Please help! Trojan.Dropper.BCMiner and Rootkit.0Access

azn1993 · August 8, 2012

Hey everyone, I have had these google redirects and my computer is infected by Trojan.Dropper.BCMiner and Rootkit.0Access! I have tried many of the solutions online but they are still here. I have tried to download combofix but it automatically crashed to a blue screen while it hasnt finish downloading. Can anyone expert help with this problem or help me to get rid of these infection off my computer? Thanks alot!

I have done the "perform full scan" using Malwarebytes Anti-Malware. Here's the log

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.03.10

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)

Internet Explorer 9.0.8112.16421

Erica :: ERICA-PC [administrator]

8/8/2012 12:19:32 PM

mbam-log-2012-08-08 (12-48-58).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 158312

Time elapsed: 29 minute(s), 6 second(s) [aborted]

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 3

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\00000008.@ (Trojan.Dropper.BCMiner) -> No action taken.

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\000000cb.@ (Rootkit.0Access) -> No action taken.

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000032.@ (Rootkit.0Access) -> No action taken.

(end)

Thanks alot!!!!!!!!!!!

azn1993 · August 8, 2012

DDS.txt and Attach.txt are attached here.

Attach.txt

DDS.txt

MrCharlie · August 8, 2012

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

azn1993 · August 8, 2012

RogueKiller V7.6.5 [08/03/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Safe mode with network support

User: Erica [Admin rights]

Mode: Scan -- Date: 08/08/2012 13:28:34

¤¤¤ Bad processes: 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 6 ¤¤¤

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[ZeroAccess] HKCR\[...]\InprocServer32 : (\\.\globalroot\systemroot\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\n.) -> FOUND

[ZeroAccess] HKLM\[...]\InprocServer32 : (\\.\globalroot\systemroot\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\n.) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : c:\windows\installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\windows\installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\windows\installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\L --> FOUND

[ZeroAccess][FILE] @ : c:\users\erica\appdata\local\{80aa28bd-953b-0d79-ac52-59b01480de54}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\users\erica\appdata\local\{80aa28bd-953b-0d79-ac52-59b01480de54}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\users\erica\appdata\local\{80aa28bd-953b-0d79-ac52-59b01480de54}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND

[susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> CANNOT FIX

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess|Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] c031903ef0e94caca6428ba2553ec33d

[bSP] 2ee18edf56eb573bfe8fc4993312b762 : Windows 7 MBR Code

Partition table:

0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 190776 Mo

2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 443140096 | Size: 260562 Mo

User != LL1 ... KO!

--- LL1 ---

[MBR] 2d9f73e8480f01623a080c08240fd05d

[bSP] 2ee18edf56eb573bfe8fc4993312b762 : Windows 7 MBR Code

Partition table:

1 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 190776 Mo

3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 443140096 | Size: 260562 Mo

User != LL2 ... KO!

--- LL2 ---

[MBR] 2d9f73e8480f01623a080c08240fd05d

[bSP] 2ee18edf56eb573bfe8fc4993312b762 : Windows 7 MBR Code

Partition table:

1 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 190776 Mo

3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 443140096 | Size: 260562 Mo

Finished : << RKreport[1].txt >>

RKreport[1].txt

thank you for replying!

MrCharlie · August 8, 2012

Here you go......

You have two infections:

¤¤¤ Infection : ZeroAccess|Root.MBR ¤¤¤

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.
BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451
When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063
I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.
Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please make sure system restore is running and create a new restore point before continuing!

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
services.exe
[*]Now press the Search button
[*]When the search is complete, search.txt will also be written to your USB
[*]Type exit and reboot the computer normally
[*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

MrC

azn1993 · August 8, 2012

Scan result of Farbar Recovery Scan Tool Version: 08-08-2012 02

Ran by Erica at 08-08-2012 13:42:23

Running from F:\

Service Pack 1 (X64) OS Language: English(US)

Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.

============ One Month Created Files and Folders ==============

2012-08-08 13:28 - 2012-08-08 13:28 - 00003409 ____A C:\Users\Erica\Desktop\RKreport[1].txt

2012-08-08 13:27 - 2012-08-08 13:28 - 00000000 ____D C:\Users\Erica\Desktop\RK_Quarantine

2012-08-08 13:02 - 2012-08-08 13:02 - 00001946 ____A C:\Users\Erica\Desktop\Attach.rar

2012-08-08 13:01 - 2012-08-08 13:01 - 00014692 ____A C:\Users\Erica\Desktop\DDS.txt

2012-08-08 13:01 - 2012-08-08 13:01 - 00006817 ____A C:\Users\Erica\Desktop\Attach.txt

2012-08-08 12:40 - 2012-08-08 12:40 - 00607260 ____R (Swearware) C:\Users\Erica\Desktop\dds.scr

2012-08-08 12:00 - 2012-08-08 12:00 - 00262144 ____A C:\Windows\Minidump\080812-37237-01.dmp

2012-08-08 11:37 - 2012-08-08 11:37 - 00266472 ____A C:\Windows\Minidump\080812-22432-01.dmp

2012-08-06 17:12 - 2009-07-13 18:14 - 00020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe

2012-08-06 12:25 - 2005-04-25 05:16 - 00253952 ____N (TODO: <Company name>) C:\Windows\SBCDSL.exe

2012-08-06 12:25 - 2002-02-13 19:53 - 00006345 ___RA C:\Windows\SysWOW64\DevMngr.vxd

