System Checkpoint

RP71: 3/14/2012 2:06:23 AM - System Checkpoint

RP72: 3/14/2012 3:00:17 AM - Software Distribution Service 3.0

RP73: 3/20/2012 1:26:56 AM - System Checkpoint

RP74: 3/21/2012 3:36:48 AM - System Checkpoint

RP75: 3/22/2012 8:05:11 AM - System Checkpoint

RP76: 3/23/2012 12:49:24 PM - Installed Adobe Reader X (10.1.2).

RP77: 3/25/2012 6:59:45 AM - System Checkpoint

RP78: 3/26/2012 7:30:53 AM - System Checkpoint

RP79: 3/27/2012 7:56:37 AM - System Checkpoint

RP80: 3/27/2012 3:36:29 PM - Installed Akamai NetSession Interface

RP81: 3/27/2012 3:53:54 PM - avast! Free Antivirus Setup

RP82: 3/28/2012 11:19:06 PM - Restore Operation

RP83: 3/29/2012 10:02:34 AM - Software Distribution Service 3.0

RP84: 3/29/2012 8:45:37 PM - Installed Akamai NetSession Interface

RP85: 3/29/2012 10:02:48 PM - Printer Driver PrimoPDF Installed

RP86: 3/29/2012 10:03:50 PM - Installed Windows Media Player 11

RP87: 3/29/2012 10:04:43 PM - Installed Windows XP Wudf01000.

RP88: 3/29/2012 10:06:38 PM - Installed Windows XP MSCompPackV1.

RP89: 3/30/2012 3:00:19 AM - Software Distribution Service 3.0

.

==== Installed Programs ======================

.

Act Printer

ACTPrinter Win Client

Adobe AIR

Adobe Anchor Service CS3

Adobe Asset Services CS3

Adobe Bridge CS3

Adobe Bridge Start Meeting

Adobe Camera Raw 4.0

Adobe CMaps

Adobe Community Help

Adobe Content Viewer

Adobe Creative Suite 5.5 Web Premium

Adobe Default Language CS3

Adobe Device Central CS3

Adobe Download Assistant

Adobe Download Manager

Adobe Dreamweaver CS3

Adobe Dreamweaver CS5.5

Adobe ExtendScript Toolkit 2

Adobe Extension Manager CS3

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Flash Professional CS5.5

Adobe Help Viewer CS3

Adobe InDesign CS5.5

Adobe PDF Library Files

Adobe Reader X (10.1.2)

Adobe Setup

Adobe Shockwave Player 11.6

Adobe Type Support

Adobe Update Manager CS3

Adobe Version Cue CS3 Client

Adobe Widget Browser

Advanced SystemCare 5

Akamai NetSession Interface

Apple Application Support

Apple Mobile Device Support

Apple Software Update

AVS Update Manager 1.0

AVS Video Converter 8

AVS4YOU Software Navigator 1.4

Bonjour

Bonjour Print Services

Business Contact Manager for Outlook 2007 SP2

Carbonite

Choice Guard

CNET TechTracker

CoffeeCup Free FTP

Corel VideoStudio 12

CuteFTP 8 Professional

DING!

Dropbox

Focus MP3 Cutter Joiner 3.5

FreeRIP v3.1

Full Tilt Poker

Game Booster

GanttProject

Google Chrome

Google Earth Plug-in

Google Talk Plugin

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB953955)

Hotfix for Windows XP (KB954434)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB954708)

Hotfix for Windows XP (KB958347)

Hotfix for Windows XP (KB959252)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

Intel® Graphics Media Accelerator Driver

IObit Malware Fighter

iTunes

Java™ 6 Update 14

Junk Mail filter update

Logicool Vid

Logicool Webcam Software

LogMeIn

MamaBargains

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office 2003 Web Components

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Small Business 2007

Microsoft Office Small Business 2007 Trial

Microsoft Office Small Business Connectivity Components

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFCLOC_x86

Mozilla Firefox 9.0.1 (x86 en-US)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser

OGA Notifier 2.0.0048.0

PDF Settings CS5

Picaboo X

Picasa 3

PixiePack Codec Pack

Power MP3 Recorder Cutter v5.2.0.0

PowerDVD

PrimoPDF -- brought to you by Nitro PDF Software

QuickTime

RocketLife

Roxio Activation Module

Roxio Creator Audio

Roxio Creator BDAV Plugin

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Drag-to-Disc

Roxio Express Labeler 3

Roxio Update Manager

SAMSUNG Mobile Modem Driver Set

SAMSUNG Mobile Modem V2 Software

Samsung New PC Studio

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Segoe UI

Shape Collage

Skype Toolbars

Skype™ 4.2

Smart Defrag 2

SmartDraw 2012

SmartSound Quicktracks Plugin

Sonic CinePlayer Decoder Pack

Spoon Sandbox Manager 3.32

swMSM

Trend Micro Titanium

Trend Micro Titanium Maximum Security 2012

Tunebite

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2597970) 32-Bit Edition

Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition

Update for Microsoft Windows (KB971513)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows Internet Explorer 8 (KB2632503)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB976749)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB898461)

Update for Windows XP (KB951618-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Video Download FileBulldog Toolbar

Video Download Toolbar 2.1.0.0

VideoStudio

WebFldrs XP

Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray

Windows Genuine Advantage Notifications (KB905474)

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Toolbar

Windows Live Upload Tool

Windows Live Writer

Windows Management Framework Core

Windows Media Encoder 9 Series

Windows Media Format 11 runtime

Windows Media Player 11

Windows Presentation Foundation

Windows Search 4.0

WinRAR archiver

XML Paper Specification Shared Components Pack 1.0

.

==== Event Viewer Messages From Past Week ========

.

3/29/2012 5:23:15 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

3/29/2012 2:27:00 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

3/29/2012 10:35:29 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm tmactmon tmcomm tmeext tmevtmgr tmtdi

3/28/2012 9:34:00 PM, error: Schedule [7901] - The At22.job command failed to start due to the following error: %%2147942402

3/28/2012 9:00:15 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk0\D.

3/28/2012 9:00:00 PM, error: Schedule [7901] - The At70.job command failed to start due to the following error: %%2147942402

3/28/2012 9:00:00 PM, error: Schedule [7901] - The At46.job command failed to start due to the following error: %%2147942402

3/28/2012 8:34:00 PM, error: Schedule [7901] - The At21.job command failed to start due to the following error: %%2147942402

3/28/2012 8:34:00 AM, error: Schedule [7901] - The At9.job command failed to start due to the following error: %%2147942402

3/28/2012 8:11:29 PM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).

3/28/2012 8:00:00 PM, error: Schedule [7901] - The At69.job command failed to start due to the following error: %%2147942402

3/28/2012 8:00:00 PM, error: Schedule [7901] - The At45.job command failed to start due to the following error: %%2147942402

3/28/2012 8:00:00 AM, error: Schedule [7901] - The At57.job command failed to start due to the following error: %%2147942402

3/28/2012 8:00:00 AM, error: Schedule [7901] - The At33.job command failed to start due to the following error: %%2147942402

3/28/2012 7:34:00 PM, error: Schedule [7901] - The At20.job command failed to start due to the following error: %%2147942402

3/28/2012 7:34:00 AM, error: Schedule [7901] - The At8.job command failed to start due to the following error: %%2147942402

3/28/2012 7:00:19 PM, error: Schedule [7901] - The At68.job command failed to start due to the following error: %%2147942402

3/28/2012 7:00:09 PM, error: Schedule [7901] - The At44.job command failed to start due to the following error: %%2147942402

3/28/2012 7:00:00 AM, error: Schedule [7901] - The At56.job command failed to start due to the following error: %%2147942402

3/28/2012 7:00:00 AM, error: Schedule [7901] - The At32.job command failed to start due to the following error: %%2147942402

3/28/2012 6:34:00 PM, error: Schedule [7901] - The At19.job command failed to start due to the following error: %%2147942402

3/28/2012 6:34:00 AM, error: Schedule [7901] - The At7.job command failed to start due to the following error: %%2147942402

3/28/2012 6:00:00 PM, error: Schedule [7901] - The At67.job command failed to start due to the following error: %%2147942402

3/28/2012 6:00:00 PM, error: Schedule [7901] - The At43.job command failed to start due to the following error: %%2147942402

3/28/2012 6:00:00 AM, error: Schedule [7901] - The At55.job command failed to start due to the following error: %%2147942402

3/28/2012 6:00:00 AM, error: Schedule [7901] - The At31.job command failed to start due to the following error: %%2147942402

3/28/2012 5:34:00 PM, error: Schedule [7901] - The At18.job command failed to start due to the following error: %%2147942402

3/28/2012 5:34:00 AM, error: Schedule [7901] - The At6.job command failed to start due to the following error: %%2147942402

3/28/2012 5:00:00 PM, error: Schedule [7901] - The At66.job command failed to start due to the following error: %%2147942402

3/28/2012 5:00:00 PM, error: Schedule [7901] - The At42.job command failed to start due to the following error: %%2147942402

3/28/2012 5:00:00 AM, error: Schedule [7901] - The At54.job command failed to start due to the following error: %%2147942402

3/28/2012 5:00:00 AM, error: Schedule [7901] - The At30.job command failed to start due to the following error: %%2147942402

3/28/2012 4:34:00 PM, error: Schedule [7901] - The At17.job command failed to start due to the following error: %%2147942402

3/28/2012 4:34:00 AM, error: Schedule [7901] - The At5.job command failed to start due to the following error: %%2147942402

3/28/2012 4:00:00 PM, error: Schedule [7901] - The At65.job command failed to start due to the following error: %%2147942402

3/28/2012 4:00:00 PM, error: Schedule [7901] - The At41.job command failed to start due to the following error: %%2147942402

3/28/2012 4:00:00 AM, error: Schedule [7901] - The At53.job command failed to start due to the following error: %%2147942402

3/28/2012 4:00:00 AM, error: Schedule [7901] - The At29.job command failed to start due to the following error: %%2147942402

3/28/2012 3:34:00 PM, error: Schedule [7901] - The At16.job command failed to start due to the following error: %%2147942402

3/28/2012 3:34:00 AM, error: Schedule [7901] - The At4.job command failed to start due to the following error: %%2147942402

3/28/2012 3:00:01 PM, error: Schedule [7901] - The At64.job command failed to start due to the following error: %%2147942402

3/28/2012 3:00:00 PM, error: Schedule [7901] - The At40.job command failed to start due to the following error: %%2147942402

3/28/2012 3:00:00 AM, error: Schedule [7901] - The At52.job command failed to start due to the following error: %%2147942402

3/28/2012 3:00:00 AM, error: Schedule [7901] - The At28.job command failed to start due to the following error: %%2147942402

3/28/2012 2:34:00 PM, error: Schedule [7901] - The At15.job command failed to start due to the following error: %%2147942402

3/28/2012 2:34:00 AM, error: Schedule [7901] - The At3.job command failed to start due to the following error: %%2147942402

3/28/2012 2:00:00 PM, error: Schedule [7901] - The At63.job command failed to start due to the following error: %%2147942402

3/28/2012 2:00:00 PM, error: Schedule [7901] - The At39.job command failed to start due to the following error: %%2147942402

3/28/2012 2:00:00 AM, error: Schedule [7901] - The At51.job command failed to start due to the following error: %%2147942402

3/28/2012 2:00:00 AM, error: Schedule [7901] - The At27.job command failed to start due to the following error: %%2147942402

3/28/2012 12:44:00 AM, error: Schedule [7901] - The At49.job command failed to start due to the following error: %%2147942402

3/28/2012 12:36:00 AM, error: Schedule [7901] - The At25.job command failed to start due to the following error: %%2147942402

3/28/2012 12:34:00 AM, error: Schedule [7901] - The At1.job command failed to start due to the following error: %%2147942402

3/28/2012 11:29:29 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.

3/28/2012 11:00:02 PM, error: Schedule [7901] - The At72.job command failed to start due to the following error: %%2147942402

3/28/2012 11:00:00 PM, error: Schedule [7901] - The At48.job command failed to start due to the following error: %%2147942402

3/28/2012 10:37:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

3/28/2012 10:35:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip tmactmon tmcomm tmeext tmevtmgr tmtdi WS2IFSL

3/28/2012 10:35:54 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

3/28/2012 10:35:54 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

3/28/2012 10:35:54 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

3/28/2012 10:35:54 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

3/28/2012 10:35:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

3/28/2012 10:35:34 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}

3/28/2012 10:00:00 PM, error: Schedule [7901] - The At71.job command failed to start due to the following error: %%2147942402

3/28/2012 10:00:00 PM, error: Schedule [7901] - The At47.job command failed to start due to the following error: %%2147942402

3/28/2012 1:34:00 PM, error: Schedule [7901] - The At14.job command failed to start due to the following error: %%2147942402

3/28/2012 1:34:00 AM, error: Schedule [7901] - The At2.job command failed to start due to the following error: %%2147942402

3/28/2012 1:00:00 PM, error: Schedule [7901] - The At62.job command failed to start due to the following error: %%2147942402

3/28/2012 1:00:00 PM, error: Schedule [7901] - The At38.job command failed to start due to the following error: %%2147942402

3/28/2012 1:00:00 AM, error: Schedule [7901] - The At50.job command failed to start due to the following error: %%2147942402

3/28/2012 1:00:00 AM, error: Schedule [7901] - The At26.job command failed to start due to the following error: %%2147942402

3/27/2012 9:34:00 AM, error: Schedule [7901] - The At10.job command failed to start due to the following error: %%2147942402

3/27/2012 9:00:00 AM, error: Schedule [7901] - The At58.job command failed to start due to the following error: %%2147942402

3/27/2012 9:00:00 AM, error: Schedule [7901] - The At34.job command failed to start due to the following error: %%2147942402

3/27/2012 7:47:51 PM, error: Service Control Manager [7034] - The Trend Micro Solution Platform service terminated unexpectedly. It has done this 1 time(s).

