computer slowing, IE not responding

blinken · June 30, 2012

One of my staff came to me saying his laptop was asking for credit card details from websites that dont usually require verification and that Internet explorer and frefox were both unresponsive in general. DDS logs attached. please help

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32

Run by TBC MB 02 at 16:12:27 on 2012-06-30

Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1811 [GMT 9.5:30]

.

AV: McAfee® Total Protection™ Service *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee® Total Protection™ Service *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee® Security-as-a-Service *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Acer Bio Protection\CompPtcVUI.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files\Common Files\Citrix\System32\CdfSvc.exe

C:\Program Files\Launch Manager\dsiwmis.exe

C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe

C:\Program Files\Acer\Registration\GregHSRW.exe

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Acer Bio Protection\BASVC.exe

C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Windows\system32\mfevtps.exe

C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\Citrix\Streaming Client\RadeSvc.exe

C:\Program Files\Acer\Acer VCM\RS_Service.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe

C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfeann.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\PrintIsolationHost.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Launch Manager\LManager.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe

C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

C:\Program Files\BigPond News Ticker\BigPond__News_Ticker.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\OEM\RunCmd.exe

C:\Program Files\Acer Bio Protection\PdtWzd.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Windows\PLFSetI.exe

C:\Program Files\Microsoft Online Services\Sign In\SignIn.exe

C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\igfxpers.exe

c:\windows\system32\oem\setEvent.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\HP\HP Software Update\hpwuschd2.exe

C:\Program Files\Telstra\Mobile Broadband Manager\TelstraUCM.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\TrustedNet Connect 2.1\TNCTray.exe

C:\Program Files\NetComm\Connection Manager\ConnectionManager.exe

C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

C:\Program Files\TrustedNet Connect 2.1\tncservice.exe

C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe

C:\Windows\system32\conhost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Acer\Acer VCM\AcerVCM.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe

C:\Windows\system32\igfxext.exe

C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe

C:\Windows\system32\DllHost.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exe

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx

uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&m=aspire_4810t&r=27360909b006l03e8zq05t47l1s14p

mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956

uInternet Settings,ProxyOverride = 192.168.*.*;*.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110926074541.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll"

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [Google Update] "c:\users\tbc mb 02\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [TrustedNet Connect 2.x] "c:\program files\trustednet connect 2.1\TNCTray.exe"

uRun: [Telstra Connection Manager] c:\program files\netcomm\connection manager\ConnectionManager.exe

uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray

uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe

mRun: [LManager] c:\program files\launch manager\LManager.exe

mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

mRun: [ODDPwr] "c:\program files\acer\optical drive power management\ODDPwr.exe"

mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe

mRun: [backupManagerTray] "c:\program files\newtech infosystems\acer backup manager\BackupManagerTray.exe" -h -k

mRun: [NortonOnlineBackupReminder] "c:\program files\symantec\norton online backup\activation\NobuActivation.exe" UNATTENDED

mRun: [bigPond News Ticker] "c:\program files\bigpond news ticker\BigPond__News_Ticker.exe"

mRun: [PLD_FrameworkRun] c:\windows\system32\oem\runcmd.exe c:\windows\system32\oem\OKTOLaunch_PLD_Framework.cmd

mRun: [VitaKeyPdtWzd] "c:\program files\acer bio protection\PdtWzd.exe"

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe

mRun: [PLFSetI] c:\windows\PLFSetI.exe

mRun: [signIn] "c:\program files\microsoft online services\sign in\SignIn.exe" /autorun

mRun: [MVS Splash] "c:\program files\mcafee\managed virusscan\desktopui\XTray.exe"

mRun: [XeroxRegistation] "c:\users\tbcmb0~1\appdata\local\temp\xerox\ereg\EReg.exe" /Startup

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [<NO NAME>]

mRun: [NSU_agent] "c:\program files\nokia\nokia software updater\nsu3ui_agent.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [bigPondWirelessBroadbandCM] "c:\program files\telstra\mobile broadband manager\TelstraUCM.exe" -tsr

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [MFNetworkScanUtility] c:\program files\canon\canon mf network scan utility\CNMFSUT.EXE

mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\myplac~1.lnk - c:\program files\next g connection manager\telstra\welcome_best.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer bio protection\PwdBank.exe