2012-08-05 15:59 - 2012-08-05 15:59 - 00000000 ____D C:\Users\Erica\Desktop\textbook fall 2012

2012-08-03 17:35 - 2012-08-08 11:37 - 00003922 ____A C:\Windows\PFRO.log

2012-07-30 18:11 - 2012-07-30 18:11 - 00000981 ____A C:\Windows\WindowsUpdate.log

2012-07-30 18:07 - 2012-08-08 11:59 - 00000000 ___SD C:\32788R22FWJFW

2012-07-30 18:07 - 2012-07-30 18:08 - 00262144 ____A C:\Windows\Minidump\073012-18564-01.dmp

2012-07-30 17:54 - 2012-08-08 12:00 - 638726075 ____A C:\Windows\MEMORY.DMP

2012-07-30 17:54 - 2012-08-08 11:37 - 00001232 ____A C:\Windows\setupact.log

2012-07-30 17:54 - 2012-07-30 17:54 - 00272008 ____A C:\Windows\Minidump\073012-19390-01.dmp

2012-07-30 17:54 - 2012-07-30 17:54 - 00000000 ____A C:\Windows\setuperr.log

2012-07-30 17:36 - 2012-08-08 12:00 - 00000000 ____D C:\Windows\Minidump

2012-07-26 18:02 - 2012-07-26 18:03 - 00253068 ____A C:\Users\Erica\Desktop\ACCT212 Course Project 1 Template Parts A and B 05202012.xlsx

2012-07-21 20:45 - 2012-07-21 20:45 - 04818574 ____A C:\Users\Erica\Desktop\1.wmv

2012-07-21 20:44 - 2012-07-21 20:45 - 00000000 ____D C:\Users\Erica\AppData\Local\{54948630-CFCE-4700-98F4-11609C1F679E}

2012-07-21 20:44 - 2012-07-21 20:44 - 00000000 ____D C:\Users\Erica\AppData\Local\{6695E5A6-25E0-413C-8EE3-17575F20945D}

2012-07-21 09:41 - 2012-07-27 18:43 - 00000192 ____A C:\Users\Erica\Desktop\confidence interval.txt

2012-07-13 15:15 - 2012-07-13 15:15 - 00081938 ____A C:\Users\Erica\Documents\cc_20120713_151542.reg

2012-07-13 15:14 - 2012-07-14 17:27 - 00000868 ____A C:\Users\Public\Desktop\CCleaner.lnk

2012-07-13 15:14 - 2012-07-13 15:14 - 00000000 ____D C:\Program Files\CCleaner

2012-07-13 14:58 - 2012-07-22 21:14 - 00000396 ____A C:\Windows\Tasks\RegAce Scheduled Scan - Erica.job

2012-07-13 14:58 - 2012-07-13 15:08 - 00000000 ____D C:\Users\All Users\RegAce

2012-07-13 14:57 - 2012-07-13 14:57 - 00000000 ____D C:\ComboFix

2012-07-13 14:54 - 2012-08-03 17:48 - 00000000 ____D C:\Windows\erdnt

2012-07-13 14:54 - 2012-07-13 14:56 - 00000000 ____D C:\Qoobox

2012-07-13 11:47 - 2012-07-13 11:47 - 00000000 ____D C:\TDSSKiller_Quarantine

2012-07-12 19:20 - 2012-07-12 19:21 - 01864267 ____A C:\Windows\System32\Drivers\Cat.DB

2012-07-12 19:20 - 2012-05-11 11:14 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys

2012-07-12 19:19 - 2012-07-12 19:19 - 00000000 ____D C:\Users\Erica\AppData\Roaming\TestApp

2012-07-12 19:19 - 2012-07-12 19:19 - 00000000 ____D C:\Users\All Users\PC Tools

2012-07-12 19:16 - 2012-07-12 19:16 - 00033758 ____A C:\Users\Erica\AppData\Local\dt.dat

2012-07-12 18:36 - 2012-07-12 19:42 - 00000000 ____D C:\Users\All Users\MFAData

2012-07-10 22:44 - 2012-06-11 20:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-07-10 22:40 - 2012-06-02 05:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-07-10 22:40 - 2012-06-02 05:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-07-10 22:40 - 2012-06-02 05:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-07-10 22:40 - 2012-06-02 05:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-07-10 22:40 - 2012-06-02 05:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-07-10 22:40 - 2012-06-02 05:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-07-10 22:40 - 2012-06-02 05:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-07-10 22:40 - 2012-06-02 05:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-07-10 22:40 - 2012-06-02 05:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-07-10 22:40 - 2012-06-02 05:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-07-10 22:40 - 2012-06-02 04:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-07-10 22:40 - 2012-06-02 04:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-07-10 22:40 - 2012-06-02 04:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-07-10 22:40 - 2012-06-02 04:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-07-10 22:40 - 2012-06-02 02:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-07-10 22:40 - 2012-06-02 01:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-07-10 22:40 - 2012-06-02 01:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-07-10 22:40 - 2012-06-02 01:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-07-10 22:40 - 2012-06-02 01:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-07-10 22:40 - 2012-06-02 01:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-07-10 22:40 - 2012-06-02 01:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-07-10 22:40 - 2012-06-02 01:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-07-10 22:40 - 2012-06-02 01:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-07-10 22:40 - 2012-06-02 01:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-07-10 22:40 - 2012-06-02 01:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-07-10 22:40 - 2012-06-02 01:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-07-10 22:40 - 2012-06-02 01:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-07-10 22:40 - 2012-06-02 01:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-07-10 19:22 - 2012-07-10 19:24 - 00000000 ____D C:\Users\Erica\AppData\Roaming\GetRightToGo