3/27/2012 12:00:00 PM, error: Schedule [7901] - The At61.job command failed to start due to the following error: %%2147942402

3/27/2012 12:00:00 PM, error: Schedule [7901] - The At37.job command failed to start due to the following error: %%2147942402

3/27/2012 11:34:00 PM, error: Schedule [7901] - The At24.job command failed to start due to the following error: %%2147942402

3/27/2012 11:34:00 AM, error: Schedule [7901] - The At12.job command failed to start due to the following error: %%2147942402

3/27/2012 11:00:00 AM, error: Schedule [7901] - The At60.job command failed to start due to the following error: %%2147942402

3/27/2012 11:00:00 AM, error: Schedule [7901] - The At36.job command failed to start due to the following error: %%2147942402

3/27/2012 10:34:01 PM, error: Schedule [7901] - The At23.job command failed to start due to the following error: %%2147942402

3/27/2012 10:34:00 AM, error: Schedule [7901] - The At11.job command failed to start due to the following error: %%2147942402

3/27/2012 10:00:00 AM, error: Schedule [7901] - The At59.job command failed to start due to the following error: %%2147942402

3/27/2012 10:00:00 AM, error: Schedule [7901] - The At35.job command failed to start due to the following error: %%2147942402

3/26/2012 12:34:00 PM, error: Schedule [7901] - The At13.job command failed to start due to the following error: %%2147942402

.

==== End Of File ===========================

Larusso · March 30, 2012

Hy there, could you please post the TDSSKiller logfile. Foundable in C:\tdsskiller_<date>_<time>.txt

Fcvolunteer · March 30, 2012

20:03:52.0953 1756 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18

20:03:52.0984 1756 ============================================================

20:03:52.0984 1756 Current date / time: 2012/03/29 20:03:52.0984

20:03:52.0984 1756 SystemInfo:

20:03:52.0984 1756

20:03:52.0984 1756 OS Version: 5.1.2600 ServicePack: 3.0

20:03:52.0984 1756 Product type: Workstation

20:03:52.0984 1756 ComputerName: ROCHELHOMEPC

20:03:52.0984 1756 UserName: Administrator

20:03:52.0984 1756 Windows directory: C:\WINDOWS

20:03:52.0984 1756 System windows directory: C:\WINDOWS

20:03:52.0984 1756 Processor architecture: Intel x86

20:03:52.0984 1756 Number of processors: 2

20:03:52.0984 1756 Page size: 0x1000

20:03:52.0984 1756 Boot type: Safe boot

20:03:52.0984 1756 ============================================================

20:03:59.0812 1756 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

20:03:59.0812 1756 Drive \Device\Harddisk1\DR6 - Size: 0x3EF00000 (0.98 Gb), SectorSize: 0x200, Cylinders: 0x80, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

20:03:59.0812 1756 \Device\Harddisk0\DR0:

20:03:59.0812 1756 MBR used

20:03:59.0812 1756 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x2541A2B0

20:03:59.0812 1756 \Device\Harddisk1\DR6:

20:03:59.0812 1756 MBR used

20:03:59.0812 1756 \Device\Harddisk1\DR6\Partition0: MBR, Type 0x6, StartLBA 0x1E0, BlocksNum 0x1F7620

20:03:59.0843 1756 Initialize success

20:03:59.0843 1756 ============================================================

20:04:29.0640 1788 ============================================================

20:04:29.0640 1788 Scan started

20:04:29.0640 1788 Mode: Manual;

20:04:29.0640 1788 ============================================================

20:04:31.0000 1788 Abiosdsk - ok

20:04:31.0234 1788 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS

20:04:31.0234 1788 abp480n5 - ok

20:04:31.0484 1788 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

20:04:31.0531 1788 ACPI - ok

20:04:31.0734 1788 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

20:04:31.0734 1788 ACPIEC - ok

20:04:32.0031 1788 ADIHdAudAddService (803c7d4767132f2407431103055c9000) C:\WINDOWS\system32\drivers\ADIHdAud.sys

20:04:32.0109 1788 ADIHdAudAddService - ok

20:04:32.0312 1788 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys

20:04:32.0343 1788 adpu160m - ok

20:04:32.0546 1788 AdvancedSystemCareService5 (e410da575ff48d976b41670c6d262a82) C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

20:04:32.0656 1788 AdvancedSystemCareService5 - ok

20:04:32.0906 1788 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

20:04:32.0937 1788 aec - ok

20:04:33.0187 1788 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

20:04:33.0234 1788 AFD - ok

20:04:33.0453 1788 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

20:04:33.0484 1788 agp440 - ok

20:04:33.0671 1788 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys

20:04:33.0687 1788 agpCPQ - ok

20:04:33.0875 1788 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys

20:04:33.0875 1788 Aha154x - ok

20:04:34.0062 1788 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys

20:04:34.0078 1788 aic78u2 - ok

20:04:34.0265 1788 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys

20:04:34.0281 1788 aic78xx - ok

20:04:34.0468 1788 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

20:04:34.0468 1788 Alerter - ok

20:04:34.0656 1788 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

20:04:34.0671 1788 ALG - ok

20:04:34.0859 1788 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys

20:04:34.0859 1788 AliIde - ok

20:04:35.0046 1788 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys

20:04:35.0062 1788 alim1541 - ok

20:04:35.0250 1788 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys

20:04:35.0250 1788 amdagp - ok

20:04:35.0453 1788 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys

20:04:35.0453 1788 amsint - ok

20:04:35.0546 1788 Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

20:04:35.0562 1788 Apple Mobile Device - ok

20:04:35.0812 1788 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll

20:04:35.0859 1788 AppMgmt - ok

20:04:36.0078 1788 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys

20:04:36.0093 1788 asc - ok

20:04:36.0312 1788 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys

20:04:36.0312 1788 asc3350p - ok

20:04:36.0500 1788 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys

20:04:36.0515 1788 asc3550 - ok

20:04:36.0656 1788 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

20:04:36.0734 1788 aspnet_state - ok

20:04:36.0937 1788 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

20:04:36.0953 1788 AsyncMac - ok

20:04:37.0171 1788 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

20:04:37.0171 1788 atapi - ok

20:04:37.0343 1788 Atdisk - ok

20:04:37.0562 1788 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

20:04:37.0562 1788 Atmarpc - ok

20:04:37.0781 1788 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

20:04:37.0796 1788 AudioSrv - ok

20:04:37.0968 1788 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

20:04:37.0984 1788 audstub - ok

20:04:38.0093 1788 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

20:04:38.0125 1788 BcmSqlStartupSvc - ok

20:04:38.0328 1788 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

20:04:38.0328 1788 Beep - ok

20:04:38.0531 1788 bhyylicz - ok

20:04:38.0828 1788 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

20:04:38.0984 1788 BITS - ok

20:04:39.0140 1788 Bonjour Service (f832f1505ad8b83474bd9a5b1b985e01) C:\Program Files\Bonjour\mDNSResponder.exe

20:04:39.0218 1788 Bonjour Service - ok

20:04:39.0468 1788 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

20:04:39.0484 1788 Browser - ok

20:04:40.0062 1788 CarboniteService (9bbed669da150776fef3343f48f92fb0) C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

20:04:40.0531 1788 CarboniteService - ok

20:04:40.0765 1788 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys

20:04:40.0781 1788 cbidf - ok

20:04:40.0968 1788 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

20:04:40.0968 1788 cbidf2k - ok

20:04:41.0171 1788 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

20:04:41.0187 1788 CCDECODE - ok

20:04:41.0359 1788 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys

20:04:41.0359 1788 cd20xrnt - ok

20:04:41.0578 1788 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

20:04:41.0578 1788 Cdaudio - ok

20:04:41.0781 1788 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

20:04:41.0796 1788 Cdfs - ok

20:04:42.0000 1788 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

20:04:42.0015 1788 Cdrom - ok

20:04:42.0187 1788 Changer - ok

20:04:42.0390 1788 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

20:04:42.0390 1788 CiSvc - ok

20:04:42.0578 1788 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

20:04:42.0593 1788 ClipSrv - ok

20:04:42.0718 1788 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

20:04:42.0796 1788 clr_optimization_v2.0.50727_32 - ok

20:04:43.0031 1788 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys

20:04:43.0031 1788 CmdIde - ok

20:04:43.0187 1788 COMSysApp - ok

20:04:43.0406 1788 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys

20:04:43.0406 1788 Cpqarray - ok

20:04:43.0656 1788 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

20:04:43.0656 1788 CryptSvc - ok

20:04:43.0890 1788 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys

20:04:43.0937 1788 dac2w2k - ok

20:04:44.0109 1788 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys

20:04:44.0125 1788 dac960nt - ok

20:04:44.0406 1788 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

20:04:44.0484 1788 DcomLaunch - ok

20:04:44.0703 1788 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

20:04:44.0734 1788 Dhcp - ok

20:04:44.0937 1788 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

20:04:44.0953 1788 Disk - ok

20:04:45.0140 1788 DLABMFSM (a0500678a33802d8954153839301d539) C:\WINDOWS\system32\Drivers\DLABMFSM.SYS

20:04:45.0156 1788 DLABMFSM - ok

20:04:45.0328 1788 DLABOIOM (b8d2f68cac54d46281399f9092644794) C:\WINDOWS\system32\Drivers\DLABOIOM.SYS

20:04:45.0343 1788 DLABOIOM - ok

20:04:45.0515 1788 DLACDBHM (0ee93ab799d1cb4ec90b36f3612fe907) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS

20:04:45.0515 1788 DLACDBHM - ok

20:04:45.0687 1788 DLADResM (87413b94ae1fabc117c4e8ae6725134e) C:\WINDOWS\system32\Drivers\DLADResM.SYS

20:04:45.0703 1788 DLADResM - ok

20:04:45.0906 1788 DLAIFS_M (766a148235be1c0039c974446e4c0edc) C:\WINDOWS\system32\Drivers\DLAIFS_M.SYS

20:04:45.0921 1788 DLAIFS_M - ok

20:04:46.0093 1788 DLAOPIOM (38267cca177354f1c64450a43a4f7627) C:\WINDOWS\system32\Drivers\DLAOPIOM.SYS

20:04:46.0109 1788 DLAOPIOM - ok

20:04:46.0281 1788 DLAPoolM (fd363369fd313b46b5aeab1a688b52e9) C:\WINDOWS\system32\Drivers\DLAPoolM.SYS

20:04:46.0281 1788 DLAPoolM - ok

20:04:46.0500 1788 DLARTL_M (336ae18f0912ef4fbe5518849e004d74) C:\WINDOWS\system32\Drivers\DLARTL_M.SYS

20:04:46.0500 1788 DLARTL_M - ok

20:04:46.0734 1788 DLAUDFAM (fd85f682c1cc2a7ca878c7a448e6d87e) C:\WINDOWS\system32\Drivers\DLAUDFAM.SYS

20:04:46.0750 1788 DLAUDFAM - ok

20:04:46.0953 1788 DLAUDF_M (af389ce587b6bf5bbdcd6f6abe5eabc0) C:\WINDOWS\system32\Drivers\DLAUDF_M.SYS

20:04:46.0968 1788 DLAUDF_M - ok

20:04:47.0125 1788 dmadmin - ok

20:04:47.0531 1788 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

20:04:47.0718 1788 dmboot - ok

20:04:47.0953 1788 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

20:04:48.0000 1788 dmio - ok

20:04:48.0171 1788 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

20:04:48.0171 1788 dmload - ok

20:04:48.0375 1788 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

20:04:48.0375 1788 dmserver - ok

20:04:48.0609 1788 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

20:04:48.0625 1788 DMusic - ok

20:04:48.0843 1788 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

20:04:48.0843 1788 Dnscache - ok

20:04:49.0062 1788 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

20:04:49.0093 1788 Dot3svc - ok

20:04:49.0296 1788 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys

20:04:49.0312 1788 dpti2o - ok

20:04:49.0500 1788 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

20:04:49.0500 1788 drmkaud - ok

20:04:49.0734 1788 DRVMCDB (5d3b71bb2bb0009d65d290e2ef374bd3) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS

20:04:49.0765 1788 DRVMCDB - ok

20:04:49.0968 1788 DRVNDDM (c591ba9f96f40a1fd6494dafdcd17185) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS

20:04:49.0968 1788 DRVNDDM - ok

20:04:50.0140 1788 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

20:04:50.0156 1788 EapHost - ok

20:04:50.0343 1788 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

20:04:50.0343 1788 ERSvc - ok

20:04:50.0578 1788 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

20:04:50.0578 1788 Eventlog - ok

20:04:50.0843 1788 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

20:04:50.0906 1788 EventSystem - ok

20:04:51.0140 1788 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

20:04:51.0171 1788 Fastfat - ok

20:04:51.0390 1788 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

20:04:51.0437 1788 FastUserSwitchingCompatibility - ok

20:04:51.0703 1788 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe

20:04:51.0765 1788 Fax - ok

20:04:51.0968 1788 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

20:04:51.0968 1788 Fdc - ok

20:04:52.0156 1788 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

20:04:52.0171 1788 Fips - ok

20:04:52.0406 1788 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

20:04:52.0562 1788 FLEXnet Licensing Service - ok

20:04:52.0765 1788 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

20:04:52.0765 1788 Flpydisk - ok

20:04:52.0984 1788 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

20:04:53.0015 1788 FltMgr - ok

20:04:53.0125 1788 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

20:04:53.0140 1788 FontCache3.0.0.0 - ok

20:04:53.0312 1788 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

20:04:53.0312 1788 Fs_Rec - ok

20:04:53.0546 1788 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

20:04:53.0578 1788 Ftdisk - ok

20:04:53.0781 1788 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

20:04:53.0781 1788 GEARAspiWDM - ok

20:04:53.0968 1788 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

20:04:53.0984 1788 Gpc - ok

20:04:54.0109 1788 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe

20:04:54.0140 1788 gupdate - ok

20:04:54.0187 1788 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe

20:04:54.0187 1788 gupdatem - ok

20:04:54.0281 1788 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

20:04:54.0312 1788 gusvc - ok

20:04:54.0609 1788 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

20:04:54.0609 1788 HDAudBus - ok

20:04:54.0765 1788 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

20:04:54.0781 1788 helpsvc - ok

20:04:54.0968 1788 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll

20:04:54.0968 1788 HidServ - ok

20:04:55.0156 1788 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

20:04:55.0156 1788 hidusb - ok

20:04:55.0343 1788 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

20:04:55.0375 1788 hkmsvc - ok

20:04:55.0578 1788 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys

20:04:55.0593 1788 hpn - ok

20:04:55.0843 1788 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

20:04:55.0906 1788 HTTP - ok

20:04:56.0093 1788 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

20:04:56.0093 1788 HTTPFilter - ok

20:04:56.0312 1788 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys

20:04:56.0312 1788 i2omgmt - ok

20:04:56.0500 1788 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys

20:04:56.0500 1788 i2omp - ok

20:04:58.0140 1788 ialm (b2768350bb50469aeb1afe694372b613) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys

20:04:59.0609 1788 ialm - ok

20:04:59.0937 1788 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

20:05:00.0156 1788 idsvc - ok

20:05:00.0390 1788 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

20:05:00.0390 1788 Imapi - ok

20:05:00.0609 1788 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

20:05:00.0640 1788 ImapiService - ok

20:05:00.0906 1788 IMFservice (491fb9e6c0bd1383884d64ea5b886ad8) C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

20:05:00.0921 1788 IMFservice - ok

20:05:01.0140 1788 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys

20:05:01.0140 1788 ini910u - ok

20:05:01.0359 1788 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

20:05:01.0359 1788 IntelIde - ok

20:05:01.0562 1788 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

20:05:01.0578 1788 intelppm - ok

20:05:01.0765 1788 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

20:05:01.0781 1788 Ip6Fw - ok

20:05:01.0953 1788 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

20:05:01.0968 1788 IpFilterDriver - ok

20:05:02.0140 1788 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

20:05:02.0140 1788 IpInIp - ok

20:05:02.0375 1788 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

20:05:02.0406 1788 IpNat - ok

20:05:02.0671 1788 iPod Service (9033d67b7112d23eded6789bacded128) C:\Program Files\iPod\bin\iPodService.exe

20:05:02.0875 1788 iPod Service - ok

20:05:03.0078 1788 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

20:05:03.0109 1788 IPSec - ok

20:05:03.0312 1788 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

20:05:03.0312 1788 IRENUM - ok

20:05:03.0515 1788 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

20:05:03.0531 1788 isapnp - ok

20:05:03.0625 1788 JavaQuickStarterService (44ffba62f0f426b581759c49aafec2e2) C:\Program Files\Java\jre6\bin\jqs.exe

20:05:03.0671 1788 JavaQuickStarterService - ok

20:05:03.0890 1788 k57w2k (cb46c36f55cdfe4d20d9833e0f267c84) C:\WINDOWS\system32\DRIVERS\k57xp32.sys

20:05:03.0937 1788 k57w2k - ok

20:05:04.0171 1788 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

20:05:04.0171 1788 Kbdclass - ok

20:05:04.0406 1788 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

20:05:04.0421 1788 kbdhid - ok

20:05:04.0718 1788 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

20:05:04.0750 1788 kmixer - ok

20:05:04.0984 1788 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

20:05:05.0000 1788 KSecDD - ok

20:05:05.0218 1788 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

20:05:05.0250 1788 LanmanServer - ok

20:05:05.0468 1788 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

20:05:05.0500 1788 lanmanworkstation - ok

20:05:05.0671 1788 lbrtfdc - ok

20:05:05.0890 1788 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

20:05:05.0890 1788 LmHosts - ok

20:05:05.0984 1788 LMIInfo (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys

20:05:06.0000 1788 LMIInfo - ok

20:05:06.0078 1788 LMIMaint (500f1e4461075d602ce77109a9a3d634) C:\Program Files\LogMeIn\x86\RaMaint.exe

20:05:06.0109 1788 LMIMaint - ok

20:05:06.0281 1788 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys

20:05:06.0296 1788 lmimirr - ok

20:05:06.0468 1788 LMIRfsClientNP - ok

20:05:06.0671 1788 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys

20:05:06.0687 1788 LMIRfsDriver - ok

20:05:06.0750 1788 LogMeIn (9015122d04c195bdab88febcbae229db) C:\Program Files\LogMeIn\x86\LogMeIn.exe

20:05:06.0765 1788 LogMeIn - ok

20:05:06.0968 1788 LVPr2Mon (f4d5180e84bca0b7caa68a39ca770cb7) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys

20:05:06.0968 1788 LVPr2Mon - ok

20:05:07.0093 1788 LVPrcSrv (6c6362c5febcebbb76c991899b5223a7) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

20:05:07.0125 1788 LVPrcSrv - ok

20:05:07.0390 1788 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys

20:05:07.0390 1788 MBAMProtector - ok

20:05:07.0640 1788 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

20:05:07.0796 1788 MBAMService - ok

20:05:08.0015 1788 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

20:05:08.0015 1788 Messenger - ok

20:05:08.0140 1788 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

20:05:08.0156 1788 Microsoft Office Groove Audit Service - ok

20:05:08.0406 1788 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

20:05:08.0406 1788 mnmdd - ok

20:05:08.0625 1788 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

20:05:08.0640 1788 mnmsrvc - ok

20:05:08.0843 1788 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

20:05:08.0843 1788 Modem - ok

20:05:09.0062 1788 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

20:05:09.0078 1788 Mouclass - ok

20:05:09.0250 1788 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

20:05:09.0250 1788 mouhid - ok

20:05:09.0484 1788 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

20:05:09.0500 1788 MountMgr - ok

20:05:09.0671 1788 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys

20:05:09.0687 1788 mraid35x - ok

20:05:09.0937 1788 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

20:05:09.0968 1788 MRxDAV - ok

20:05:10.0265 1788 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

20:05:10.0375 1788 MRxSmb - ok

20:05:10.0578 1788 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

20:05:10.0578 1788 MSDTC - ok

20:05:10.0765 1788 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

20:05:10.0765 1788 Msfs - ok

20:05:10.0921 1788 MSIServer - ok

20:05:11.0125 1788 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

20:05:11.0140 1788 MSKSSRV - ok

20:05:11.0312 1788 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

20:05:11.0312 1788 MSPCLOCK - ok

20:05:11.0500 1788 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

20:05:11.0500 1788 MSPQM - ok

20:05:11.0734 1788 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

20:05:11.0734 1788 mssmbios - ok

20:05:11.0828 1788 MSSQL$MSSMLBIZ - ok

20:05:11.0890 1788 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe

20:05:11.0921 1788 MSSQLServerADHelper - ok

20:05:12.0125 1788 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

20:05:12.0125 1788 MSTEE - ok

20:05:12.0343 1788 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

20:05:12.0375 1788 Mup - ok

20:05:12.0578 1788 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

20:05:12.0593 1788 NABTSFEC - ok

20:05:12.0843 1788 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

20:05:12.0921 1788 napagent - ok

20:05:13.0140 1788 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

20:05:13.0187 1788 NDIS - ok

20:05:13.0359 1788 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

20:05:13.0375 1788 NdisIP - ok

20:05:13.0593 1788 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

20:05:13.0593 1788 NdisTapi - ok

20:05:13.0765 1788 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

20:05:13.0781 1788 Ndisuio - ok

20:05:13.0968 1788 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

20:05:14.0000 1788 NdisWan - ok

20:05:14.0218 1788 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

20:05:14.0234 1788 NDProxy - ok

20:05:14.0406 1788 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

20:05:14.0421 1788 NetBIOS - ok

20:05:14.0656 1788 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

20:05:14.0703 1788 NetBT - ok

20:05:14.0921 1788 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

20:05:14.0953 1788 NetDDE - ok

20:05:14.0984 1788 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

20:05:14.0984 1788 NetDDEdsdm - ok

20:05:15.0171 1788 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

20:05:15.0171 1788 Netlogon - ok

20:05:15.0406 1788 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

20:05:15.0453 1788 Netman - ok

20:05:15.0609 1788 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

20:05:15.0640 1788 NetTcpPortSharing - ok

20:05:15.0875 1788 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

20:05:15.0921 1788 Nla - ok

20:05:16.0140 1788 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

20:05:16.0156 1788 Npfs - ok

20:05:16.0468 1788 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

20:05:16.0625 1788 Ntfs - ok

20:05:16.0828 1788 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

20:05:16.0843 1788 NtLmSsp - ok

20:05:17.0187 1788 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

20:05:17.0296 1788 NtmsSvc - ok

20:05:17.0500 1788 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

20:05:17.0500 1788 Null - ok

20:05:17.0703 1788 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

20:05:17.0718 1788 NwlnkFlt - ok

20:05:17.0921 1788 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

20:05:17.0921 1788 NwlnkFwd - ok

20:05:18.0140 1788 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

20:05:18.0250 1788 odserv - ok

20:05:18.0328 1788 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

20:05:18.0375 1788 ose - ok

20:05:18.0609 1788 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

20:05:18.0640 1788 Parport - ok

20:05:18.0828 1788 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

20:05:18.0843 1788 PartMgr - ok

20:05:19.0015 1788 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

20:05:19.0015 1788 ParVdm - ok

20:05:19.0218 1788 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

20:05:19.0234 1788 PCI - ok

20:05:19.0406 1788 PCIDump - ok

20:05:19.0593 1788 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

20:05:19.0593 1788 PCIIde - ok

20:05:19.0812 1788 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

20:05:19.0843 1788 Pcmcia - ok

20:05:20.0015 1788 PDCOMP - ok

20:05:20.0203 1788 PDFRAME - ok

20:05:20.0375 1788 PDRELI - ok

20:05:20.0546 1788 PDRFRAME - ok

20:05:20.0734 1788 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys

20:05:20.0734 1788 perc2 - ok

20:05:20.0921 1788 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys

20:05:20.0921 1788 perc2hib - ok

20:05:21.0187 1788 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE

20:05:21.0250 1788 PEVSystemStart - ok

20:05:22.0140 1788 PID_PEPI (bd8c6c254835ea14ec0242f76009cbc4) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS

20:05:22.0859 1788 PID_PEPI - ok

20:05:23.0093 1788 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

20:05:23.0093 1788 PlugPlay - ok

20:05:23.0265 1788 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

20:05:23.0281 1788 PolicyAgent - ok

20:05:23.0500 1788 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

20:05:23.0515 1788 PptpMiniport - ok

20:05:23.0703 1788 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

20:05:23.0703 1788 ProtectedStorage - ok

20:05:23.0890 1788 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

20:05:23.0906 1788 PSched - ok

20:05:24.0078 1788 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

20:05:24.0093 1788 Ptilink - ok

20:05:24.0296 1788 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys

20:05:24.0312 1788 PxHelp20 - ok

20:05:24.0546 1788 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys

20:05:24.0546 1788 ql1080 - ok

20:05:24.0734 1788 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys

20:05:24.0734 1788 Ql10wnt - ok

20:05:24.0921 1788 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys

20:05:24.0937 1788 ql12160 - ok

20:05:25.0125 1788 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys

20:05:25.0140 1788 ql1240 - ok

20:05:25.0328 1788 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys

20:05:25.0343 1788 ql1280 - ok

20:05:25.0531 1788 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

20:05:25.0531 1788 RasAcd - ok

20:05:25.0750 1788 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

20:05:25.0765 1788 RasAuto - ok

20:05:25.0984 1788 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

20:05:26.0000 1788 Rasl2tp - ok

20:05:26.0203 1788 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

20:05:26.0250 1788 RasMan - ok

20:05:26.0437 1788 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

20:05:26.0437 1788 RasPppoe - ok

20:05:26.0625 1788 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

20:05:26.0625 1788 Raspti - ok

20:05:26.0843 1788 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

20:05:26.0875 1788 Rdbss - ok

20:05:27.0046 1788 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

20:05:27.0062 1788 RDPCDD - ok

20:05:27.0296 1788 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

20:05:27.0343 1788 rdpdr - ok

20:05:27.0593 1788 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

20:05:27.0625 1788 RDPWD - ok

20:05:27.0843 1788 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

20:05:27.0875 1788 RDSessMgr - ok

20:05:28.0078 1788 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

20:05:28.0093 1788 redbook - ok

20:05:28.0281 1788 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

20:05:28.0296 1788 RemoteAccess - ok

20:05:28.0500 1788 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll

20:05:28.0515 1788 RemoteRegistry - ok

20:05:28.0734 1788 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

20:05:28.0750 1788 RpcLocator - ok

20:05:29.0031 1788 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

20:05:29.0031 1788 RpcSs - ok

20:05:29.0234 1788 RRNetCap (43110c2a2c5ed32ead96c440718e4452) C:\WINDOWS\system32\DRIVERS\rrnetcap.sys

20:05:29.0234 1788 RRNetCap - ok

20:05:29.0250 1788 RRNetCapMP (43110c2a2c5ed32ead96c440718e4452) C:\WINDOWS\system32\DRIVERS\rrnetcap.sys

20:05:29.0250 1788 RRNetCapMP - ok

20:05:29.0453 1788 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

20:05:29.0500 1788 RSVP - ok

20:05:29.0671 1788 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

20:05:29.0671 1788 SamSs - ok

20:05:29.0906 1788 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

20:05:29.0937 1788 SCardSvr - ok

20:05:30.0234 1788 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

20:05:30.0296 1788 Schedule - ok

20:05:30.0546 1788 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

20:05:30.0546 1788 Secdrv - ok

20:05:30.0781 1788 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

20:05:30.0781 1788 seclogon - ok

20:05:31.0000 1788 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

20:05:31.0015 1788 SENS - ok

20:05:31.0187 1788 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

20:05:31.0203 1788 Serenum - ok

20:05:31.0421 1788 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

20:05:31.0437 1788 Serial - ok

20:05:31.0656 1788 SFAUDIO (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys

20:05:31.0671 1788 SFAUDIO - ok

20:05:31.0875 1788 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

20:05:31.0875 1788 Sfloppy - ok

20:05:32.0156 1788 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

20:05:32.0250 1788 SharedAccess - ok

20:05:32.0468 1788 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

20:05:32.0468 1788 ShellHWDetection - ok

20:05:32.0625 1788 Simbad - ok

20:05:32.0843 1788 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys

20:05:32.0843 1788 sisagp - ok

20:05:33.0046 1788 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

20:05:33.0062 1788 SLIP - ok

20:05:33.0250 1788 SmartDefragDriver (972dea0d8149d73c5b7a2c97b2e749e3) C:\WINDOWS\system32\Drivers\SmartDefragDriver.sys

20:05:33.0250 1788 SmartDefragDriver - ok

20:05:33.0453 1788 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys

20:05:33.0468 1788 Sparrow - ok

20:05:33.0671 1788 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

20:05:33.0687 1788 splitter - ok

20:05:33.0890 1788 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

20:05:33.0906 1788 Spooler - ok

20:05:34.0031 1788 SQLBrowser (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

20:05:34.0093 1788 SQLBrowser - ok

20:05:34.0156 1788 SQLWriter (d89083c4eb02daca8f944b0e05e57f9d) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