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

Trusted Zone: localhost

Trusted Zone: telstra.com

Trusted Zone: telstra.com\prm

Trusted Zone: telstra.com.au

Trusted Zone: tlsmb.com.au\mail

Trusted Zone: //about.htm/

Trusted Zone: //Exclude.htm/

Trusted Zone: //FWEvent.htm/

Trusted Zone: //LanguageSelection.htm/

Trusted Zone: //Message.htm/

Trusted Zone: //MyAgttryCmd.htm/

Trusted Zone: //MyAgttryNag.htm/

Trusted Zone: //MyNotification.htm/

Trusted Zone: //NOCLessUpdate.htm/

Trusted Zone: //quarantine.htm/

Trusted Zone: //ScanNow.htm/

Trusted Zone: //strings.vbs/

Trusted Zone: //Template.htm/

Trusted Zone: //Update.htm/

Trusted Zone: //VirFound.htm/

Trusted Zone: mcafee.com\*

Trusted Zone: mcafeeasap.com\betavscan

Trusted Zone: mcafeeasap.com\vs

Trusted Zone: mcafeeasap.com\www

DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab

DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab

DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab

DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab

DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab

DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab

DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab

DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab

DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab

DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab

DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab

DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab

DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab

DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab

DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab

DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab

DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab

DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab

DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab

DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab

DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab

DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab

DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab

DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab

DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab

DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab

DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab

DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab

DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab

DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab

DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://teamtelstra.webex.com/client/T27L10NSP21EP3/webex/ieatgpc1.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab

DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab

DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab

DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab

DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E} : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603432303 : DhcpNameServer = 10.0.0.138

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603934303 : DhcpNameServer = 10.0.0.138

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\36C61627B602E6564777F627B6 : DhcpNameServer = 192.168.20.1

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\452434 : DhcpNameServer = 192.168.5.254

TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\8445340205F627471626C6560284F6473707F647 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0} : NameServer = 10.4.81.103 10.4.182.20

TCP: Interfaces\{56F3F92A-E39A-409D-BAB7-7D2DF4926FDE} : DhcpNameServer = 10.4.85.135 10.4.176.231

TCP: Interfaces\{A076241E-F287-4440-A75C-6FF8FC204DF6} : DhcpNameServer = 192.168.1.254

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll

Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - c:\program files\mcafee\managed virusscan\agent\MyRmProt5.0.0.811.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\progra~1\citrix\system32\mfaphook.dll

LSA: Notification Packages = c:\program files\acer bio protection\PwdFilter

.

============= SERVICES / DRIVERS ===============

.

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-16 461864]

R1 cdfdrv;cdfdrv;c:\windows\system32\drivers\cdfdrv.sys [2008-7-27 27672]

R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-8-12 64712]

R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-8-12 164776]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]

R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-9-3 20328]

R2 ctxpidmn;ctxpidmn;c:\windows\system32\drivers\ctxpidmn.sys [2008-8-16 22808]

R2 CtxSbx;CtxSbx;c:\windows\system32\drivers\CtxSbx.sys [2008-8-16 185880]

R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2009-9-16 107016]

R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2009-9-16 688128]

R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2010-1-13 22528]

R2 Greg_Service;GRegService;c:\program files\acer\registration\GregHSRW.exe [2009-8-28 1150496]

R2 IGBASVC;EgisTec Service;c:\program files\acer bio protection\BASVC.exe [2009-8-5 3450368]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-29 654408]

R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\mcafee\siteadvisor enterprise\McSACore.exe [2011-5-12 324928]

R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-1-7 166024]

R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2011-1-12 160344]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-1-7 148520]

R2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-12-7 214896]

R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064]

R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-9-4 62720]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2009-6-18 144640]

R2 ODDPwrSvc;Acer ODD Power Service;c:\program files\acer\optical drive power management\ODDPWRSvc.exe [2009-9-16 125472]

R2 PassThru Service;Internet Pass-Through Service;c:\program files\htc\internet pass-through\PassThruSvr.exe [2011-9-15 88576]

R2 RadeSvc;Citrix Streaming Service;c:\program files\citrix\streaming client\RadeSvc.exe [2008-8-16 398656]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]