2012-07-10 18:38 - 2012-07-10 18:38 - 00001073 ____A C:\Users\Public\Desktop\????.lnk

2012-07-10 18:31 - 2012-07-10 18:31 - 00000000 ____A C:\Windows\LiveUpdate.INI

2012-07-10 17:49 - 2012-06-08 22:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-07-10 17:49 - 2012-06-08 21:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-07-10 17:49 - 2012-06-05 23:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-07-10 17:49 - 2012-06-05 23:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-07-10 17:49 - 2012-06-05 22:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-07-10 17:49 - 2012-06-05 22:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-07-10 17:49 - 2010-06-25 20:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2012-07-10 17:49 - 2010-06-25 20:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2012-07-10 17:48 - 2012-06-01 22:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-07-10 17:48 - 2012-06-01 22:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-07-10 17:48 - 2012-06-01 22:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-07-10 17:48 - 2012-06-01 22:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-07-10 17:48 - 2012-06-01 22:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-07-10 17:48 - 2012-06-01 21:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-07-10 17:48 - 2012-06-01 21:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-07-10 17:48 - 2012-06-01 21:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-07-10 17:48 - 2012-06-01 21:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-07-10 17:38 - 2012-06-05 23:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-07-10 17:38 - 2012-06-05 22:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

============ 3 Months Modified Files ========================

2012-08-08 13:28 - 2012-08-08 13:28 - 00003409 ____A C:\Users\Erica\Desktop\RKreport[1].txt

2012-08-08 13:02 - 2012-08-08 13:02 - 00001946 ____A C:\Users\Erica\Desktop\Attach.rar

2012-08-08 13:01 - 2012-08-08 13:01 - 00014692 ____A C:\Users\Erica\Desktop\DDS.txt

2012-08-08 13:01 - 2012-08-08 13:01 - 00006817 ____A C:\Users\Erica\Desktop\Attach.txt

2012-08-08 12:40 - 2012-08-08 12:40 - 00607260 ____R (Swearware) C:\Users\Erica\Desktop\dds.scr

2012-08-08 12:00 - 2012-08-08 12:00 - 00262144 ____A C:\Windows\Minidump\080812-37237-01.dmp

2012-08-08 12:00 - 2012-07-30 17:54 - 638726075 ____A C:\Windows\MEMORY.DMP

2012-08-08 11:45 - 2009-07-13 21:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-08 11:45 - 2009-07-13 21:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-08 11:38 - 2012-06-03 12:56 - 00000380 ____A C:\Users\Erica\AppData\Roaming\sp_data.sys

2012-08-08 11:38 - 2012-04-13 08:38 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-08-08 11:37 - 2012-08-08 11:37 - 00266472 ____A C:\Windows\Minidump\080812-22432-01.dmp

2012-08-08 11:37 - 2012-08-03 17:35 - 00003922 ____A C:\Windows\PFRO.log

2012-08-08 11:37 - 2012-07-30 17:54 - 00001232 ____A C:\Windows\setupact.log

2012-08-08 11:37 - 2009-07-13 22:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-08 11:32 - 2012-03-26 16:21 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000UA.job

2012-08-06 12:28 - 2011-10-06 16:59 - 00002012 ____A C:\Windows\System32\AutoRunFilter.ini

2012-08-04 00:32 - 2012-03-26 16:21 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000Core.job

2012-08-03 17:39 - 2012-04-13 08:38 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-03 17:39 - 2012-03-05 14:00 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-07-30 18:11 - 2012-07-30 18:11 - 00000981 ____A C:\Windows\WindowsUpdate.log

2012-07-30 18:08 - 2012-07-30 18:07 - 00262144 ____A C:\Windows\Minidump\073012-18564-01.dmp

2012-07-30 17:54 - 2012-07-30 17:54 - 00272008 ____A C:\Windows\Minidump\073012-19390-01.dmp

2012-07-30 17:54 - 2012-07-30 17:54 - 00000000 ____A C:\Windows\setuperr.log

2012-07-29 22:47 - 2009-07-13 22:13 - 00745942 ____A C:\Windows\System32\PerfStringBackup.INI

2012-07-27 18:43 - 2012-07-21 09:41 - 00000192 ____A C:\Users\Erica\Desktop\confidence interval.txt

2012-07-26 18:03 - 2012-07-26 18:02 - 00253068 ____A C:\Users\Erica\Desktop\ACCT212 Course Project 1 Template Parts A and B 05202012.xlsx

2012-07-22 21:14 - 2012-07-13 14:58 - 00000396 ____A C:\Windows\Tasks\RegAce Scheduled Scan - Erica.job

2012-07-21 20:45 - 2012-07-21 20:45 - 04818574 ____A C:\Users\Erica\Desktop\1.wmv

2012-07-14 17:27 - 2012-07-13 15:14 - 00000868 ____A C:\Users\Public\Desktop\CCleaner.lnk

2012-07-14 10:00 - 2011-10-06 16:59 - 00001396 ____A C:\Windows\System32\ServiceFilter.ini

2012-07-13 15:15 - 2012-07-13 15:15 - 00081938 ____A C:\Users\Erica\Documents\cc_20120713_151542.reg

2012-07-12 19:21 - 2012-07-12 19:20 - 01864267 ____A C:\Windows\System32\Drivers\Cat.DB