20:05:34.0171 1788 SQLWriter - ok

20:05:34.0421 1788 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

20:05:34.0437 1788 sr - ok

20:05:34.0687 1788 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

20:05:34.0734 1788 srservice - ok

20:05:35.0000 1788 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

20:05:35.0093 1788 Srv - ok

20:05:35.0328 1788 sscebus (29ae754f4e9dcc08dcfd4aef07375d52) C:\WINDOWS\system32\DRIVERS\sscebus.sys

20:05:35.0343 1788 sscebus - ok

20:05:35.0546 1788 sscemdfl (48de57f9c5a7f39ec3ea5cfbf163b811) C:\WINDOWS\system32\DRIVERS\sscemdfl.sys

20:05:35.0546 1788 sscemdfl - ok

20:05:35.0750 1788 sscemdm (600d634c721e57e4b89d3dfdd381cdb7) C:\WINDOWS\system32\DRIVERS\sscemdm.sys

20:05:35.0781 1788 sscemdm - ok

20:05:35.0968 1788 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

20:05:36.0000 1788 SSDPSRV - ok

20:05:36.0250 1788 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

20:05:36.0328 1788 stisvc - ok

20:05:36.0500 1788 stllssvr (de3e7a2345ebaa3ce8e6957dfb55fb15) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

20:05:36.0515 1788 stllssvr - ok

20:05:36.0734 1788 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

20:05:36.0734 1788 streamip - ok

20:05:36.0953 1788 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

20:05:36.0953 1788 swenum - ok

20:05:37.0171 1788 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

20:05:37.0296 1788 SwitchBoard - ok

20:05:37.0546 1788 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

20:05:37.0562 1788 swmidi - ok

20:05:37.0718 1788 SwPrv - ok

20:05:37.0921 1788 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys

20:05:37.0921 1788 symc810 - ok

20:05:38.0140 1788 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys

20:05:38.0140 1788 symc8xx - ok

20:05:38.0328 1788 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys

20:05:38.0328 1788 sym_hi - ok

20:05:38.0531 1788 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys

20:05:38.0531 1788 sym_u3 - ok

20:05:38.0765 1788 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

20:05:38.0781 1788 sysaudio - ok

20:05:39.0000 1788 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

20:05:39.0015 1788 SysmonLog - ok

20:05:39.0265 1788 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

20:05:39.0312 1788 TapiSrv - ok

20:05:39.0515 1788 tbhsd (4d46f63f7ddc2442941d63327c360b90) C:\WINDOWS\system32\drivers\tbhsd.sys

20:05:39.0531 1788 tbhsd - ok

20:05:39.0812 1788 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

20:05:39.0906 1788 Tcpip - ok

20:05:40.0109 1788 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

20:05:40.0125 1788 TDPIPE - ok

20:05:40.0312 1788 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

20:05:40.0312 1788 TDTCP - ok

20:05:40.0531 1788 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

20:05:40.0531 1788 TermDD - ok

20:05:40.0812 1788 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

20:05:40.0890 1788 TermService - ok

20:05:41.0109 1788 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

20:05:41.0109 1788 Themes - ok

20:05:41.0296 1788 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe

20:05:41.0312 1788 TlntSvr - ok

20:05:41.0484 1788 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys

20:05:41.0484 1788 TosIde - ok

20:05:41.0703 1788 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

20:05:41.0718 1788 TrkWks - ok

20:05:41.0921 1788 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

20:05:41.0937 1788 Udfs - ok

20:05:42.0062 1788 UleadBurningHelper (810883e6225c0037f2553d964fc866e3) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

20:05:42.0093 1788 UleadBurningHelper - ok

20:05:42.0281 1788 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys

20:05:42.0296 1788 ultra - ok

20:05:42.0671 1788 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

20:05:42.0812 1788 Update - ok

20:05:43.0078 1788 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

20:05:43.0125 1788 upnphost - ok

20:05:43.0312 1788 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

20:05:43.0312 1788 UPS - ok

20:05:43.0531 1788 USBAAPL (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys

20:05:43.0546 1788 USBAAPL - ok

20:05:43.0765 1788 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

20:05:43.0781 1788 usbaudio - ok

20:05:43.0984 1788 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

20:05:43.0984 1788 usbccgp - ok

20:05:44.0203 1788 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

20:05:44.0203 1788 usbehci - ok

20:05:44.0437 1788 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

20:05:44.0453 1788 usbhub - ok

20:05:44.0671 1788 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

20:05:44.0671 1788 usbscan - ok

20:05:44.0890 1788 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

20:05:44.0890 1788 USBSTOR - ok

20:05:45.0078 1788 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

20:05:45.0078 1788 usbuhci - ok

20:05:45.0328 1788 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys

20:05:45.0359 1788 usbvideo - ok

20:05:45.0578 1788 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

20:05:45.0578 1788 VgaSave - ok

20:05:45.0781 1788 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys

20:05:45.0796 1788 viaagp - ok

20:05:45.0984 1788 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys

20:05:45.0984 1788 ViaIde - ok

20:05:46.0171 1788 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

20:05:46.0187 1788 VolSnap - ok

20:05:46.0437 1788 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

20:05:46.0515 1788 VSS - ok

20:05:46.0734 1788 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

20:05:46.0781 1788 w32time - ok

20:05:46.0984 1788 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

20:05:47.0000 1788 Wanarp - ok

20:05:47.0156 1788 WDICA - ok

20:05:47.0421 1788 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

20:05:47.0437 1788 wdmaud - ok

20:05:47.0625 1788 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

20:05:47.0640 1788 WebClient - ok

20:05:47.0921 1788 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

20:05:47.0953 1788 winmgmt - ok

20:05:48.0406 1788 WinRM (18f347402da544a780949b8fdf83351b) C:\WINDOWS\system32\WsmSvc.dll

20:05:48.0718 1788 WinRM - ok

20:05:48.0953 1788 WmdmPmSN (c7e39ea41233e9f5b86c8da3a9f1e4a8) C:\WINDOWS\system32\mspmsnsv.dll

20:05:48.0968 1788 WmdmPmSN - ok

20:05:49.0296 1788 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll

20:05:49.0437 1788 Wmi - ok

20:05:49.0656 1788 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

20:05:49.0687 1788 WmiApSrv - ok

20:05:49.0921 1788 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

20:05:49.0937 1788 WS2IFSL - ok

20:05:50.0171 1788 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

20:05:50.0187 1788 wscsvc - ok

20:05:50.0343 1788 WSearch - ok

20:05:50.0546 1788 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

20:05:50.0562 1788 WSTCODEC - ok

20:05:50.0750 1788 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

20:05:50.0750 1788 wuauserv - ok

20:05:51.0046 1788 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

20:05:51.0171 1788 WZCSVC - ok

20:05:51.0375 1788 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

20:05:51.0421 1788 xmlprov - ok

20:05:51.0468 1788 MBR (0x1B8) (cdb4de4bbd714f152979da2dcbef57eb) \Device\Harddisk0\DR0

20:05:51.0500 1788 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected

20:05:51.0500 1788 \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0)

20:05:51.0515 1788 MBR (0x1B8) (ddae9d649db12f6aff24483f2c298989) \Device\Harddisk1\DR6

20:05:51.0515 1788 \Device\Harddisk1\DR6 - ok

20:05:51.0562 1788 Boot (0x1200) (7019eb4ed7475397299dcfc0ef612fee) \Device\Harddisk0\DR0\Partition0

20:05:51.0562 1788 \Device\Harddisk0\DR0\Partition0 - ok

20:05:51.0578 1788 Boot (0x1200) (ea94d10371f902e50906ebd662495cb5) \Device\Harddisk1\DR6\Partition0

20:05:51.0578 1788 \Device\Harddisk1\DR6\Partition0 - ok

20:05:51.0593 1788 ============================================================

20:05:51.0593 1788 Scan finished

20:05:51.0593 1788 ============================================================

20:05:51.0609 1780 Detected object count: 1

20:05:51.0609 1780 Actual detected object count: 1

20:06:35.0796 1780 \Device\Harddisk0\DR0\# - copied to quarantine

20:06:35.0796 1780 \Device\Harddisk0\DR0 - copied to quarantine

20:06:35.0875 1780 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

20:06:35.0875 1780 \Device\Harddisk0\DR0\TDLFS\rsrc.dat - copied to quarantine

20:06:35.0875 1780 \Device\Harddisk0\DR0\TDLFS\bckfg.tmp - copied to quarantine

20:06:35.0890 1780 \Device\Harddisk0\DR0\TDLFS\tdlcmd.dll - copied to quarantine

20:06:35.0906 1780 \Device\Harddisk0\DR0\TDLFS\keywords - copied to quarantine

20:06:35.0906 1780 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - will be cured on reboot

20:06:35.0906 1780 \Device\Harddisk0\DR0 - ok

20:06:36.0171 1780 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Cure

20:06:52.0390 1752 Deinitialize success

Larusso · March 31, 2012

I see you ran ComboFix without being instructed to. I would like to quote a section of the ComboFix tutorial located here: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

Fcvolunteer · April 1, 2012

Hi Daniel,

Thanks for your concern. I actually did run ComboFix and the request of a helper, it just wasn't a helper from Malwarebytes. As I mentioned earlier,

I contacted our computer person at work who told me to use combofix

Just so youshould know, (I don't know if it's important or not) I ran combofix now and after completeing stage 5 the screen went blue and i got a really long error message saying,

A problem has been detected and windows has been shut down to prevent damage to your computer.
Plug and play detected and error most likely caused bu a faulty driver.
If this is the first time you've seen the stop error screen, restart your computer.
If this screen appears again follow these steps:
Check to make sure any new hardware or software is properly installed. If this is a new installation ask your hardware or software manufacturer for any windows updates you might need.
If problems continue disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable compnents, restart your computer, press F8 to select advanced startup options and then select safe mode.
Technical Information:
*** STOP: 0x000000CA (0x00000004, 0x898DEC98, 0x00000000, 0x00000000)

ComboFix 12-03-31.03 - Rochel 03/31/2012 22:13:38.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.3061.2139 [GMT -4:00]

Running from: c:\documents and settings\Rochel\Desktop\ComboFix.exe

AV: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\Rochel\System

c:\documents and settings\Rochel\System\win_qs8.jqx

c:\program files\ARO2011_tbt.exe

c:\program files\avg_free_stf_en_85_285a1462.exe

c:\program files\somototoolbar\vmNTemplatex.dll

C:\setup.exe

c:\windows\EventSystem.log

c:\windows\Fonts\OptimaBold.ttf

c:\windows\system32\fsc.txt

c:\windows\system32\ide.txt

c:\windows\system32\klgd.bmp

c:\windows\system32\lpe.txt

c:\windows\system32\xef.txt

c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\windows\XSxS

.

c:\windows\system32\drivers\i8042prt.sys . . . is missing!!

.

((((((((((((((((((((((((( Files Created from 2012-03-01 to 2012-04-01 )))))))))))))))))))))))))))))))

.

2012-03-30 02:06 . 2012-03-30 02:06 -------- d-----w- c:\program files\Windows Media Connect 2

2012-03-30 02:04 . 2012-03-30 02:05 -------- d-----w- c:\windows\system32\drivers\UMDF

2012-03-30 02:04 . 2012-03-30 02:04 -------- d-----w- c:\windows\system32\LogFiles

2012-03-30 00:56 . 2012-03-30 00:46 92432 ----a-w- c:\windows\system32\drivers\tmtdi.sys

2012-03-30 00:56 . 2012-03-30 00:46 81168 ----a-w- c:\windows\system32\drivers\tmactmon.sys

2012-03-30 00:56 . 2012-03-30 00:46 68368 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys

2012-03-30 00:56 . 2012-03-30 00:46 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2012-03-30 00:46 . 2012-03-30 00:59 -------- d-----w- c:\program files\Trend Micro

2012-03-30 00:06 . 2012-03-30 00:06 -------- d-----w- C:\TDSSKiller_Quarantine

2012-03-29 03:44 . 2012-03-29 03:44 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2012-03-29 03:31 . 2012-03-29 03:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2012-03-29 02:35 . 2012-03-29 02:35 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2012-03-27 23:42 . 2012-03-27 23:42 -------- d-----w- C:\temp

2012-03-27 20:10 . 2012-03-30 00:55 56 ----a-w- c:\windows\system32\SupportTool.exe.bat

2012-03-27 20:09 . 2012-03-30 00:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Trend Micro

2012-03-21 22:42 . 2012-03-21 22:42 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-03-21 22:42 . 2012-03-21 22:42 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-06 23:42 . 2011-08-19 03:40 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-03 09:26 . 2008-04-25 16:16 1869184 ----a-w- c:\windows\system32\win32k.sys

2012-02-02 04:40 . 2012-02-02 04:40 538200 ----a-w- c:\program files\smartdraw_11E_QDO56_setup.exe

2012-01-31 21:57 . 2012-01-31 21:53 32853760 ----a-w- c:\program files\spoon-plugin-dotnet.exe

2012-01-22 18:42 . 2010-07-26 19:31 30218224 ----a-w- c:\program files\asc-setup.exe

2012-01-11 19:06 . 2012-02-16 05:30 3072 ------w- c:\windows\system32\iacenc.dll

2012-01-09 16:20 . 2008-04-25 21:26 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-01-02 00:51 . 2012-01-02 00:47 15292208 ----a-w- c:\program files\Firefox Setup 9.0.1.exe

2011-12-12 04:22 . 2011-12-12 04:14 64207032 ----a-w- c:\program files\setup_av_free_cnet.exe

2011-12-08 20:55 . 2011-12-08 20:55 108 ----a-w- c:\program files\hirtcamp.com

2011-08-19 15:16 . 2011-08-19 03:14 3089056 ----a-w- c:\program files\install_flash_player.exe

2011-07-24 16:14 . 2011-07-24 16:05 65981368 ----a-w- c:\program files\AVSVideoConverter.exe

2011-07-24 15:17 . 2011-07-24 15:17 6062368 ----a-w- c:\program files\video-download-toolbar-setup.exe

2011-07-24 15:08 . 2011-07-24 15:08 858940 ----a-w- c:\program files\toolbar_setup411.exe

2011-07-24 15:02 . 2011-07-24 15:02 5153792 ----a-w- c:\program files\YouTubeDownloaderSetup32.exe