R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-9-16 253952]

R2 RumorServer;McAfee Peer Distribution Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064]

R2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\sierra wireless inc\common\SwiCardDetect.exe [2011-6-24 238960]

R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer\version5\TeamViewer_Service.exe [2010-6-28 173352]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-1 2337144]

R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-1-19 3027840]

R2 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2009-9-16 240160]

R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.361.0\SeaPort.EXE [2012-2-10 240408]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2009-9-16 180736]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-29 22344]

R3 MfeAVFK;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-4-16 180008]

R3 MfeBOPK;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-4-16 59288]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-8-12 338040]

R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048]

R3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\trustednet connect 2.1\TNCService.exe [2010-7-22 320408]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]

S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.361.0\BBSvc.EXE [2012-2-10 193816]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176]

S2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-9-16 359952]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-6-28 250056]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-9-16 43944]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-1-13 29472]

S3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [2009-8-10 89600]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176]

S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408]

S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [2010-6-23 23040]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2009-9-16 101248]

S3 IERA;IERA;c:\program files\sierra wireless inc\iera\IERA.exe [2010-8-11 152432]

S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-7-10 7168]

S3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2011-12-16 15896]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-6-29 40776]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-12 87808]

S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\windows\system32\drivers\mferkdk.sys [2010-4-16 34248]

S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [2009-7-10 25856]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-4-4 20480]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-1-29 8320]

S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-9-16 4231680]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-5-18 137600]

S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-5-18 8576]

S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2009-6-18 50432]

S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-5-31 16472]

S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-5-31 11104]

S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [2009-10-5 31872]

S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2010-7-1 188392]

S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [2010-7-1 32872]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]

S3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\drivers\swg3kser00.sys [2012-3-20 215552]

S3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\drivers\swiwdmbus.sys [2010-6-21 78720]

S3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\drivers\swiwdmbx.sys [2012-3-20 83968]

S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [2012-3-20 208128]

S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [2010-6-21 156544]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-6 1343400]

S3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\drivers\zghsdiag.sys [2011-12-16 113688]

S3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\drivers\zghsmdm.sys [2011-12-16 113688]

S3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\drivers\zghsnmea.sys [2011-12-16 113688]

.

=============== Created Last 30 ================

.

2012-06-30 06:03:43 -------- d-----w- c:\program files\Trend Micro

2012-06-30 03:50:25 -------- d-----w- c:\program files\CCleaner

2012-06-29 05:41:11 -------- d-----w- c:\program files\NoVirusThanks

2012-06-29 00:54:22 -------- d-----w- c:\users\tbc mb 02\appdata\local\Macromedia

2012-06-29 00:40:47 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-06-29 00:40:47 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Malwarebytes

2012-06-29 00:39:47 -------- d-----w- c:\programdata\Malwarebytes

2012-06-29 00:39:43 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-29 00:39:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-27 23:30:36 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-26 00:57:32 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Foxit Software

2012-06-26 00:53:23 -------- d-----w- c:\program files\Foxit Software

2012-06-22 07:25:29 -------- d-----w- c:\program files\MediaInfo

2012-06-21 23:24:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-21 23:23:48 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-21 23:23:34 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-21 23:23:34 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-19 03:22:39 -------- d-----w- c:\programdata\Windows

2012-06-13 23:43:37 2342400 ----a-w- c:\windows\system32\win32k.sys

2012-06-13 23:43:13 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-13 23:43:07 2342400 ----a-w- c:\windows\system32\msi.dll

2012-06-13 23:43:03 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-06-13 23:43:00 57856 ----a-w- c:\windows\system32\rdpwsx.dll

2012-06-13 23:42:59 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-06-13 23:42:50 163328 ----a-w- c:\windows\system32\profsvc.dll

2012-06-13 23:41:29 1156608 ----a-w- c:\windows\system32\crypt32.dll

2012-06-13 23:41:27 139264 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-13 23:41:24 103936 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-13 00:35:37 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information