2012-07-12 19:16 - 2012-07-12 19:16 - 00033758 ____A C:\Users\Erica\AppData\Local\dt.dat

2012-07-11 17:56 - 2009-07-13 21:45 - 00413312 ____A C:\Windows\System32\FNTCACHE.DAT

2012-07-10 22:44 - 2009-07-13 19:34 - 00000478 ____A C:\Windows\win.ini

2012-07-10 22:41 - 2012-02-29 18:50 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-07-10 18:38 - 2012-07-10 18:38 - 00001073 ____A C:\Users\Public\Desktop\????.lnk

2012-07-10 18:31 - 2012-07-10 18:31 - 00000000 ____A C:\Windows\LiveUpdate.INI

2012-07-07 17:09 - 2012-07-07 17:09 - 00000312 ____A C:\rkill.log

2012-06-17 20:16 - 2012-05-24 15:12 - 00005632 ____A C:\Users\Erica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-06-12 09:09 - 2009-07-13 22:08 - 00032582 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2012-06-11 20:08 - 2012-07-10 22:44 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-08 22:43 - 2012-07-10 17:49 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-08 21:41 - 2012-07-10 17:49 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-06-06 18:45 - 2012-06-06 18:45 - 00759334 ____A C:\Windows\SysWOW64\PerfStringBackup.INI

2012-06-05 23:06 - 2012-07-10 17:49 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-05 23:06 - 2012-07-10 17:49 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-05 23:02 - 2012-07-10 17:38 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-06-05 22:05 - 2012-07-10 17:49 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-06-05 22:05 - 2012-07-10 17:49 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-06-05 22:03 - 2012-07-10 17:38 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-06-05 15:26 - 2012-06-05 15:26 - 00001510 ____A C:\Users\Erica\Desktop\Warcraft III.lnk

2012-06-05 15:26 - 2012-06-05 15:24 - 00015153 ____A C:\Windows\War3Unin.dat

2012-06-05 15:24 - 2012-06-05 15:24 - 00126976 ____A (Blizzard Entertainment) C:\Windows\War3Unin.exe

2012-06-05 15:24 - 2012-06-05 15:24 - 00002829 ____A C:\Windows\War3Unin.pif

2012-06-03 12:59 - 2011-10-06 16:59 - 00000080 ____A C:\Windows\System32\Defrag.ini

2012-06-03 12:58 - 2011-10-06 16:46 - 00000184 ____A C:\setup.log

2012-06-03 12:52 - 2012-02-19 21:57 - 00045056 ____A C:\Windows\System32\acovcnt.exe

2012-06-03 08:45 - 2011-10-06 16:51 - 00002490 ____A C:\RHDSetup.log

2012-06-02 15:19 - 2012-06-21 17:03 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 15:19 - 2012-06-21 17:03 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 15:19 - 2012-06-21 17:03 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 15:19 - 2012-06-21 17:03 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 15:19 - 2012-06-21 17:03 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 15:19 - 2012-06-21 17:03 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 15:15 - 2012-06-21 17:03 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 15:15 - 2012-06-21 17:03 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 15:15 - 2012-06-21 17:03 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 05:49 - 2012-07-10 22:40 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 05:17 - 2012-07-10 22:40 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 05:12 - 2012-07-10 22:40 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 05:05 - 2012-07-10 22:40 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 05:05 - 2012-07-10 22:40 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 05:04 - 2012-07-10 22:40 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 05:04 - 2012-07-10 22:40 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 05:03 - 2012-07-10 22:40 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 05:01 - 2012-07-10 22:40 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 05:00 - 2012-07-10 22:40 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 04:59 - 2012-07-10 22:40 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 04:57 - 2012-07-10 22:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 04:57 - 2012-07-10 22:40 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 04:54 - 2012-07-10 22:40 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-02 02:07 - 2012-07-10 22:40 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-06-02 01:43 - 2012-07-10 22:40 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-06-02 01:33 - 2012-07-10 22:40 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-06-02 01:26 - 2012-07-10 22:40 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-06-02 01:25 - 2012-07-10 22:40 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-06-02 01:25 - 2012-07-10 22:40 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-06-02 01:23 - 2012-07-10 22:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-06-02 01:21 - 2012-07-10 22:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-06-02 01:20 - 2012-07-10 22:40 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-06-02 01:19 - 2012-07-10 22:40 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-06-02 01:19 - 2012-07-10 22:40 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-06-02 01:17 - 2012-07-10 22:40 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-06-02 01:16 - 2012-07-10 22:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-06-02 01:14 - 2012-07-10 22:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-06-01 22:50 - 2012-07-10 17:48 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-01 22:48 - 2012-07-10 17:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-01 22:48 - 2012-07-10 17:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-01 22:45 - 2012-07-10 17:48 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-01 22:44 - 2012-07-10 17:48 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-06-01 21:40 - 2012-07-10 17:48 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-06-01 21:40 - 2012-07-10 17:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-06-01 21:39 - 2012-07-10 17:48 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-06-01 21:34 - 2012-07-10 17:48 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-05-11 11:14 - 2012-07-12 19:20 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys

ZeroAccess:

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\L

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\L\00000004.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\L\1afb2d56

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\L\201d3dde

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\00000004.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\00000008.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\000000cb.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000000.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000032.@

C:\Windows\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000064.@

ZeroAccess:

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\@

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\L

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\U

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\L\00000004.@

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\00000004.@

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000000.@

C:\Users\Erica\AppData\Local\{80aa28bd-953b-0d79-ac52-59b01480de54}\U\80000064.@

ZeroAccess:

C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:

C:\Windows\assembly\GAC_64\Desktop.ini

Type 00 partition infection:

C:\Windows\svchost.exe

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

TDL4: custom:26000022 <===== ATTENTION!