2011-07-24 14:40 . 2011-07-24 14:40 8532623 ----a-w- c:\program files\gfsetup.exe

2011-07-17 19:08 . 2011-07-17 19:07 14276088 ----a-w- c:\program files\picasa38-setup.exe

2011-06-15 01:46 . 2011-06-15 01:45 4117040 ----a-w- c:\program files\CNET_TechTracker_2_0_3_59_a_Setup.exe

2011-05-29 21:55 . 2011-05-29 21:49 56923744 ----a-w- c:\program files\setup_av_free.exe

2011-05-25 23:03 . 2011-05-25 22:59 30459048 ----a-w- c:\program files\asc4-setup-cnet.exe

2011-05-13 15:48 . 2011-05-13 15:43 2431520 ----a-w- c:\program files\AdobeDownloadAssistant.exe

2011-04-29 17:06 . 2011-04-29 17:05 12521992 ----a-w- c:\program files\Firefox Setup 4.0.1.exe

2011-04-12 00:54 . 2011-04-12 00:47 51349520 ----a-w- c:\program files\avira_antivir_personal_en.exe

2011-04-06 17:58 . 2011-04-06 17:52 80298280 ----a-w- c:\program files\iTunesSetup.exe

2010-11-23 20:48 . 2010-11-23 20:47 13525424 ----a-w- c:\program files\Dropbox 0.7.110.exe

2010-11-14 04:02 . 2010-11-14 04:01 2443360 ----a-w- c:\program files\divine-setup.exe

2010-10-04 18:26 . 2010-10-04 18:26 947592 ----a-w- c:\program files\SkypeSetup.exe

2010-09-28 15:42 . 2010-09-28 15:41 225672 ----a-w- c:\program files\CrucialScan.exe

2010-09-27 00:53 . 2010-09-27 00:53 469504 ----a-w- c:\program files\ACTPrinterSetup.exe

2010-09-15 22:39 . 2010-09-15 22:38 7633259 ----a-w- c:\program files\fmcjsetup.exe

2010-09-15 22:31 . 2010-09-15 22:31 4585944 ----a-w- c:\program files\mp3-splitter-joiner.exe

2010-09-15 05:02 . 2009-10-22 02:49 2007072 ----a-w- c:\program files\mp3joiner_setup.exe

2010-07-21 02:42 . 2010-07-21 02:41 3087086 ----a-w- c:\program files\mp3cutterjoiner.exe

2010-07-21 02:38 . 2010-07-21 02:38 689560 ----a-w- c:\program files\iobituninstaller.exe

2010-07-19 21:59 . 2010-07-19 21:58 2411072 ----a-w- c:\program files\MP3Cutter.EXE

2010-07-19 20:52 . 2010-07-19 20:48 38084600 ----a-w- c:\program files\tunebite.exe

2010-06-24 18:32 . 2010-06-24 18:31 8587672 ----a-w- c:\program files\Firefox Setup 3.6.4.exe

2010-06-22 18:43 . 2010-06-22 18:40 32532792 ----a-w- c:\program files\SafariSetup.exe

2010-05-06 20:35 . 2010-05-06 20:35 562864 ----a-w- c:\program files\GoogleVoiceAndVideoSetup.exe

2010-04-19 03:01 . 2010-04-19 03:01 562848 ----a-w- c:\program files\GoogleEarthSetup.exe

2010-04-19 02:08 . 2010-04-19 02:08 529800 ----a-w- c:\program files\smartdraw_10E_H3HE9_A_setup.exe

2010-04-16 21:47 . 2010-04-16 21:47 4071176 ----a-w- c:\program files\registrybooster.exe

2010-02-22 02:35 . 2010-02-22 02:16 82452960 ----a-w- c:\program files\a897_PCStudio.exe

2010-01-08 03:20 . 2010-01-08 03:19 11029387 ----a-w- c:\program files\aoaaudioextractor.exe

2009-12-02 18:38 . 2009-12-02 18:38 6599680 ----a-w- c:\program files\DingInstall-1.05.exe

2009-11-10 05:28 . 2009-11-10 05:28 72946 ----a-w- c:\program files\ears.com

2009-11-02 00:40 . 2009-11-02 00:39 21785928 ----a-w- c:\program files\cuteftppro.exe

2009-10-30 18:03 . 2009-10-30 18:03 1505049 ----a-w- c:\program files\Mp3nity_2.1_Setup.exe

2009-10-23 01:01 . 2009-10-23 01:01 7492592 ----a-w- c:\program files\CoffeeFreeFTPInstaller4.2.exe

2009-09-08 17:35 . 2009-09-08 17:34 4938616 ----a-w- c:\program files\Silverlight.exe

2009-07-28 04:05 . 2009-07-28 04:05 1876292 ----a-w- c:\program files\freeripmp3.exe

2009-07-28 03:51 . 2009-07-28 03:50 2693610 ----a-w- c:\program files\swmsetup.exe

2009-07-28 02:57 . 2009-07-28 02:55 12154344 ----a-w- c:\program files\SFTPMSI.exe

2009-07-23 15:26 . 2009-07-23 15:25 7858801 ----a-w- c:\program files\Freeware_PrimoPDF.exe

2009-07-21 20:00 . 2009-07-21 20:00 6537 ----a-w- c:\program files\jquery.tools.min.js

2009-07-17 16:37 . 2009-07-17 16:37 3654395 ----a-w- c:\program files\ybkfull.exe

2009-07-10 16:46 . 2009-07-10 16:46 1234120 ----a-w- c:\program files\wrar380.exe

2009-07-08 19:02 . 2009-07-08 19:01 21935408 ----a-w- c:\program files\QuickTimeInstaller.exe

2009-04-30 23:14 . 2009-04-30 23:14 16883056 ----a-w- c:\program files\IE8-WindowsXP-x86-ENU.exe

2009-04-29 17:04 . 2009-04-29 17:04 2967800 ----a-w- c:\program files\mbam-setup.exe

2009-04-24 20:49 . 2009-04-24 20:49 1878888 ----a-w- c:\program files\Adobe Acrobat 9 Pro.lnk.exe

2009-04-24 20:33 . 2009-04-24 20:17 342437920 ----a-w- c:\program files\AcroPro90_efg.exe

2004-05-25 03:01 . 2010-07-26 03:59 1155635 ----a-w- c:\program files\EasyScreenCaptureVideo.exe

2012-03-21 22:42 . 2012-02-20 16:28 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

<pre>
c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl .exe
c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray .exe
</pre>

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B29002A0-87A1-4DC4-AC55-5982034EB61E}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Rochel\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Rochel\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Rochel\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Rochel\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Logicool Vid"="c:\program files\Logicool\Logicool Vid\vid.exe" [2009-06-02 5451536]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-03-06 574296]

"Akamai NetSession Interface"="c:\documents and settings\Rochel\Local Settings\Application Data\Akamai\netsession_win.exe" [2012-03-13 3331872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-19 141848]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-19 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-19 170520]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2012-02-27 1304792]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2012-02-27 133424]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2009-10-02 01:31 87352 ----a-w- c:\windows\system32\LMIinit.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^Rochel^Start Menu^Programs^Startup^ACTPrinter Win.exe.lnk]

path=c:\documents and settings\Rochel\Start Menu\Programs\Startup\ACTPrinter Win.exe.lnk

backup=c:\windows\pss\ACTPrinter Win.exe.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast]

c:\program files\AVAST Software\Avast\avastUI.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS3\\Dreamweaver.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Nitro PDF\\PrimoPDF\\PrimoPDF.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=

"c:\\Program Files\\CoffeeCup Software\\Free FTP\\FreeFTP.exe"=

"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=

"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=

"c:\\Documents and Settings\\Rochel\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Documents and Settings\\Rochel\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Documents and Settings\\Rochel\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=

"c:\\Program Files\\Logicool\\Logicool Vid\\Vid.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

"1166:TCP"= 1166:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [4/16/2009 7:00 AM 24064]

R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [6/14/2011 9:55 PM 13496]

R1 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [3/29/2012 8:56 PM 68368]

R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [12/7/2011 12:02 PM 913752]

R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [3/29/2012 8:54 PM 200632]

R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [6/14/2011 9:54 PM 821080]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]

R3 k57w2k;Broadcom NetLink Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [4/16/2009 7:00 AM 176640]

R3 RRNetCapMP;RRNetCapMP;c:\windows\system32\drivers\rrnetcap.sys [7/9/2010 4:34 PM 31848]

S0 bhyylicz;bhyylicz; [x]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/25/2010 4:08 PM 136176]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6/25/2010 4:08 PM 136176]

S3 RRNetCap;RRNetCap Service;c:\windows\system32\drivers\rrnetcap.sys [7/9/2010 4:34 PM 31848]

S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2/21/2010 10:42 PM 90240]

S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2/21/2010 10:42 PM 14976]

S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2/21/2010 10:42 PM 121856]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 1:37 PM 517096]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]

2010-02-16 23:02 114688 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe

.

Contents of the 'Scheduled Tasks' folder

.

2012-03-30 c:\windows\Tasks\AdobeAAMUpdater-1.0-ROCHELHOMEPC-Rochel.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-09-13 12:46]

.

2012-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-25 01:42]

.

2012-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-25 01:42]

.

2012-03-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136418324-59859425-3307268990-1005Core.job

- c:\documents and settings\Rochel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-04 20:17]

.

2012-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136418324-59859425-3307268990-1005UA.job

- c:\documents and settings\Rochel\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-04 20:17]

.

2012-04-01 c:\windows\Tasks\User_Feed_Synchronization-{DB9CE760-98C7-41EB-8CB1-36819FB4AEC5}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://chabadnc.org/

uInternet Settings,ProxyOverride = *.local;<local>

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\documents and settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\

FF - prefs.js: network.proxy.type - 0

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 750000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 750000

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 0

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{8854823A-E915-ADFF-BA70-E2C1456C2F56} - (no file)

Toolbar-Locked - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\program files\NOS\bin\getPlus_Helper_3004.dll

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-03-31 22:24

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

c:\docume~1\Rochel\LOCALS~1\Temp\CSCA.tmp

.

scan completed successfully

hidden files: 1

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,da,b4,55,a0,6c,18,30,49,9f,ed,3c,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,da,b4,55,a0,6c,18,30,49,9f,ed,3c,\

.

[HKEY_USERS\S-1-5-21-2136418324-59859425-3307268990-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7776FADB-5620-C489-58F0-FC82D8C4EC96}*]

@Allowed: (Read) (RestrictedCode)

"oaimpbidhbgigknbpekkeoojlngnpl"=hex:64,61,69,6f,70,68,6a,6c,00,85

"oaephfdalammeeihecaafkgjcipaff"=hex:6b,61,69,6f,69,69,6a,6e,61,6b,6d,67,61,62,

68,70,67,6b,6a,6d,6e,69,00,7c

"naolndnkagbaagahpjndhoccnikc"=hex:69,61,62,6f,63,66,6f,61,6a,68,61,62,61,6f,

63,62,6b,6b,00,ff

.

[HKEY_USERS\S-1-5-21-2136418324-59859425-3307268990-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CDC4B717-3FBD-D5D9-78C3-A2D963B7FF7D}*]

@Allowed: (Read) (RestrictedCode)

"oahnphlmgkkobkllacpchhnhnoacic"=hex:64,61,67,64,6d,6a,62,68,00,85

"oadpodbfgifogmlcgopoocoffpbkfc"=hex:6b,61,68,64,63,6a,6e,67,62,65,6a,6f,67,69,

68,63,67,66,63,69,69,69,00,00

"najobieokkghglombobpmhohjcpm"=hex:6a,61,67,64,6e,6a,65,68,6c,68,65,67,6d,69,

6a,68,64,67,67,66,00,0f

.

[HKEY_USERS\S-1-5-21-2136418324-59859425-3307268990-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D17F1DB2-E15B-47E1-2D85-82110FD3EE91}*]

@Allowed: (Read) (RestrictedCode)

"iaogcakdeakhgofdkb"=hex:6a,61,70,62,6e,62,6b,70,6e,6c,6c,6e,62,65,6a,70,62,66,

6b,61,00,f2

"hamheoaoohmccjpl"=hex:6a,61,62,62,70,68,6f,6e,67,62,6f,70,66,6a,62,61,65,67,

68,61,00,f2

"ganhgdhgpjloed"=hex:61,63,6e,62,68,62,63,62,6d,65,61,66,6d,62,6b,63,64,6d,67,

6d,65,6e,6c,65,6d,64,69,6e,66,68,68,70,62,6b,69,68,70,6b,65,6c,66,65,66,6f,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1068)

c:\windows\system32\LMIinit.dll

.

- - - - - - - > 'explorer.exe'(5320)

c:\windows\system32\WININET.dll

c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

c:\documents and settings\Rochel\Application Data\Dropbox\bin\DropboxExt.14.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Roxio\Drag-to-Disc\Shellex.dll

c:\program files\Common Files\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL

c:\program files\Roxio\Drag-to-Disc\ShellRes.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\LMIRfsClientNP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\LogMeIn\x86\RaMaint.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

c:\windows\system32\SearchIndexer.exe

c:\documents and settings\Rochel\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe

c:\program files\Southwest Airlines\Ding\Ding.exe

c:\windows\system32\igfxsrvc.exe

c:\documents and settings\Rochel\Application Data\Dropbox\bin\Dropbox.exe

c:\program files\MamaBargains\MamaBargains\MamaBargains.exe

c:\documents and settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\Spoon-Sandbox.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\SearchProtocolHost.exe

c:\documents and settings\Rochel\Local Settings\Application Data\Spoon\Client\Console\0.3.7.8\Spoon-Console.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2012-03-31 22:31:39 - machine was rebooted

ComboFix-quarantined-files.txt 2012-04-01 02:31

.

Pre-Run: 240,775,045,120 bytes free

Post-Run: 241,108,897,792 bytes free

.

- - End Of File - - 58D1895F0606E79453C8EF62193A8403

Fcvolunteer · April 1, 2012

oops, I meant to add that after I got that error message I removed my usb drive and restarted the computer and ran combofix again and everything ran as it should have and produced the log I included in my last post.

Thanks

Larusso · April 1, 2012

Hy there.

Download OTL to your Desktop.

Double click on the icon to run it.
Under the box paste this in


activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.manifest /3
/md5start
i8042prt.sys
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT

Make sure all other windows are closed to let it run uninterrupted.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please post both logfiles in your next reply.