2012-06-13 00:35:33 -------- d-----w- c:\program files\Canon

2012-06-13 00:35:05 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL

2012-06-13 00:35:05 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL

2012-06-13 00:35:05 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL

2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL

2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL

2012-06-13 00:35:00 86016 ----a-w- c:\windows\system32\CNCI4400.DLL

2012-06-13 00:35:00 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll

2012-06-13 00:35:00 122880 ----a-w- c:\windows\system32\CNCL4400.DLL

2012-06-13 00:34:58 303104 ----a-w- c:\windows\system32\CNCC4400.DLL

2012-06-13 00:34:58 143360 ----a-w- c:\windows\system32\CNCE4400.DLL

2012-06-13 00:34:27 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL

2012-06-13 00:34:19 204800 ----a-w- c:\windows\system32\CNCENPR.dll

2012-06-13 00:34:19 110592 ----a-w- c:\windows\system32\CNCENPU.dll

2012-06-13 00:34:18 139264 ----a-w- c:\windows\system32\CNCENPM.dll

.

==================== Find3M ====================

.

2012-06-28 00:19:08 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-05-30 12:26:10 476960 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-05-30 12:26:10 472864 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-17 22:45:37 1800192 ----a-w- c:\windows\system32\jscript9.dll

2012-05-17 22:35:47 1129472 ----a-w- c:\windows\system32\wininet.dll

2012-05-17 22:35:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2012-05-17 22:29:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2012-05-17 22:24:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-04-02 04:46:44 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-02 04:46:44 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe

.

============= FINISH: 16:14:08.62 ===============

Attach.txt

DDS.txt

LDTate · July 2, 2012

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

blinken · July 3, 2012

Thanks for the asistance

Laptop is still behaving a bit sluggish, Ie seems to crash unexpectedly, MBAM scan results below.

Malwarebytes Anti-Malware (Trial) 1.61.0.1400

www.malwarebytes.org

Database version: v2012.07.02.06

Windows 7 x86 NTFS

Internet Explorer 9.0.8112.16421

TBC MB 02 :: TBCMB02-PC [administrator]

Protection: Enabled

3/07/2012 9:15:12 AM

mbam-log-2012-07-03 (09-15-12).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 423662

Time elapsed: 5 hour(s), 14 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

LDTate · July 3, 2012

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

blinken · July 4, 2012

the laptop seems better, haven't seen websites asking for credit card verification last 2 days.

Combofix log below.

thanks.

ComboFix 12-07-02.01 - TBC MB 02 04/07/2012 10:31:35.1.2 - x86

Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1822 [GMT 9.5:30]

Running from: c:\users\TBC MB 02\Desktop\ComboFix.exe

AV: McAfee® Total Protection™ Service *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee® Security-as-a-Service *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee® Total Protection™ Service *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\windows

c:\programdata\windows\msxx.dat

c:\programdata\Windows\vvve.dat

c:\users\TBC MB 02\AppData\Local\assembly\tmp

c:\users\TBC MB 02\AppData\Roaming\.#

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@1692770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@16927A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@1322770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@13227A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@372770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@3727A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@1592770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@15927A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@232770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@2327A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@1622770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@16227A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@1752770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@17527A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@1732770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@17327A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F2770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F27A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@1802770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@18027A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C2770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C27A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@1542770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@15427A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F2770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F27A0.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D2770.###

c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D27A0.###

c:\users\TBC MB 02\g2mdlhlpx.exe

.

((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))

.

2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Ctx_StreamingSvc\AppData\Local\temp

2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\McAfeeMVSUser\AppData\Local\temp

2012-07-04 00:03 . 2012-07-04 00:03 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\HPAppData

2012-07-02 02:36 . 2012-07-02 02:36 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll

2012-07-02 02:36 . 2012-07-02 02:36 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll

2012-07-02 00:59 . 2012-04-04 06:26 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-02 00:58 . 2012-07-02 00:58 -------- d-----w- c:\program files\iPod

2012-07-02 00:58 . 2012-07-02 01:01 -------- d-----w- c:\program files\iTunes

2012-07-02 00:39 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-07-02 00:39 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-07-02 00:39 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-07-02 00:39 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-07-02 00:38 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-07-02 00:38 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-07-02 00:38 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-07-02 00:38 . 2012-06-02 05:49 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-07-02 00:38 . 2012-06-02 05:42 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-30 06:03 . 2012-06-30 06:03 -------- d-----w- c:\program files\Trend Micro