========================= Memory info ======================

Percentage of memory in use: 40%

Total physical RAM: 4000.13 MB

Available physical RAM: 2386.8 MB

Total Pagefile: 7998.45 MB

Available Pagefile: 6527.03 MB

Total Virtual: 8192 MB

Available Virtual: 8191.87 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:186.3 GB) (Free:134.36 GB) NTFS ==>[system with boot components (obtained from reading drive)]

2 Drive d: (DATA) (Fixed) (Total:254.45 GB) (Free:254.35 GB) NTFS

3 Drive e: (Warcraft III) (CDROM) (Total:0.66 GB) (Free:0 GB) CDFS

4 Drive f: (ERICA) (Removable) (Total:7.47 GB) (Free:0.43 GB) FAT32

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 465 GB 1024 KB

Disk 1 Online 7663 MB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 25 GB 1024 KB

Partition 2 Primary 186 GB 25 GB

Partition 0 Extended 254 GB 211 GB

Partition 3 Logical 254 GB 211 GB

==================================================================================

Disk: 0

Partition 1

Type : 1C

Hidden: Yes

Active: No

There is no volume associated with this partition.

==================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 C OS NTFS Partition 186 GB Healthy System (partition with boot components)

==================================================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 D DATA NTFS Partition 254 GB Healthy

==================================================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 7655 MB 22 KB

==================================================================================

Disk: 1

Partition 1

Type : 0B

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 F ERICA FAT32 Removable 7655 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-08-07 09:58

======================= End Of Log ==========================

azn1993 · August 8, 2012

Farbar Recovery Scan Tool Version: 08-08-2012 02

Ran by Erica at 2012-08-08 13:43:26

Running from F:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 16:19] - [2009-07-13 18:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 16:19] - [2009-07-13 18:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

MrCharlie · August 8, 2012

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.

You didn't run the tool properly > please try it again....MrC

azn1993 · August 8, 2012

I apologized for misreading the instruction

and I have just did the scan from the recovery tool.

Scan result of Farbar Recovery Scan Tool Version: 08-08-2012 02

Ran by SYSTEM at 08-08-2012 14:16:24

Running from F:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [VizorHtmlDialog.exe] "C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe" "DEF" "EULA" "C:\Program Files\Trend Micro\Titanium\UI\Installer.cmpt\resources\preinstall_01_welcome_trial.html" "DEF" "DEF" "DEF" [x]

HKLM\...\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [192520 2010-10-12] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe -ReFlush "none" "none" [322384 2010-09-17] (Trend Micro Inc.)

HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [168216 2011-06-01] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [391960 2011-06-01] (Intel Corporation)

HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)

HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3 [2277480 2011-08-16] (Realtek Semiconductor)

HKLM-x32\...\Run: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" [371 2012-08-06] ()

HKLM-x32\...\Run: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" [2018032 2011-04-01] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /S [731472 2011-02-23] (ecareme)

HKLM-x32\...\Run: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)

HKLM-x32\...\Run: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot [296056 2012-02-21] (RealNetworks, Inc.)

HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)

HKLM-x32\...\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [322176 2012-02-16] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-24] (ASUS)

HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)

HKLM-x32\...\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2321072 2012-02-02] (ASUSTeK Computer Inc.)

HKU\Erica\...\Run: [Facebook Update] "C:\Users\Erica\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-11] (Facebook Inc.)

HKU\Erica\...\Run: [Google Update] "C:\Users\Erica\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-03-26] (Google Inc.)

HKU\Erica\...\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [17355912 2012-05-03] (Skype Technologies S.A.)

HKU\Erica\...\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)

HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)

Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

HKLM\...\InprocServer32: [Default-wbemess] \\.\globalroot\systemroot\Installer\{80aa28bd-953b-0d79-ac52-59b01480de54}\n. ATTENTION! ====> ZeroAccess

Startup: C:\Users\All Users\Start Menu\Programs\Startup\FancyStart daemon.lnk

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe ()

==================== Services (Whitelisted) ======

2 ASLDRService; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [80512 2011-11-21] (ASUS)

2 ATKGFNEXSrv; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-21] (ASUS)

3 SonicStage Back-End Service; "C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SsBeSvc.exe" [112184 2007-02-05] (Sony Corporation)

3 SSScsiSV; C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SSScsiSV.exe [75320 2007-02-05] (Sony Corporation)

3 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [241488 2010-09-17] (Trend Micro Inc.)

2 UNS; "C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe" [2656280 2010-12-20] (Intel Corporation)

3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x]

========================== Drivers (Whitelisted) =============

2 ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [15416 2009-07-02] (ASUS)

1 ATKWMIACPIIO_; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [17536 2011-09-07] (ASUS)

3 kbfiltr; C:\Windows\System32\Drivers\kbfiltr.sys [15416 2009-07-20] ( )

2 tmactmon; C:\Windows\System32\Drivers\tmactmon.sys [90704 2010-09-17] (Trend Micro Inc.)

2 tmcomm; C:\Windows\System32\Drivers\tmcomm.sys [144464 2010-09-17] (Trend Micro Inc.)