Fcvolunteer · April 2, 2012

OTL logfile created on: 4/1/2012 7:54:04 PM - Run 1

OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Rochel\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 2.29 Gb Available Physical Memory | 76.73% Memory free

4.83 Gb Paging File | 3.87 Gb Available in Paging File | 80.20% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 298.05 Gb Total Space | 224.76 Gb Free Space | 75.41% Space Free | Partition Type: NTFS

Drive D: | 7.01 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ROCHELHOMEPC | User Name: Rochel | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/01 19:47:55 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rochel\Desktop\OTL.exe

PRC - [2012/03/29 20:46:27 | 000,200,632 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

PRC - [2012/03/29 20:46:27 | 000,142,952 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

PRC - [2012/03/14 17:38:14 | 000,913,752 | ---- | M] (IObit) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

PRC - [2012/03/13 05:37:52 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Akamai\netsession_win.exe

PRC - [2012/03/06 18:39:50 | 000,574,296 | ---- | M] (IObit) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

PRC - [2012/02/27 09:44:06 | 001,006,864 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe

PRC - [2012/02/27 09:44:06 | 000,133,424 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe

PRC - [2012/02/14 19:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Rochel\Application Data\Dropbox\bin\Dropbox.exe

PRC - [2012/01/27 16:06:16 | 002,324,872 | ---- | M] (Code Systems Corporation) -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\Spoon-Sandbox.exe

PRC - [2012/01/27 16:05:31 | 008,646,816 | ---- | M] (Code Systems Corporation) -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\Client\Console\0.3.7.8\Spoon-Console.exe

PRC - [2011/12/02 10:36:39 | 000,142,848 | ---- | M] () -- C:\Program Files\MamaBargains\MamaBargains\MamaBargains.exe

PRC - [2011/12/01 16:24:20 | 002,624,512 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe

PRC - [2011/06/01 14:10:00 | 000,821,080 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

PRC - [2011/03/30 09:12:18 | 000,310,944 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

PRC - [2009/12/03 17:52:32 | 001,980,560 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe

PRC - [2009/10/01 21:31:48 | 000,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe

PRC - [2009/10/01 21:31:39 | 000,378,176 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardian.exe

PRC - [2009/06/02 08:59:46 | 005,451,536 | ---- | M] (Logicool Co., Ltd) -- C:\Program Files\Logicool\Logicool Vid\Vid.exe

PRC - [2009/04/30 16:01:10 | 000,150,040 | ---- | M] (Logicool Co., Ltd) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe

PRC - [2008/07/24 18:46:10 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe

PRC - [2008/06/09 11:37:44 | 000,053,392 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/01/11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

PRC - [2006/06/22 15:15:48 | 000,462,848 | ---- | M] (Southwest Airlines) -- C:\Program Files\Southwest Airlines\Ding\Ding.exe

========== Modules (No Company Name) ==========

MOD - [2012/03/29 20:46:48 | 000,174,624 | ---- | M] () -- C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll

MOD - [2012/03/29 20:46:32 | 000,442,368 | ---- | M] () -- C:\Program Files\Trend Micro\AMSP\sqlite3.dll

MOD - [2012/03/29 20:46:29 | 001,081,344 | ---- | M] () -- C:\Program Files\Trend Micro\AMSP\libprotobuf.dll

MOD - [2012/03/29 20:46:27 | 000,057,344 | ---- | M] () -- C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll

MOD - [2012/03/29 20:46:27 | 000,049,152 | ---- | M] () -- C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll

MOD - [2012/03/29 20:46:27 | 000,012,288 | ---- | M] () -- C:\Program Files\Trend Micro\AMSP\boost_system-vc80-mt-1_36.dll

MOD - [2012/02/16 04:09:09 | 003,186,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll

MOD - [2012/02/16 04:09:06 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll

MOD - [2012/02/16 04:09:03 | 004,550,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll

MOD - [2012/02/16 04:08:59 | 000,626,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll

MOD - [2012/02/16 04:08:54 | 002,048,000 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll

MOD - [2012/02/16 04:08:49 | 000,010,752 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll

MOD - [2012/02/16 04:08:42 | 005,025,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll

MOD - [2012/02/16 04:08:41 | 000,839,680 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll

MOD - [2012/02/16 04:08:38 | 005,246,976 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll

MOD - [2012/01/22 14:33:46 | 004,770,176 | ---- | M] () -- c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\WebKit.dll

MOD - [2011/12/02 10:36:39 | 000,142,848 | ---- | M] () -- C:\Program Files\MamaBargains\MamaBargains\MamaBargains.exe

MOD - [2011/12/01 16:24:20 | 002,624,512 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe

MOD - [2011/04/21 16:54:40 | 000,347,024 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 5\madexcept_.bpl

MOD - [2011/04/21 16:54:40 | 000,179,088 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 5\madbasic_.bpl

MOD - [2011/04/21 16:54:40 | 000,046,480 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 5\maddisAsm_.bpl

MOD - [2011/02/28 18:37:32 | 000,180,624 | ---- | M] () -- C:\WINDOWS\system32\Primomonnt.dll

MOD - [2011/02/06 11:32:14 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2009/10/01 21:31:39 | 001,063,248 | ---- | M] () -- C:\Program Files\LogMeIn\x86\ICSAgent32.dll

MOD - [2009/06/02 09:00:22 | 000,138,000 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\plugins\imageformats\qjpeg4.dll

MOD - [2009/06/02 09:00:22 | 000,035,088 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\plugins\imageformats\qico4.dll

MOD - [2009/06/02 09:00:20 | 000,028,944 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\plugins\imageformats\qgif4.dll

MOD - [2009/06/02 08:59:34 | 000,027,408 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\SDL.dll

MOD - [2009/06/02 08:59:24 | 000,363,792 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\qtxml4.dll

MOD - [2009/06/02 08:59:12 | 011,311,888 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\QtWebKit4.dll

MOD - [2009/06/02 08:59:00 | 000,199,952 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\qtsql4.dll

MOD - [2009/06/02 08:58:50 | 000,475,408 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\QtOpenGL4.dll

MOD - [2009/06/02 08:58:38 | 007,704,336 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\QtGui4.dll

MOD - [2009/06/02 08:58:38 | 000,968,976 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\QtNetwork4.dll

MOD - [2009/06/02 08:58:26 | 002,140,944 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\QtCore4.dll

MOD - [2009/06/02 08:58:16 | 000,291,600 | ---- | M] () -- C:\Program Files\Logicool\Logicool Vid\phonon4.dll

MOD - [2008/07/19 16:02:52 | 000,086,016 | ---- | M] () -- C:\WINDOWS\system32\custmon32.dll

MOD - [2008/04/14 08:00:00 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

MOD - [2008/04/14 08:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

MOD - [2007/07/23 16:04:46 | 000,068,080 | ---- | M] () -- C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe -- (Amsp)

SRV - [2012/03/14 17:38:14 | 000,913,752 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)

SRV - [2011/06/01 14:10:00 | 000,821,080 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe -- (IMFservice)

SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2009/12/03 17:52:32 | 001,980,560 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto | Running] -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe -- (CarboniteService)

SRV - [2009/10/01 21:31:48 | 000,116,032 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\ramaint.exe -- (LMIMaint)

SRV - [2009/04/30 16:01:10 | 000,150,040 | ---- | M] (Logicool Co., Ltd) [Auto | Running] -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)

SRV - [2009/04/24 16:48:25 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2008/07/24 18:46:10 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)

SRV - [2008/06/09 11:37:44 | 000,053,392 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)

SRV - [2008/01/11 17:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\Rochel\LOCALS~1\Temp\mbr.sys -- (mbr)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\Rochel\LOCALS~1\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | Boot | Stopped] -- -- (bhyylicz)

DRV - [2012/03/29 20:46:34 | 000,205,072 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)

DRV - [2012/03/29 20:46:34 | 000,092,432 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tmtdi.sys -- (tmtdi)

DRV - [2012/03/29 20:46:34 | 000,081,168 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tmactmon.sys -- (tmactmon)

DRV - [2012/03/29 20:46:34 | 000,068,368 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tmevtmgr.sys -- (tmevtmgr)

DRV - [2011/02/23 17:04:32 | 000,013,496 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)

DRV - [2010/07/09 16:34:44 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tbhsd.sys -- (tbhsd)

DRV - [2010/07/09 16:34:36 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rrnetcap.sys -- (RRNetCapMP)

DRV - [2010/07/09 16:34:36 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rrnetcap.sys -- (RRNetCap)

DRV - [2009/10/01 21:31:40 | 000,083,288 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)

DRV - [2009/05/13 12:41:02 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscemdm.sys -- (sscemdm)

DRV - [2009/05/13 12:41:02 | 000,090,240 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)

DRV - [2009/05/13 12:41:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscemdfl.sys -- (sscemdfl)

DRV - [2009/04/30 22:55:58 | 002,686,872 | ---- | M] (Logicool Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)

DRV - [2009/04/30 16:00:24 | 000,024,984 | ---- | M] (Logicool Co., Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)

DRV - [2008/07/24 18:46:12 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)

DRV - [2008/07/24 18:46:10 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)

DRV - [2008/07/16 00:03:18 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\k57xp32.sys -- (k57w2k) Broadcom NetLink

DRV - [2008/07/15 23:40:58 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)

DRV - [2007/07/23 16:05:20 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLADResM.SYS -- (DLADResM)

DRV - [2007/07/23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS -- (DLABMFSM)

DRV - [2007/07/23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)

DRV - [2007/07/23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)

DRV - [2007/07/23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)

DRV - [2007/07/23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS -- (DLABOIOM)

DRV - [2007/07/23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS -- (DLAPoolM)

DRV - [2007/07/23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)

DRV - [2007/07/23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)

DRV - [2007/07/23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1

IE - HKLM\..\SearchScopes,DefaultScope = {F8305D7D-CF69-465a-9003-813C6013A702}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKLM\..\SearchScopes\{F8305D7D-CF69-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/result.php?cx=partner-pub-5087362176467115:lyglkqaff6i&cof=FORID:10&ie=ISO-8859-1&sa=Search&q={searchTerms}

IE - HKLM\..\SearchScopes\{F8305D7D-CF79-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/result.php?cx=partner-pub-5087362176467115:h6z8ss-efx2&cof=FORID:10&ie=ISO-8859-1&sa=Search&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://chabadnc.org/

IE - HKCU\..\SearchScopes,DefaultScope = {7D25A8ED-6A9F-4ADB-ACE0-F2F75D1F165B}

IE - HKCU\..\SearchScopes\{7D25A8ED-6A9F-4ADB-ACE0-F2F75D1F165B}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: LogMeInClient@logmein.com:1.0.0.586

FF - prefs.js..extensions.enabledItems: {e3f6c2cc-d8db-498c-af6c-499fb211db97}:1.10.2

FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2

FF - prefs.js..extensions.enabledItems: gmail_sigs@blankcanvasweb.com:1.16.1b

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.91

FF - prefs.js..extensions.enabledItems: {6614d11d-d21d-b211-ae23-815234e1ebb5}:1.0.23

FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.91: C:\Program Files\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@TrendMicro.com/FFExtension: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@spoon.net/Spoon Plugin 3.32: C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\npMozillaSpoonPlugin.dll (Code Systems Corporation)

FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\Rochel\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)

FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\Rochel\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll File not found

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{38783831-6098-4faa-A9C9-1EE1E343F4D2}: C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\firefoxextension [2012/03/29 21:34:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2012/03/29 20:56:07 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\ [2012/03/29 21:35:08 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/21 18:42:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/03/23 12:49:57 | 000,000,000 | ---D | M]

[2009/04/23 23:44:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Extensions

[2012/03/26 08:08:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions

[2010/05/06 14:16:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/05/06 14:16:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}-trash

[2011/07/24 11:21:12 | 000,000,000 | ---D | M] (Somoto Toolbar) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\{652853ad-5592-4231-88c6-706613a52e61}

[2012/03/26 08:08:09 | 000,000,000 | ---D | M] (Page Speed) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}

[2010/06/24 00:42:00 | 000,000,000 | ---D | M] (FatWallet Tools) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\fatcash@fatwallet.com

[2010/03/12 15:58:44 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\LogMeInClient@logmein.com

[2011/04/29 13:19:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\nostmp

[2011/03/28 19:22:10 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\personas@christopher.beard

[2010/07/19 18:00:48 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\support@predictad.com

[2012/03/26 08:08:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rochel\Application Data\Mozilla\Firefox\Profiles\foef8ybj.default\extensions\trash

[2012/01/01 21:08:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

() (No name found) -- C:\DOCUMENTS AND SETTINGS\ROCHEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\FOEF8YBJ.DEFAULT\EXTENSIONS\{65E41D20-F092-41B7-BB83-C6E8A9AB0F57}.XPI

() (No name found) -- C:\DOCUMENTS AND SETTINGS\ROCHEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\FOEF8YBJ.DEFAULT\EXTENSIONS\{6614D11D-D21D-B211-AE23-815234E1EBB5}.XPI

() (No name found) -- C:\DOCUMENTS AND SETTINGS\ROCHEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\FOEF8YBJ.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

[2012/03/21 18:42:30 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012/02/20 12:27:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/02/20 12:27:50 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\17.0.963.83\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\17.0.963.83\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\Application\17.0.963.83\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Rochel\Application Data\Mozilla\plugins\npgoogletalk.dll

CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Rochel\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Platform SE 6 U14 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Java Deployment Toolkit 6.0.140.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: getPlusPlus for Adobe 16291 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np_gp.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll

CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll

CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: Spoon Plugin (Enabled) = C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\npMozillaSpoonPlugin.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll

CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Firebug Lite for Google Chrome\u2122 = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench\1.4.0.11967_0\

CHR - Extension: TrendMicro Toolbar = C:\Documents and Settings\Rochel\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj\5.2.0.1035_0\

O1 HOSTS File: ([2012/03/31 22:22:23 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll (Trend Micro Inc.)

O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.

O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.

O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Video Download Toolbar Intercept) - {B29002A0-87A1-4DC4-AC55-5982034EB61E} - C:\Program Files\VideoDownloadToolbar\VideoDownloadToolbarIntercept.dll (Sakysoft s.r.l. uninominale)

O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll (Trend Micro Inc.)

O3 - HKLM\..\Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2B171655-A70C-5C18-B693-6CB5DC269D41} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.