2012-06-29 05:41 . 2012-06-29 05:41 -------- d-----w- c:\program files\NoVirusThanks

2012-06-29 00:54 . 2012-06-29 00:54 -------- d-----w- c:\users\TBC MB 02\AppData\Local\Macromedia

2012-06-29 00:40 . 2012-06-29 00:40 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Malwarebytes

2012-06-29 00:39 . 2012-06-29 00:39 -------- d-----w- c:\programdata\Malwarebytes

2012-06-29 00:39 . 2012-07-02 00:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-26 00:57 . 2012-06-26 02:34 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Foxit Software

2012-06-26 00:53 . 2012-06-26 00:53 -------- d-----w- c:\program files\Foxit Software

2012-06-22 07:25 . 2012-07-02 00:32 -------- d-----w- c:\program files\MediaInfo

2012-06-13 23:43 . 2012-05-15 01:12 2342400 ----a-w- c:\windows\system32\win32k.sys

2012-06-13 23:43 . 2012-04-28 03:19 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-13 23:43 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\system32\msi.dll

2012-06-13 23:43 . 2012-04-26 04:48 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-06-13 23:43 . 2012-04-26 04:48 57856 ----a-w- c:\windows\system32\rdpwsx.dll

2012-06-13 23:42 . 2012-04-26 04:43 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-06-13 23:42 . 2012-05-02 04:52 163328 ----a-w- c:\windows\system32\profsvc.dll

2012-06-13 23:41 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll

2012-06-13 23:41 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-13 23:41 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-13 02:04 . 2012-06-13 02:04 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Canon

2012-06-13 00:35 . 2012-06-13 00:35 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information

2012-06-13 00:35 . 2012-06-13 02:04 -------- d-----w- c:\program files\Canon

2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL

2012-06-13 00:35 . 2010-07-20 23:49 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL

2012-06-13 00:35 . 2010-07-20 23:49 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL

2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL

2012-06-13 00:35 . 2010-07-20 23:49 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL

2012-06-13 00:35 . 2010-07-20 23:49 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll

2012-06-13 00:35 . 2010-07-20 23:48 86016 ----a-w- c:\windows\system32\CNCI4400.DLL

2012-06-13 00:35 . 2010-07-20 23:47 122880 ----a-w- c:\windows\system32\CNCL4400.DLL

2012-06-13 00:34 . 2010-07-20 23:49 143360 ----a-w- c:\windows\system32\CNCE4400.DLL

2012-06-13 00:34 . 2010-07-20 23:48 303104 ----a-w- c:\windows\system32\CNCC4400.DLL

2012-06-13 00:34 . 2010-07-08 23:08 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL

2012-06-13 00:34 . 2009-06-18 09:43 204800 ----a-w- c:\windows\system32\CNCENPR.dll

2012-06-13 00:34 . 2009-06-18 09:43 110592 ----a-w- c:\windows\system32\CNCENPU.dll

2012-06-13 00:34 . 2010-07-07 05:06 139264 ----a-w- c:\windows\system32\CNCENPM.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-30 12:26 . 2012-05-30 12:26 476960 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-05-30 12:26 . 2010-05-24 03:55 472864 ----a-w- c:\windows\system32\deployJava1.dll

2012-07-02 02:36 . 2011-05-30 04:12 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"TrustedNet Connect 2.x"="c:\program files\TrustedNet Connect 2.1\TNCTray.exe" [2003-07-29 86936]

"Telstra Connection Manager"="c:\program files\NetComm\Connection Manager\ConnectionManager.exe" [2010-01-29 145408]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-12-21 1483264]

"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-08-27 1191432]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-18 1537320]

"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-09-04 186912]

"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-19 487424]

"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-09-04 261888]

"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]

"BigPond News Ticker"="c:\program files\BigPond News Ticker\BigPond__News_Ticker.exe" [2009-02-10 759728]

"PLD_FrameworkRun"="c:\windows\System32\oem\RunCMD.exe" [2009-08-11 229376]

"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-08-05 3567616]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-30 200704]

"SignIn"="c:\program files\Microsoft Online Services\Sign In\SignIn.exe" [2010-03-09 1734512]

"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-05 59240]

"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 167424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 144384]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-09 49208]

"NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2011-12-13 190768]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"BigPondWirelessBroadbandCM"="c:\program files\Telstra\Mobile Broadband Manager\TelstraUCM.exe" [2011-08-11 6198168]

"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-01 634880]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"MFNetworkScanUtility"="c:\program files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE" [2009-12-15 484760]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-9-16 708608]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-18 795936]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

My Place.lnk - c:\program files\Next G Connection Manager\Telstra\welcome_best.exe [2010-1-13 4594096]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Citrix\system32\mfaphook.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ c:\program files\Acer Bio Protection\PwdFilter

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.exe [x]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]

R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]

R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]

R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]

R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]

R3 IERA;IERA;c:\program files\Sierra Wireless Inc\IERA\IERA.exe [x]

R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]

R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [x]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]

R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]

R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]

R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]

R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]

R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]

R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [x]

R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [x]

R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [x]

R3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\swg3kser00.sys [x]

R3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\DRIVERS\swiwdmbus.sys [x]

R3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\DRIVERS\swiwdmbx.sys [x]

R3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\DRIVERS\swnc8ua3.sys [x]

R3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\DRIVERS\swumxa3.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\DRIVERS\zghsdiag.sys [x]

R3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\DRIVERS\zghsmdm.sys [x]

R3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\DRIVERS\zghsnmea.sys [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

S1 cdfdrv;cdfdrv;c:\windows\system32\DRIVERS\cdfdrv.sys [x]

S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]

S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [x]

S2 ctxpidmn;ctxpidmn;c:\windows\system32\DRIVERS\ctxpidmn.sys [x]

S2 CtxSbx;CtxSbx;c:\windows\system32\DRIVERS\CtxSbx.sys [x]

S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [x]

S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [x]

S2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [x]

S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [x]

S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]

S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [x]

S2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]

S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [x]

S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [x]

S2 RadeSvc;Citrix Streaming Service;c:\program files\Citrix\Streaming Client\RadeSvc.exe [x]

S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]

S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x]

S2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x]

S2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\Sierra Wireless Inc\Common\SwiCardDetect.exe [x]

S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [x]

S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x]

S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]

S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.exe [x]

S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]

S3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]

S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

S3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\TrustedNet Connect 2.1\tncservice.exe [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - mfeavfk01

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28]

.

2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28]

.

2012-06-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003Core.job

- c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27]

.

2012-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003UA.job

- c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27]

.

------- Supplementary Scan -------

.

uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956

uInternet Settings,ProxyOverride = 192.168.*.*;*.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: localhost

Trusted Zone: telstra.com

Trusted Zone: telstra.com\prm

Trusted Zone: telstra.com.au

Trusted Zone: tlsmb.com.au\mail

Trusted Zone: //about.htm/

Trusted Zone: //Exclude.htm/

Trusted Zone: //FWEvent.htm/

Trusted Zone: //LanguageSelection.htm/

Trusted Zone: //Message.htm/

Trusted Zone: //MyAgttryCmd.htm/

Trusted Zone: //MyAgttryNag.htm/

Trusted Zone: //MyNotification.htm/

Trusted Zone: //NOCLessUpdate.htm/

Trusted Zone: //quarantine.htm/

Trusted Zone: //ScanNow.htm/

Trusted Zone: //strings.vbs/

Trusted Zone: //Template.htm/

Trusted Zone: //Update.htm/

Trusted Zone: //VirFound.htm/

Trusted Zone: mcafee.com\*

Trusted Zone: mcafeeasap.com\betavscan

Trusted Zone: mcafeeasap.com\vs

Trusted Zone: mcafeeasap.com\www

TCP: DhcpNameServer = 10.0.0.138

TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0}: NameServer = 10.4.81.103 10.4.182.20

DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab

DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab

DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab

DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab

DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab

DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab

DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab

DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab

DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab

DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab

DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab

DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab

DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab

DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab

DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab

DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab

DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab

DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab

DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab

DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab

DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab

DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab

DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab

DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab

DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab

DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab

DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab

DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab

DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab

DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab

DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab

DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab

DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab

DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab

DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab

DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab

DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab

DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab

DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab

FF - ProfilePath -

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

SafeBoot-mcmscsvc

SafeBoot-MCODS

AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)