2 tmevtmgr; C:\Windows\System32\Drivers\tmevtmgr.sys [67664 2010-09-17] (Trend Micro Inc.)

1 tmtdi; C:\Windows\System32\Drivers\tmtdi.sys [105552 2010-09-17] (Trend Micro Inc.)

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-08 12:42 - 2012-08-08 12:42 - 00000000 ____D C:\FRST

2012-08-08 12:28 - 2012-08-08 12:28 - 00003409 ____A C:\Users\Erica\Desktop\RKreport[1].txt

2012-08-08 12:27 - 2012-08-08 12:28 - 00000000 ____D C:\Users\Erica\Desktop\RK_Quarantine

2012-08-08 12:02 - 2012-08-08 12:02 - 00001946 ____A C:\Users\Erica\Desktop\Attach.rar

2012-08-08 12:01 - 2012-08-08 12:01 - 00014692 ____A C:\Users\Erica\Desktop\DDS.txt

2012-08-08 12:01 - 2012-08-08 12:01 - 00006817 ____A C:\Users\Erica\Desktop\Attach.txt

2012-08-05 14:59 - 2012-08-05 14:59 - 00000000 ____D C:\Users\Erica\Desktop\textbook fall 2012

2012-08-03 16:35 - 2012-08-03 16:35 - 00002202 ____A C:\Windows\PFRO.log

2012-07-30 17:11 - 2012-07-30 17:11 - 00000981 ____A C:\Windows\WindowsUpdate.log

2012-07-30 17:07 - 2012-08-08 14:14 - 00000000 ___SD C:\32788R22FWJFW

2012-07-30 17:07 - 2012-07-30 17:08 - 00262144 ____A C:\Windows\Minidump\073012-18564-01.dmp

2012-07-30 16:54 - 2012-08-06 10:39 - 00000616 ____A C:\Windows\setupact.log

2012-07-30 16:54 - 2012-07-30 17:07 - 484876219 ____A C:\Windows\MEMORY.DMP

2012-07-30 16:54 - 2012-07-30 16:54 - 00272008 ____A C:\Windows\Minidump\073012-19390-01.dmp

2012-07-30 16:54 - 2012-07-30 16:54 - 00000000 ____A C:\Windows\setuperr.log

2012-07-30 16:36 - 2012-07-30 17:14 - 00000000 ____D C:\Windows\Minidump

2012-07-26 17:02 - 2012-07-26 17:03 - 00253068 ____A C:\Users\Erica\Desktop\ACCT212 Course Project 1 Template Parts A and B 05202012.xlsx

2012-07-25 22:16 - 2009-07-13 17:14 - 00020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe

2012-07-21 19:45 - 2012-07-21 19:45 - 04818574 ____A C:\Users\Erica\Desktop\1.wmv

2012-07-21 19:44 - 2012-07-21 19:45 - 00000000 ____D C:\Users\Erica\AppData\Local\{54948630-CFCE-4700-98F4-11609C1F679E}

2012-07-21 19:44 - 2012-07-21 19:44 - 00000000 ____D C:\Users\Erica\AppData\Local\{6695E5A6-25E0-413C-8EE3-17575F20945D}

2012-07-21 08:41 - 2012-07-27 17:43 - 00000192 ____A C:\Users\Erica\Desktop\confidence interval.txt

2012-07-13 14:15 - 2012-07-13 14:15 - 00081938 ____A C:\Users\Erica\Documents\cc_20120713_151542.reg

2012-07-13 14:14 - 2012-07-14 16:27 - 00000868 ____A C:\Users\Public\Desktop\CCleaner.lnk

2012-07-13 14:14 - 2012-07-13 14:14 - 00000000 ____D C:\Program Files\CCleaner

2012-07-13 13:58 - 2012-07-22 20:14 - 00000396 ____A C:\Windows\Tasks\RegAce Scheduled Scan - Erica.job

2012-07-13 13:58 - 2012-07-13 14:08 - 00000000 ____D C:\Users\All Users\RegAce

2012-07-13 13:57 - 2012-07-13 13:57 - 00000000 ____D C:\ComboFix

2012-07-13 13:54 - 2012-08-08 14:14 - 00000000 ____D C:\Windows\erdnt

2012-07-13 13:54 - 2012-07-13 13:56 - 00000000 ____D C:\Qoobox

2012-07-13 10:47 - 2012-07-13 10:47 - 00000000 ____D C:\TDSSKiller_Quarantine

2012-07-12 18:20 - 2012-07-12 18:21 - 01864267 ____A C:\Windows\System32\Drivers\Cat.DB

2012-07-12 18:20 - 2012-05-11 10:14 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys

2012-07-12 18:19 - 2012-07-12 18:19 - 00000000 ____D C:\Users\Erica\AppData\Roaming\TestApp

2012-07-12 18:19 - 2012-07-12 18:19 - 00000000 ____D C:\Users\All Users\PC Tools

2012-07-12 18:16 - 2012-07-12 18:16 - 00033758 ____A C:\Users\Erica\AppData\Local\dt.dat