O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found

O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)

O4 - HKCU..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)

O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Documents and Settings\Rochel\Local Settings\Application Data\Akamai\netsession_win.exe (Akamai Technologies, Inc)

O4 - HKCU..\Run: [Logicool Vid] C:\Program Files\Logicool\Logicool Vid\vid.exe (Logicool Co., Ltd)

O4 - Startup: C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\CNET TechTracker.lnk = C:\Documents and Settings\Rochel\Application Data\CBS Interactive\CNET TechTracker\TechTracker.exe ()

O4 - Startup: C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe (Southwest Airlines)

O4 - Startup: C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Rochel\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\MamaBargains.lnk = C:\Program Files\MamaBargains\MamaBargains\MamaBargains.exe ()

O4 - Startup: C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\Spoon Sandbox Manager 3.32.lnk = C:\Documents and Settings\Rochel\Local Settings\Application Data\Spoon\3.32.2.12\Spoon-Sandbox-Native.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BD92DCD7-91FF-45DA-A8C2-724596A291F2}: DhcpNameServer = 192.168.1.254

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/04/25 17:29:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

ActiveX: {8A1AD540-DEA7-C34D-5DE8-81DFBB3BB0D2} - Internet Explorer

ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

ActiveX: {8FF315A8-BB70-6141-9204-18040C39E700} - Browser Customizations

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider

ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -

ActiveX: {B55E267B-4F86-930D-DCB4-FF690BF0259C} - Microsoft Windows Media Player

ActiveX: {BB9C99C7-FFFE-3E43-2401-112C4D9599BC} - Vector Graphics Rendering (VML)

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: Microsoft Base Smart Card Crypto Provider Package -

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpFolder: C:^Documents and Settings^Rochel^Start Menu^Programs^Startup^ACTPrinter Win.exe.lnk - C:\Documents and Settings\Rochel\Application Data\Microsoft\Installer\{8048F8E1-4A09-4EE8-BC72-01B49B999CE4}\_ACF4DAA81DB585838F4CFA.exe - ()

MsConfig - StartUpReg: avast - hkey= - key= - File not found

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 0

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/01 19:47:59 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Rochel\Desktop\OTL.exe

[2012/03/31 22:25:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\XSxS

[2012/03/31 21:47:09 | 004,452,445 | R--- | C] (Swearware) -- C:\Documents and Settings\Rochel\Desktop\ComboFix.exe

[2012/03/30 13:10:56 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Rochel\Start Menu\Programs\Administrative Tools

[2012/03/30 13:10:16 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Rochel\Desktop\dds.com

[2012/03/29 22:06:09 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2

[2012/03/29 22:04:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF

[2012/03/29 22:04:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles

[2012/03/29 22:02:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\PrimoPDF

[2012/03/29 20:57:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rochel\Start Menu\Programs\Trend Micro Titanium Maximum Security 2012

[2012/03/29 20:56:51 | 000,092,432 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmtdi.sys

[2012/03/29 20:56:46 | 000,205,072 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys

[2012/03/29 20:56:46 | 000,081,168 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmactmon.sys

[2012/03/29 20:56:46 | 000,068,368 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmevtmgr.sys

[2012/03/29 20:46:00 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2012/03/29 20:06:35 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine

[2012/03/29 18:01:03 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2012/03/29 15:11:58 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2012/03/29 15:11:58 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2012/03/29 15:11:58 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2012/03/29 15:11:58 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2012/03/29 15:10:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2012/03/29 14:27:56 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/03/29 10:33:48 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC

[2012/03/28 22:40:29 | 000,000,000 | ---D | C] -- C:\Config.Msi

[2012/03/27 19:42:49 | 000,000,000 | ---D | C] -- C:\temp

[2012/03/27 16:12:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Trend Micro

[2012/03/27 16:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Trend Micro

[2012/03/27 16:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Trend Micro

[2012/03/27 15:36:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Akamai

[2012/01/31 17:53:03 | 032,853,760 | ---- | C] (Code Systems Corporation) -- C:\Program Files\spoon-plugin-dotnet.exe

[2012/01/01 20:47:30 | 015,292,208 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 9.0.1.exe

[2011/08/18 23:14:15 | 003,089,056 | ---- | C] (Adobe Systems, Inc.) -- C:\Program Files\install_flash_player.exe

[2011/07/24 12:05:28 | 065,981,368 | ---- | C] (Online Media Technologies Ltd. ) -- C:\Program Files\AVSVideoConverter.exe

[2011/07/24 11:17:19 | 006,062,368 | ---- | C] (Sakysoft s.r.l. uninominale ) -- C:\Program Files\video-download-toolbar-setup.exe

[2011/07/24 10:40:23 | 008,532,623 | ---- | C] (GetFLV, Inc. ) -- C:\Program Files\gfsetup.exe

[2011/07/17 15:07:24 | 014,276,088 | ---- | C] (Google Inc.) -- C:\Program Files\picasa38-setup.exe

[2011/06/14 21:45:59 | 004,117,040 | ---- | C] (CBS Interactive) -- C:\Program Files\CNET_TechTracker_2_0_3_59_a_Setup.exe

[2011/05/25 18:59:37 | 030,459,048 | ---- | C] (IObit ) -- C:\Program Files\asc4-setup-cnet.exe

[2011/04/29 13:05:23 | 012,521,992 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 4.0.1.exe

[2011/04/06 13:52:03 | 080,298,280 | ---- | C] (Apple Inc.) -- C:\Program Files\iTunesSetup.exe

[2010/11/14 00:01:39 | 002,443,360 | ---- | C] (http://www.divine-project.com/ ) -- C:\Program Files\divine-setup.exe

[2010/10/04 14:26:50 | 000,947,592 | ---- | C] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup.exe

[2010/09/15 18:38:50 | 007,633,259 | ---- | C] (FocusSoft.net ) -- C:\Program Files\fmcjsetup.exe

[2010/09/15 18:31:00 | 004,585,944 | ---- | C] (ManiacTools.com ) -- C:\Program Files\mp3-splitter-joiner.exe

[2010/07/26 15:31:14 | 030,218,224 | ---- | C] (IObit ) -- C:\Program Files\asc-setup.exe

[2010/07/25 23:59:19 | 001,155,635 | ---- | C] (ESCV ) -- C:\Program Files\EasyScreenCaptureVideo.exe

[2010/07/20 22:38:11 | 000,689,560 | ---- | C] (IObit) -- C:\Program Files\iobituninstaller.exe

[2010/07/19 17:58:47 | 002,411,072 | ---- | C] (CooolSoft, Inc. ) -- C:\Program Files\MP3Cutter.EXE

[2010/07/19 16:48:47 | 038,084,600 | ---- | C] (RapidSolution Software AG) -- C:\Program Files\tunebite.exe

[2010/06/24 14:31:54 | 008,587,672 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 3.6.4.exe

[2010/06/22 14:40:45 | 032,532,792 | ---- | C] (Apple Inc.) -- C:\Program Files\SafariSetup.exe

[2010/05/06 16:35:19 | 000,562,864 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleVoiceAndVideoSetup.exe

[2010/04/18 23:01:07 | 000,562,848 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe

[2010/04/16 17:47:31 | 004,071,176 | ---- | C] (Uniblue Systems Ltd ) -- C:\Program Files\registrybooster.exe

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/01 19:47:55 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rochel\Desktop\OTL.exe

[2012/04/01 19:43:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2136418324-59859425-3307268990-1005UA.job

[2012/04/01 19:12:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012/04/01 19:12:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012/04/01 09:43:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2136418324-59859425-3307268990-1005Core.job

[2012/04/01 02:00:00 | 000,000,344 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-ROCHELHOMEPC-Rochel.job

[2012/03/31 22:26:08 | 000,000,795 | ---- | M] () -- C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\MamaBargains.lnk

[2012/03/31 22:24:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/03/31 22:22:23 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2012/03/31 22:21:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/03/31 21:46:01 | 000,002,273 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2012/03/31 21:46:00 | 000,002,295 | ---- | M] () -- C:\Documents and Settings\Rochel\Desktop\Google Chrome.lnk

[2012/03/31 21:39:54 | 004,452,445 | R--- | M] (Swearware) -- C:\Documents and Settings\Rochel\Desktop\ComboFix.exe

[2012/03/31 21:31:19 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012/03/31 21:30:10 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DB9CE760-98C7-41EB-8CB1-36819FB4AEC5}.job

[2012/03/30 13:10:08 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Rochel\Desktop\dds.com

[2012/03/29 22:07:21 | 000,000,927 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Uninstaller.lnk

[2012/03/29 22:07:20 | 000,000,876 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare 5.lnk

[2012/03/29 22:07:19 | 000,000,894 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced SystemCare 5.lnk

[2012/03/29 22:06:29 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk

[2012/03/29 22:06:29 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\Rochel\Desktop\Windows Media Player.lnk

[2012/03/29 22:06:27 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb

[2012/03/29 22:06:27 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb

[2012/03/29 22:04:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf

[2012/03/29 22:02:57 | 000,000,806 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\PrimoPDF - Drop Files Here to Convert!.lnk

[2012/03/29 22:02:19 | 000,000,314 | ---- | M] () -- C:\WINDOWS\primopdf.ini

[2012/03/29 20:57:43 | 000,000,934 | ---- | M] () -- C:\Documents and Settings\Rochel\Desktop\Trend Micro Titanium Maximum Security 2012.lnk

[2012/03/29 20:56:44 | 000,525,700 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012/03/29 20:56:44 | 000,102,070 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012/03/29 20:55:31 | 000,000,056 | ---- | M] () -- C:\WINDOWS\System32\SupportTool.exe.bat

[2012/03/29 20:46:34 | 000,205,072 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys

[2012/03/29 20:46:34 | 000,092,432 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmtdi.sys

[2012/03/29 20:46:34 | 000,081,168 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmactmon.sys

[2012/03/29 20:46:34 | 000,068,368 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmevtmgr.sys

[2012/03/29 18:01:20 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2012/03/29 17:47:53 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2012/03/29 14:36:10 | 000,000,934 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\Microsoft\Internet Explorer\Quick Launch\Trend Micro Titanium Maximum Security 2012 (2).lnk

[2012/03/29 10:04:52 | 000,644,658 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB

[2012/03/27 22:06:44 | 000,000,452 | ---- | M] () -- C:\Documents and Settings\Rochel\My Documents\spider.sav

[2012/03/27 15:54:07 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2012/03/27 12:51:23 | 000,001,017 | ---- | M] () -- C:\Documents and Settings\Rochel\Start Menu\Programs\Startup\Dropbox.lnk

[2012/03/27 12:51:23 | 000,001,017 | ---- | M] () -- C:\Documents and Settings\Rochel\Desktop\Dropbox.lnk

[2012/03/25 20:08:05 | 000,000,132 | ---- | M] () -- C:\Documents and Settings\Rochel\Application Data\Adobe PNG Format CS5 Prefs

[2012/03/23 12:49:58 | 000,001,736 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk

[2012/03/14 09:55:14 | 003,977,000 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/03/04 02:35:42 | 000,001,456 | ---- | M] () -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/29 22:04:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf

[2012/03/29 22:04:51 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2012/03/29 22:02:57 | 000,000,806 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\PrimoPDF - Drop Files Here to Convert!.lnk

[2012/03/29 20:57:42 | 000,000,934 | ---- | C] () -- C:\Documents and Settings\Rochel\Desktop\Trend Micro Titanium Maximum Security 2012.lnk

[2012/03/29 18:01:18 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2012/03/29 18:01:06 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2012/03/29 15:11:58 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2012/03/29 15:11:58 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2012/03/29 15:11:58 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2012/03/29 15:11:58 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2012/03/29 15:11:58 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2012/03/29 14:36:10 | 000,000,934 | ---- | C] () -- C:\Documents and Settings\Rochel\Application Data\Microsoft\Internet Explorer\Quick Launch\Trend Micro Titanium Maximum Security 2012 (2).lnk

[2012/03/28 15:54:26 | 000,644,658 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB

[2012/03/27 16:10:44 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\SupportTool.exe.bat

[2012/03/23 12:49:58 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk

[2012/03/23 12:49:58 | 000,001,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk

[2012/02/26 10:32:22 | 000,000,326 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\PrimoPDFSet.xml

[2012/02/16 01:30:25 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012/02/02 00:40:22 | 000,538,200 | ---- | C] () -- C:\Program Files\smartdraw_11E_QDO56_setup.exe

[2011/12/12 00:14:45 | 064,207,032 | ---- | C] () -- C:\Program Files\setup_av_free_cnet.exe

[2011/12/08 16:55:10 | 000,000,108 | ---- | C] () -- C:\Program Files\hirtcamp.com

[2011/12/01 14:17:43 | 000,143,768 | ---- | C] () -- C:\Program Files\MamabargainsAir.air

[2011/07/24 11:08:49 | 000,858,940 | ---- | C] () -- C:\Program Files\toolbar_setup411.exe

[2011/07/24 11:02:39 | 005,153,792 | ---- | C] () -- C:\Program Files\YouTubeDownloaderSetup32.exe

[2011/06/16 19:05:50 | 000,001,456 | ---- | C] () -- C:\Documents and Settings\Rochel\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs

[2011/06/14 21:55:27 | 000,029,520 | ---- | C] () -- C:\WINDOWS\System32\SmartDefragBootTime.exe

[2011/06/14 21:55:26 | 000,013,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\SmartDefragDriver.sys

[2011/06/07 11:14:25 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Rochel\Application Data\Adobe IllExport Filter CS5 Prefs

[2011/06/06 00:18:58 | 000,109,712 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/05/29 17:49:59 | 056,923,744 | ---- | C] () -- C:\Program Files\setup_av_free.exe

[2011/05/15 20:24:33 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Rochel\Application Data\Adobe PNG Format CS5 Prefs

[2011/05/13 11:43:19 | 002,431,520 | ---- | C] () -- C:\Program Files\AdobeDownloadAssistant.exe

[2011/04/11 20:47:58 | 051,349,520 | ---- | C] () -- C:\Program Files\avira_antivir_personal_en.exe

[2011/02/10 00:03:48 | 000,000,314 | ---- | C] () -- C:\WINDOWS\primopdf.ini

[2010/11/23 16:47:36 | 013,525,424 | ---- | C] () -- C:\Program Files\Dropbox 0.7.110.exe

[2010/11/14 00:35:02 | 006,780,771 | ---- | C] () -- C:\Program Files\beta-docs.chm

[2010/10/04 14:30:26 | 000,000,048 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2010/09/28 11:41:58 | 000,225,672 | ---- | C] () -- C:\Program Files\CrucialScan.exe

[2010/09/26 20:59:02 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\custmon32.dll

[2010/09/26 20:53:45 | 000,469,504 | ---- | C] () -- C:\Program Files\ACTPrinterSetup.exe

[2010/09/15 18:40:53 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

[2010/07/22 14:21:58 | 000,000,668 | ---- | C] () -- C:\WINDOWS\Mp3CutterJoiner.ini

[2010/07/20 22:46:21 | 000,000,005 | ---- | C] () -- C:\WINDOWS\System32\SySMP3CutJoin.dat

[2010/07/20 22:41:47 | 003,087,086 | ---- | C] ( ) -- C:\Program Files\mp3cutterjoiner.exe

[2010/06/07 08:37:13 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8f4VCiqmw.dat

[2010/04/18 22:08:52 | 000,529,800 | ---- | C] () -- C:\Program Files\smartdraw_10E_H3HE9_A_setup.exe

========== LOP Check ==========

[2010/06/16 19:59:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[2012/03/28 22:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software

[2010/06/16 20:38:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2010/01/09 23:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Carbonite

[2010/11/14 00:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Divine

[2009/07/28 00:16:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreeRIP

[2009/11/01 20:58:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GlobalSCAPE

[2010/02/23 14:11:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterVideo

[2011/12/07 12:04:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit

[2009/05/12 22:26:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn

[2011/05/25 19:00:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Quark

[2010/07/19 17:31:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidSolution

[2012/01/04 12:14:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2010/02/23 14:11:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc

[2010/02/24 13:45:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems

[2010/05/31 01:06:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Update

[2009/09/22 02:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visan

[2011/04/06 14:09:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/09/26 21:04:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\ACTPrinter

[2011/11/17 14:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Blackboard

[2011/06/14 21:48:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\CBS Interactive

[2011/05/17 20:12:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2009/10/13 14:55:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\CheckPoint

[2009/10/22 21:13:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\CoffeeCup Software

[2011/11/17 13:16:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Collaborate

[2011/05/13 11:48:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant

[2011/06/06 00:39:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

[2011/06/19 22:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\com.dwuser.erwizard.EasyRotatorWizard

[2011/08/19 16:49:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1

[2011/02/23 15:37:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Divine

[2012/03/31 22:26:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Dropbox

[2010/10/20 14:23:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Elluminate

[2010/05/31 01:11:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\FE0E3AD4F82198DD9A575A296B182636

[2010/09/15 18:41:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Focus Mp3 Cutter Joiner

[2011/07/24 11:09:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\FVDIEPlugin

[2009/04/29 12:37:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\GetRightToGo

[2009/11/01 20:46:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\GlobalSCAPE

[2011/12/02 10:36:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\index.htm.MamaBargains

[2012/02/02 01:50:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\IObit

[2009/10/30 14:10:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Littlelan

[2010/09/15 23:49:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Power MP3 Cutter

[2010/07/19 18:00:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Power Mp3 Recorder

[2009/11/05 04:46:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Quark

[2011/04/11 20:48:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Sammsoft

[2010/02/21 22:41:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Samsung

[2012/02/02 00:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\SmartDraw

[2011/07/24 11:22:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\somototoolbar

[2009/04/24 09:27:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Southwest Airlines

[2011/06/04 23:58:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2011/09/12 14:22:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\TeamViewer

[2010/02/24 13:45:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Ulead Systems

[2010/04/16 17:52:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Uniblue

[2011/07/24 11:21:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\vmntemplate

[2009/04/16 04:11:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Windows Desktop Search

[2009/04/23 21:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rochel\Application Data\Windows Search

[2012/03/31 21:30:10 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{DB9CE760-98C7-41EB-8CB1-36819FB4AEC5}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >

[2012/03/29 20:06:35 | 000,000,000 | ---D | M] -- C:\boot

[2012/03/29 18:01:16 | 000,000,000 | RHSD | M] -- C:\cmdcons

[2012/03/29 20:54:39 | 000,000,000 | ---D | M] -- C:\Config.Msi

[2009/08/22 03:03:45 | 000,000,000 | ---D | M] -- C:\d0cdb53f1a2fb505c5

[2009/04/24 13:50:09 | 000,000,000 | ---D | M] -- C:\DELL

[2009/05/14 11:37:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings

[2009/04/16 11:02:13 | 000,000,000 | ---D | M] -- C:\drivers

[2009/02/25 13:03:48 | 000,000,000 | ---D | M] -- C:\EFI

[2009/08/06 20:33:27 | 000,000,000 | ---D | M] -- C:\Hasbro

[2009/04/16 04:09:56 | 000,000,000 | ---D | M] -- C:\I386

[2009/04/29 12:11:09 | 000,000,000 | R--D | M] -- C:\MSOCache

[2010/09/14 16:23:57 | 000,000,000 | ---D | M] -- C:\My Music

[2012/03/31 22:19:26 | 000,000,000 | R--D | M] -- C:\Program Files

[2012/03/31 22:31:42 | 000,000,000 | ---D | M] -- C:\Qoobox

[2010/02/23 14:12:29 | 000,000,000 | ---D | M] -- C:\SmartSound Software

[2012/03/29 14:54:16 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012/03/29 20:06:35 | 000,000,000 | ---D | M] -- C:\TDSSKiller_Quarantine

[2012/03/27 19:42:49 | 000,000,000 | ---D | M] -- C:\temp

[2012/03/31 22:25:17 | 000,000,000 | ---D | M] -- C:\WINDOWS

[2010/07/07 16:16:54 | 000,000,000 | ---D | M] -- C:\_AcroTemp

< %PROGRAMFILES%\*.exe >

[2010/02/21 22:35:11 | 082,452,960 | ---- | M] (Samsung Electronics Co., Ltd. ) -- C:\Program Files\a897_PCStudio.exe

[2009/04/24 16:33:09 | 342,437,920 | ---- | M] ( ) -- C:\Program Files\AcroPro90_efg.exe

[2010/09/26 20:53:46 | 000,469,504 | ---- | M] () -- C:\Program Files\ACTPrinterSetup.exe

[2009/04/24 16:49:12 | 001,878,888 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe Acrobat 9 Pro.lnk.exe

[2011/05/13 11:48:06 | 002,431,520 | ---- | M] () -- C:\Program Files\AdobeDownloadAssistant.exe

[2010/01/07 23:20:15 | 011,029,387 | ---- | M] (AoAMedia.com ) -- C:\Program Files\aoaaudioextractor.exe

[2012/01/22 14:42:08 | 030,218,224 | ---- | M] (IObit ) -- C:\Program Files\asc-setup.exe

[2011/05/25 19:03:06 | 030,459,048 | ---- | M] (IObit ) -- C:\Program Files\asc4-setup-cnet.exe

[2011/04/11 20:54:39 | 051,349,520 | ---- | M] () -- C:\Program Files\avira_antivir_personal_en.exe

[2011/07/24 12:14:49 | 065,981,368 | ---- | M] (Online Media Technologies Ltd. ) -- C:\Program Files\AVSVideoConverter.exe

[2011/06/14 21:46:53 | 004,117,040 | ---- | M] (CBS Interactive) -- C:\Program Files\CNET_TechTracker_2_0_3_59_a_Setup.exe

[2009/10/22 21:01:31 | 007,492,592 | ---- | M] (BitRock SL) -- C:\Program Files\CoffeeFreeFTPInstaller4.2.exe

[2010/09/28 11:42:01 | 000,225,672 | ---- | M] () -- C:\Program Files\CrucialScan.exe

[2009/11/01 20:40:48 | 021,785,928 | ---- | M] (GlobalSCAPE, Inc. ) -- C:\Program Files\cuteftppro.exe

[2009/12/02 14:38:58 | 006,599,680 | ---- | M] () -- C:\Program Files\DingInstall-1.05.exe

[2010/11/14 00:02:39 | 002,443,360 | ---- | M] (http://www.divine-project.com/ ) -- C:\Program Files\divine-setup.exe

[2010/11/23 16:48:32 | 013,525,424 | ---- | M] () -- C:\Program Files\Dropbox 0.7.110.exe

[2004/05/24 23:01:46 | 001,155,635 | ---- | M] (ESCV ) -- C:\Program Files\EasyScreenCaptureVideo.exe

[2010/06/24 14:32:11 | 008,587,672 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 3.6.4.exe

[2011/04/29 13:06:26 | 012,521,992 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 4.0.1.exe

[2012/01/01 20:51:06 | 015,292,208 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 9.0.1.exe

[2010/09/15 18:39:25 | 007,633,259 | ---- | M] (FocusSoft.net ) -- C:\Program Files\fmcjsetup.exe

[2009/07/28 00:05:17 | 001,876,292 | ---- | M] (MGShareware ) -- C:\Program Files\freeripmp3.exe

[2009/07/23 11:26:02 | 007,858,801 | ---- | M] () -- C:\Program Files\Freeware_PrimoPDF.exe

[2011/07/24 10:40:59 | 008,532,623 | ---- | M] (GetFLV, Inc. ) -- C:\Program Files\gfsetup.exe

[2010/04/18 23:01:09 | 000,562,848 | ---- | M] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe

[2010/05/06 16:35:21 | 000,562,864 | ---- | M] (Google Inc.) -- C:\Program Files\GoogleVoiceAndVideoSetup.exe

[2009/04/30 19:14:45 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\Program Files\IE8-WindowsXP-x86-ENU.exe

[2011/08/19 11:16:26 | 003,089,056 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\install_flash_player.exe

[2010/07/20 22:38:11 | 000,689,560 | ---- | M] (IObit) -- C:\Program Files\iobituninstaller.exe

[2011/04/06 13:58:21 | 080,298,280 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunesSetup.exe

[2009/04/29 13:04:51 | 002,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Program Files\mbam-setup.exe

[2010/09/15 18:31:20 | 004,585,944 | ---- | M] (ManiacTools.com ) -- C:\Program Files\mp3-splitter-joiner.exe

[2010/07/19 17:59:01 | 002,411,072 | ---- | M] (CooolSoft, Inc. ) -- C:\Program Files\MP3Cutter.EXE

[2010/07/20 22:42:10 | 003,087,086 | ---- | M] ( ) -- C:\Program Files\mp3cutterjoiner.exe

[2010/09/15 01:02:32 | 002,007,072 | ---- | M] (Piston Software ) -- C:\Program Files\mp3joiner_setup.exe

[2009/10/30 14:03:32 | 001,505,049 | ---- | M] (LittleLan.com ) -- C:\Program Files\Mp3nity_2.1_Setup.exe

[2011/07/17 15:08:28 | 014,276,088 | ---- | M] (Google Inc.) -- C:\Program Files\picasa38-setup.exe

[2009/07/08 15:02:41 | 021,935,408 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe

[2010/04/16 17:47:38 | 004,071,176 | ---- | M] (Uniblue Systems Ltd ) -- C:\Program Files\registrybooster.exe

[2010/06/22 14:43:31 | 032,532,792 | ---- | M] (Apple Inc.) -- C:\Program Files\SafariSetup.exe

[2011/05/29 17:55:13 | 056,923,744 | ---- | M] () -- C:\Program Files\setup_av_free.exe

[2011/12/12 00:22:42 | 064,207,032 | ---- | M] () -- C:\Program Files\setup_av_free_cnet.exe

[2009/07/27 22:57:43 | 012,154,344 | ---- | M] (SmartSoft Ltd) -- C:\Program Files\SFTPMSI.exe

[2009/09/08 13:35:07 | 004,938,616 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Silverlight.exe

[2010/10/04 14:26:50 | 000,947,592 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup.exe

[2010/04/18 22:08:54 | 000,529,800 | ---- | M] () -- C:\Program Files\smartdraw_10E_H3HE9_A_setup.exe

[2012/02/02 00:40:23 | 000,538,200 | ---- | M] () -- C:\Program Files\smartdraw_11E_QDO56_setup.exe

[2012/01/31 17:57:00 | 032,853,760 | ---- | M] (Code Systems Corporation) -- C:\Program Files\spoon-plugin-dotnet.exe

[2009/07/27 23:51:46 | 002,693,610 | ---- | M] (Naturpic Software ) -- C:\Program Files\swmsetup.exe

[2011/07/24 11:08:49 | 000,858,940 | ---- | M] () -- C:\Program Files\toolbar_setup411.exe

[2010/07/19 16:52:01 | 038,084,600 | ---- | M] (RapidSolution Software AG) -- C:\Program Files\tunebite.exe

[2011/07/24 11:17:47 | 006,062,368 | ---- | M] (Sakysoft s.r.l. uninominale ) -- C:\Program Files\video-download-toolbar-setup.exe

[2009/07/10 12:46:12 | 001,234,120 | ---- | M] () -- C:\Program Files\wrar380.exe

[2009/07/17 12:37:23 | 003,654,395 | ---- | M] (Spacejock Software ) -- C:\Program Files\ybkfull.exe

[2011/07/24 11:02:39 | 005,153,792 | ---- | M] () -- C:\Program Files\YouTubeDownloaderSetup32.exe

Invalid Environment Variable: LOCALAPPDATA

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.manifest /3 >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< MD5 for: EXPLORER.EXE >

[2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe

[2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe

< MD5 for: I8042PRT.SYS >

[2008/04/14 08:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\I386\sp3.cab:i8042prt.sys

[2008/04/14 08:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:i8042prt.sys

< MD5 for: REGEDIT.EXE >

[2008/04/14 08:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) MD5=058710B720282CA82B909912D3EF28DB -- C:\I386\REGEDIT.EXE

[2008/04/14 08:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) MD5=058710B720282CA82B909912D3EF28DB -- C:\WINDOWS\ERDNT\cache\regedit.exe

[2008/04/14 08:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) MD5=058710B720282CA82B909912D3EF28DB -- C:\WINDOWS\regedit.exe

< MD5 for: USERINIT.EXE >

[2008/04/14 08:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe

[2008/04/14 08:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >

[2008/04/14 08:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe

[2008/04/14 08:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2012/02/03 05:26:17 | 001,869,184 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-04-01 01:32:04

< End of report >

Fcvolunteer · April 2, 2012

OTL Extras logfile created on: 4/1/2012 7:54:04 PM - Run 1