2012-07-12 17:36 - 2012-07-12 18:42 - 00000000 ____D C:\Users\All Users\MFAData

2012-07-10 21:44 - 2012-06-11 19:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-07-10 21:40 - 2012-06-02 04:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-07-10 21:40 - 2012-06-02 04:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-07-10 21:40 - 2012-06-02 04:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-07-10 21:40 - 2012-06-02 04:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-07-10 21:40 - 2012-06-02 04:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-07-10 21:40 - 2012-06-02 04:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-07-10 21:40 - 2012-06-02 04:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-07-10 21:40 - 2012-06-02 04:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-07-10 21:40 - 2012-06-02 04:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-07-10 21:40 - 2012-06-02 04:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-07-10 21:40 - 2012-06-02 03:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-07-10 21:40 - 2012-06-02 03:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-07-10 21:40 - 2012-06-02 03:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-07-10 21:40 - 2012-06-02 03:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-07-10 21:40 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-07-10 21:40 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-07-10 21:40 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-07-10 21:40 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-07-10 21:40 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-07-10 21:40 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-07-10 21:40 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-07-10 21:40 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-07-10 21:40 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-07-10 21:40 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-07-10 21:40 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-07-10 21:40 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-07-10 21:40 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-07-10 21:40 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-07-10 18:22 - 2012-07-10 18:24 - 00000000 ____D C:\Users\Erica\AppData\Roaming\GetRightToGo

2012-07-10 17:38 - 2012-07-10 17:38 - 00001073 ____A C:\Users\Public\Desktop\????.lnk

2012-07-10 17:31 - 2012-07-10 17:31 - 00000000 ____A C:\Windows\LiveUpdate.INI

2012-07-10 16:49 - 2012-06-08 21:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-07-10 16:49 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-07-10 16:49 - 2012-06-05 22:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-07-10 16:49 - 2012-06-05 22:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-07-10 16:49 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-07-10 16:49 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-07-10 16:49 - 2010-06-25 19:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2012-07-10 16:49 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2012-07-10 16:48 - 2012-06-01 21:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-07-10 16:48 - 2012-06-01 21:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-07-10 16:48 - 2012-06-01 21:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-07-10 16:48 - 2012-06-01 21:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-07-10 16:48 - 2012-06-01 21:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-07-10 16:48 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-07-10 16:48 - 2012-06-01 20:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-07-10 16:48 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-07-10 16:48 - 2012-06-01 20:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-07-10 16:38 - 2012-06-05 22:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-07-10 16:38 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

============ 3 Months Modified Files ========================

2012-08-08 12:28 - 2012-08-08 12:28 - 00003409 ____A C:\Users\Erica\Desktop\RKreport[1].txt

2012-08-08 12:02 - 2012-08-08 12:02 - 00001946 ____A C:\Users\Erica\Desktop\Attach.rar

2012-08-08 12:01 - 2012-08-08 12:01 - 00014692 ____A C:\Users\Erica\Desktop\DDS.txt

2012-08-08 12:01 - 2012-08-08 12:01 - 00006817 ____A C:\Users\Erica\Desktop\Attach.txt

2012-08-06 10:47 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-06 10:47 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-06 10:40 - 2012-06-03 11:56 - 00000380 ____A C:\Users\Erica\AppData\Roaming\sp_data.sys

2012-08-06 10:40 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-06 10:39 - 2012-07-30 16:54 - 00000616 ____A C:\Windows\setupact.log

2012-08-05 22:38 - 2012-04-13 07:38 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-08-05 22:35 - 2012-03-09 23:25 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000UA.job

2012-08-05 22:32 - 2012-03-26 15:21 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000UA.job

2012-08-03 23:32 - 2012-03-26 15:21 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000Core.job

2012-08-03 16:39 - 2012-04-13 07:38 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-03 16:39 - 2012-03-05 13:00 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-08-03 16:35 - 2012-08-03 16:35 - 00002202 ____A C:\Windows\PFRO.log

2012-07-30 17:11 - 2012-07-30 17:11 - 00000981 ____A C:\Windows\WindowsUpdate.log

2012-07-30 17:08 - 2012-07-30 17:07 - 00262144 ____A C:\Windows\Minidump\073012-18564-01.dmp

2012-07-30 17:07 - 2012-07-30 16:54 - 484876219 ____A C:\Windows\MEMORY.DMP

2012-07-30 16:54 - 2012-07-30 16:54 - 00272008 ____A C:\Windows\Minidump\073012-19390-01.dmp

2012-07-30 16:54 - 2012-07-30 16:54 - 00000000 ____A C:\Windows\setuperr.log

2012-07-29 21:47 - 2009-07-13 21:13 - 00745942 ____A C:\Windows\System32\PerfStringBackup.INI

2012-07-29 19:35 - 2012-03-09 23:25 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2033533363-2417740829-912105009-1000Core.job

2012-07-27 17:43 - 2012-07-21 08:41 - 00000192 ____A C:\Users\Erica\Desktop\confidence interval.txt

2012-07-26 17:03 - 2012-07-26 17:02 - 00253068 ____A C:\Users\Erica\Desktop\ACCT212 Course Project 1 Template Parts A and B 05202012.xlsx

2012-07-22 20:14 - 2012-07-13 13:58 - 00000396 ____A C:\Windows\Tasks\RegAce Scheduled Scan - Erica.job

2012-07-21 19:45 - 2012-07-21 19:45 - 04818574 ____A C:\Users\Erica\Desktop\1.wmv

2012-07-14 16:27 - 2012-07-13 14:14 - 00000868 ____A C:\Users\Public\Desktop\CCleaner.lnk

2012-07-14 09:00 - 2011-10-06 15:59 - 00001976 ____A C:\Windows\System32\AutoRunFilter.ini

2012-07-14 09:00 - 2011-10-06 15:59 - 00001396 ____A C:\Windows\System32\ServiceFilter.ini

2012-07-13 14:15 - 2012-07-13 14:15 - 00081938 ____A C:\Users\Erica\Documents\cc_20120713_151542.reg

2012-07-12 18:21 - 2012-07-12 18:20 - 01864267 ____A C:\Windows\System32\Drivers\Cat.DB

2012-07-12 18:16 - 2012-07-12 18:16 - 00033758 ____A C:\Users\Erica\AppData\Local\dt.dat

2012-07-11 16:56 - 2009-07-13 20:45 - 00413312 ____A C:\Windows\System32\FNTCACHE.DAT

2012-07-10 21:44 - 2009-07-13 18:34 - 00000478 ____A C:\Windows\win.ini

2012-07-10 21:41 - 2012-02-29 17:50 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-07-10 17:38 - 2012-07-10 17:38 - 00001073 ____A C:\Users\Public\Desktop\????.lnk

2012-07-10 17:31 - 2012-07-10 17:31 - 00000000 ____A C:\Windows\LiveUpdate.INI

2012-07-07 16:09 - 2012-07-07 16:09 - 00000312 ____A C:\rkill.log

2012-06-17 19:16 - 2012-05-24 14:12 - 00005632 ____A C:\Users\Erica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-06-12 08:09 - 2009-07-13 21:08 - 00032582 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2012-06-11 19:08 - 2012-07-10 21:44 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-08 21:43 - 2012-07-10 16:49 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-08 20:41 - 2012-07-10 16:49 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-06-06 17:45 - 2012-06-06 17:45 - 00759334 ____A C:\Windows\SysWOW64\PerfStringBackup.INI

2012-06-05 22:06 - 2012-07-10 16:49 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-05 22:06 - 2012-07-10 16:49 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-05 22:02 - 2012-07-10 16:38 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-06-05 21:05 - 2012-07-10 16:49 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-06-05 21:05 - 2012-07-10 16:49 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-06-05 21:03 - 2012-07-10 16:38 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-06-05 14:26 - 2012-06-05 14:26 - 00001510 ____A C:\Users\Erica\Desktop\Warcraft III.lnk

2012-06-05 14:26 - 2012-06-05 14:24 - 00015153 ____A C:\Windows\War3Unin.dat

2012-06-05 14:24 - 2012-06-05 14:24 - 00126976 ____A (Blizzard Entertainment) C:\Windows\War3Unin.exe

2012-06-05 14:24 - 2012-06-05 14:24 - 00002829 ____A C:\Windows\War3Unin.pif

2012-06-03 11:59 - 2011-10-06 15:59 - 00000080 ____A C:\Windows\System32\Defrag.ini

2012-06-03 11:58 - 2011-10-06 15:46 - 00000184 ____A C:\setup.log

2012-06-03 11:52 - 2012-02-19 20:57 - 00045056 ____A C:\Windows\System32\acovcnt.exe

2012-06-03 07:45 - 2011-10-06 15:51 - 00002490 ____A C:\RHDSetup.log

2012-06-02 14:19 - 2012-06-21 16:03 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 14:19 - 2012-06-21 16:03 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 14:19 - 2012-06-21 16:03 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 14:19 - 2012-06-21 16:03 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 14:19 - 2012-06-21 16:03 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 14:19 - 2012-06-21 16:03 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 14:15 - 2012-06-21 16:03 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 14:15 - 2012-06-21 16:03 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 14:15 - 2012-06-21 16:03 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 04:49 - 2012-07-10 21:40 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 04:17 - 2012-07-10 21:40 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 04:12 - 2012-07-10 21:40 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 04:05 - 2012-07-10 21:40 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 04:05 - 2012-07-10 21:40 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 04:04 - 2012-07-10 21:40 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 04:04 - 2012-07-10 21:40 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 04:03 - 2012-07-10 21:40 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 04:01 - 2012-07-10 21:40 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 04:00 - 2012-07-10 21:40 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 03:59 - 2012-07-10 21:40 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 03:57 - 2012-07-10 21:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 03:57 - 2012-07-10 21:40 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 03:54 - 2012-07-10 21:40 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-02 01:07 - 2012-07-10 21:40 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-06-02 00:43 - 2012-07-10 21:40 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-06-02 00:33 - 2012-07-10 21:40 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-06-02 00:26 - 2012-07-10 21:40 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-06-02 00:25 - 2012-07-10 21:40 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-06-02 00:25 - 2012-07-10 21:40 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-06-02 00:23 - 2012-07-10 21:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-06-02 00:21 - 2012-07-10 21:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-06-02 00:20 - 2012-07-10 21:40 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-06-02 00:19 - 2012-07-10 21:40 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-06-02 00:19 - 2012-07-10 21:40 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-06-02 00:17 - 2012-07-10 21:40 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-06-02 00:16 - 2012-07-10 21:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-06-02 00:14 - 2012-07-10 21:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-06-01 21:50 - 2012-07-10 16:48 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-01 21:48 - 2012-07-10 16:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-01 21:48 - 2012-07-10 16:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-01 21:45 - 2012-07-10 16:48 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-01 21:44 - 2012-07-10 16:48 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-06-01 20:40 - 2012-07-10 16:48 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-06-01 20:40 - 2012-07-10 16:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-06-01 20:39 - 2012-07-10 16:48 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-06-01 20:34 - 2012-07-10 16:48 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-05-11 10:14 - 2012-07-12 18:20 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys